Microsoft Patches 398 Flaws, Including Zero-Day Exploited by North Korea's Lazarus Group

Key points

• Microsoft patched 398 vulnerabilities, with 42 rated as critical, including one actively exploited zero-day.
• The zero-day, CVE-2026-68820, is a privilege escalation flaw in the afd.sys driver, exploited by Lazarus in its 'Operation Dream Job' campaign.
• Four other critical flaws allow unauthenticated remote code execution on Windows DNS, Deployment Services, QUIC, and HPC Pack.
• AI has increased the volume of discovered vulnerabilities, but experts caution that AI-generated patches often fail or introduce new bugs without human testing.
• Security leaders are advised to prioritize patching based on exploit status and service reachability rather than just CVSS scores, and to avoid rushing updates without testing.

Background

This release follows a record-breaking July Patch Tuesday with over 570 fixes and a June release with nearly 200. Microsoft has attributed the surge in vulnerabilities to AI-assisted discovery. Previous coverage noted that organizations are struggling to keep up with the increased patch cadence, with some delays in applying updates to avoid system instability.

How outlets are covering it

Krebs on Security emphasizes the sheer volume of patches and the limitations of AI in fixing vulnerabilities, citing research showing LLMs fail more than half the time. The Hacker News focuses on the technical details of the zero-day and the four unauthenticated RCE flaws, highlighting the importance of service inventory for prioritization. The Register provides context on the Lazarus Group's 'Operation Dream Job' campaign, detailing the use of fake job offers and SEO techniques to deliver malware. Thurrott.com highlights the non-security features included in the update, such as new touchpad gestures and Windows Hello improvements.

Why it matters

The active exploitation of a zero-day by a state-sponsored actor underscores the urgency of patching, even for flaws with lower CVSS scores. The increasing volume of vulnerabilities, driven by AI, is straining security teams and highlighting the need for robust testing and human oversight in the patching process.

What to watch

Organizations should prioritize patching CVE-2026-68820 and the four unauthenticated RCE flaws, ensuring that exposed services are secured. Security teams should continue to test AI-generated patches before deployment and monitor for any misbehaving updates in the days following Patch Tuesday.