Record 974-Patch Tuesday, LG TV Surveillance, and 150M ID Breach Define September Security Landscape

Key points

• Microsoft patched 974 vulnerabilities in September, with 113 rated critical and two zero-days (CVE-2026-81963, CVE-2026-85880) under active exploitation.
• Gamers Nexus found LG TVs collect screen content, audio, and network data even when tracking is disabled, with security flaws allowing local root access.
• IDScan was breached for at least a year, leading to the theft of 150 million U.S. driver’s license scans, including those of public figures.
• The Shai-Halud worm reappeared in NPM on September 7, 2026, infecting four packages despite repository scanning measures.
• Adobe confirmed active exploitation of CVE-2026-75650 in Commerce and Magento, allowing attackers to implant PHP code and steal payment data.
• Microsoft plans to block emails from unpatched on-premises Exchange servers to Exchange Online, targeting systems not updated since October 2025.

Background

This follows a trend of record-breaking patch volumes in 2026, with Microsoft’s July release fixing 570 vulnerabilities. Earlier in 2026, supply chain attacks like the TeamPCP campaign and Tata Electronics breach highlighted the growing risk of compromised software pipelines. The current surge in patches is attributed to AI-assisted vulnerability discovery, which has increased the volume of reported bugs across the industry.

How outlets are covering it

Ars Technica and Krebs on Security both emphasize the unprecedented scale of Microsoft’s September patch, attributing the surge to AI-assisted vulnerability discovery. However, they differ in tone: Ars Technica frames the increase as a 'new normal' driven by AI, while Krebs on Security highlights the operational strain on organizations trying to test and deploy so many fixes. Hackaday provides a broader security roundup, including LG TV surveillance and the IDScan breach, which are not covered by the other sources. ExtremeTech offers specific technical details on the patch counts and build numbers, while Krebs on Security focuses on the criticality of the flaws and the challenges for enterprise admins. All sources agree on the severity of the Microsoft patches but differ in their emphasis on the broader implications of AI-driven security changes.

Why it matters

The record-breaking patch volume highlights the growing complexity of maintaining secure systems in an era of AI-assisted vulnerability discovery. The LG TV findings raise concerns about the privacy and security of smart devices in the home, while the IDScan breach underscores the risks of centralized ID validation systems. The return of the Shai-Halud worm and active exploitation of Adobe Commerce flaws demonstrate the persistent threat of supply chain attacks and the need for robust security measures. Microsoft’s plan to block unpatched Exchange servers signals a shift toward stricter security enforcement, potentially impacting organizations that delay updates.

What to watch

Organizations should prioritize patching the critical Microsoft vulnerabilities, especially the two zero-days, and verify their build numbers to ensure updates are applied. Users should review LG TV settings and consider disabling smart features or disconnecting devices from the network to mitigate privacy risks. Businesses using Adobe Commerce or Magento should apply the latest patches immediately to prevent exploitation. Security teams should monitor for signs of the Shai-Halud worm in their NPM dependencies and ensure their repositories are scanning for known threats. Microsoft is expected to enforce its policy of blocking unpatched Exchange servers, which may force organizations to accelerate their patching processes.