6 ms·
Microsoft has released software updates to plug at least 570 security holes
- gerdesj 3mo ago"Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence." If only real intelligence found the fucking things instead. As ye sew, so shall ye reap!
- d0100 3mo agoAn employee just got phished by adding a number to a legitimate deviceAdd login route that bypasses 2FA and adds a device with full access to office and mail Probably working as intended...
- xorl 3mo agoI always click NO to these, that's full human error. edit: The underlying issue is that they send a 2FA before asking for a password at all.
- shakna 3mo agoSounds like one of ADOs recent security misconfiguration vulnerability announcements. The customer is blamed, for not quite hardening everything the right way, when ADO config is... A sizeable task.
- freitasm 3mo agoI wonder how many bugs will be introduced with these fixes...
- ronsor 3mo agoNo bugs, only intentional backdoors
- hulitu 3mo agoThey don't introduce bugs. They introduce feature experiences.
- gred 3mo agoEmergent product roadmap in action.
- windexh8er 3mo agoThat feature experience often crops up as a choose-your-own-adventure game! Looks like their users are loving it [0]. [0] https://www.neowin.net/news/it-admins-feel-overwhelmingly-sick-of-microsoft-and-windows-11-garbage-apps-products/ https://www.neowin.net/news/it-admins-feel-overwhelmingly-si...
- ColdStream 3mo agoFix one and add two. There used to be a brilliant weather app here in Oz back in the early days of iOS. I always loved the update notes the author provided. One was "Fixed one grammatical error and introduced another one, can you find it?"
- Cthulhu_ 3mo agoIt depends on how good their testing practices and code review / auditing are. I want to believe they are some of the best in the industry, but that's making assumptions. But jumping to assumptions that fixes introduce bugs is a bit rash and assumes incompetence / unprofessionality / unmonitored AI usage / kneejerk bugfix processes.
- 3mo ago
- naturalmovement 3mo agoSounds like a lot but compare it to Edge also being patched for 428 Chromium CVEs this month. If 20 years ago you told me a single piece of software had 428 vulnerabilities I wouldn't have believed it. If Chromium has that many security bugs, perhaps the move fast and break things approach of spraying diarrhea masquerading as code into a keyboard — in a rush to add new features no one asked for — needs to be reexamined.
- georgemcbay 3mo ago> If 20 years ago you told me a single piece of software had 428 vulnerabilities I wouldn't have believed it. For something as complex as an operating system or a web browser, even one from 20 years ago (say, Windows XP or IE/Firefox) I wouldn't have believed there were 428 vulnerabilities either, I would have assumed there were much more than that.
- dylan604 3mo agoEven if it had the Microsoft logo attached? Windows was always known to not be the most secure of products. I can't imagine anything else from the same company would be any better
- deleted 3mo ago[deleted]
- tokioyoyo 3mo ago20 years ago software wasn't as much battle tested as today, had way less feature set, was less connected to the internet, and etc. 428 CVEs looks small, assuming not all have CVSS 9.8 or something.
- lousken 3mo agoIt was more tested as real testers were testing it. Nowadays, AI just checks the code.
- 3mo ago
- lousken 3mo agoIt would be nice if microsoft had windows update for .net, visual c++, office, windows, edge ... just all their software in one updater, but that would be too easy...
- nobodyandproud 3mo agoYou mean…service packs?
- anonymars 3mo agoNo, "Microsoft Update" is what it was once called (see e.g. https://learn.microsoft.com/en-us/windows/deployment/update/update-other-microsoft-products https://learn.microsoft.com/en-us/windows/deployment/update/...)
- Cthulhu_ 3mo agoCan't believe that at one point Windows could do updates through a browser interface. I mean we've gone full circle and are now deploying browser interfaces as full blown applications to get around the bit where you give a browser system access, but still.
- nobodyandproud 3mo agoUmm, yeah…I was going to let this go but “Microsoft Update” is a later, more annoying though perhaps necessary turn of events. https://en.wikipedia.org/wiki/Service_pack https://en.wikipedia.org/wiki/Service_pack https://microsoft.fandom.com/wiki/Windows_service_packs https://microsoft.fandom.com/wiki/Windows_service_packs
- anonymars 3mo agoWhat context are you responding to? > It would be nice if microsoft had windows update for .net, visual c++, office, windows, edge ... just all their software in one updater...
- 3mo ago
- charonn0 3mo agoIt seems like bug hunting might be the one area where AI is actually making the world a better place.
- ashleyn 3mo agoHow many were introduced by misuse of AI coding/vibe coding though?
- DANmode 3mo agoHow many were known, and put on the roadmap because war got hot?
- iJohnDoe 3mo ago[flagged]
- stackghost 3mo agoAt Microslop? Evidently, lots.
- miffy900 3mo agohighly unlikely for many of them. SharePoint, bitlocker, Active directory, hyper-v, rdp, DHCP and MSMQ are all software/technologies that have decades of history and long pre-dated LLMs. seriously, do people not realise it was entirely possible to write insecure or bad code before LLMs?
- kingforaday 3mo agoFull July 2026 Summary: https://www.bleepingcomputer.com/microsoft-patch-tuesday-reports/Microsoft-Patch-Tuesday-July-2026.html https://www.bleepingcomputer.com/microsoft-patch-tuesday-rep...
- ReactiveJelly 3mo agoThey should patch that Global Device ID thing :^)
- fuckinpuppers 3mo agoThis is great. Now ask Mythos to make windows suck less and let it go crazy.
- ColdStream 3mo agoDeletes Windows 11 Installs Windows 7 with new patches
- throwaway27448 3mo agoWhat would be the point of any of this if the registry is still there? It'd just a particularly shit version of linux window management that happens to run games well
- Cthulhu_ 3mo agoThe registry was never an issue tbh, it's just a database that some companies decided to fearmonger about to sell you "registry cleaners". But if I'm wrong, please do point us in the direction of known issues with the registry.
- tonyedgecombe 3mo agoIt was easy to corrupt in the early days and performance was poor as it grew in size. That was a long time ago though, it’s pretty solid now and has some benefits over storing settings in a bunch of text files such as more granular permissions.
- throwaway27448 3mo agoThe registry absolutely is an issue—it's everything bad people make the command line out to be except ten times worse because they haven't bothered to fix it in forty years. You need to cooy and paste an incomprehensible string off the internet just to set the functionality of the caps lock key or rewire a file extension. Just straight up dogshit softwareif you weren't raised in the cult
- 3mo ago
- devin 3mo agoHow many are chained, and how many patches are defense-in-depth after discovering chained paths to that flaw?
- dhx 3mo agoTitle is not correct. Microsoft didn't patch a lot of this, they're reporting patches for dependencies that other people patched and Microsoft are inheriting. For example, Mariner (now branded Azure Linux) is a Microsoft-supported Linux distribution. So in this list of 570 vulnerabilities, Microsoft have reported 100 vulnerabilities inherited from all sorts of open source software projects included in their Azure Linux distribution. The OpenSSH vulnerabilities are described in better detail at https://www.openssh.org/releasenotes.html https://www.openssh.org/releasenotes.html where it implies 2 vulnerabilities were detected with Swival Security Scanner (using LLMs) and another 6 by other researchers/companies (using undisclosed methods). As an example of one of the OpenSSH vulnerabilites CVE-2026-59996 which is attributed to Swival Security Scanner, Swival have published the output of their automated vulnerability detection report at https://github.com/Swival/security-audits/blob/main/openssh/003-source-server-escapes-remote-target-directory.md https://github.com/Swival/security-audits/blob/main/openssh/...
- yread 3mo agoThey did patch a lot of cves in dotnet: https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-july-2026-servicing-updates/ https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-fram... Releases without cve patches used to be quite common, max ive seen before were 3
- JSTucker 3mo agoIf you want an easy way to view these I made https://wofa.dev https://wofa.dev to keep track of windows updates and security patches in a single place
- shevy-java 3mo agoIt is time to abandon Microsoft.
- tonyedgecombe 3mo agoMicrosoft has its place but I’m not sure that includes personal computers anymore.
- alex_duf 3mo agoWhile I do think it's wise for people to start looking at alternatives, I don't think this specific news should sway one way or another. Windows (like Linux or macos) contains an enormous amount of code, and with large code-bases you're certain to have security issues. Finding these security issues and fixing them seems like a good idea, no matter how much you love or hate Windows.
- HeatrayEnjoyer 3mo agoCode can exist without vulnerabilities. Verifiable proof exists. It is hard, but it is possible.
- lionkor 3mo agoIf I find a bug in very important MS products, I usually do report them using their shitty feedback app. Not once has any of that yielded anything. Maybe a way to find tons of high impact bugs would be to let MS developers access those bug reports?
- 7bit 3mo agoThere's more direct channels to report security vulnerabilities - which this about.
- transcriptase 3mo agoPerhaps the feedback boxes they put in every app should actually be read. That’s a them problem.
- voakbasda 3mo agoThose boxes are not there to generate feedback. They are there to placate the user by implying that their voice will be heard.
- wafflemaker 3mo agoI reported 3 errors/feature requests in Oura Ring app. After going through the reporting process I felt much less irritated at the bugs and smiled to myself thinking that must have been the purpose of the reports. To my astonishment, 3-4 months later they fixed the errors and rolled out the feature I asked about. WTH, people read those reports? I know people do, I often get in touch with support for various services, knowing that in the sea of people not giving feedback, your comments mean a lot. But up until recently both the Oura App and their support was very mediocre. Where's my enshittification?
- nar001 3mo agoI guess Oura hasn't heard the feedback about outsourcing their support/engineers yet! Enjoy knowing you made their app better, I'm sure with time it won't work anymore, sadly
- ozim 3mo agoGets me wondering if it is real or they just got a backlog quick fixes dropped so it looks like AI bug hunting really works to prop up their AI bullshit narrative.
- 1vuio0pswjnm7 3mo agoThe attack surface of Windows is infinite As one door closes, another opens "Features" "Fixes" Job security Security holes The threat model is Microsoft
- ipgleg 3mo ago[flagged]