Microsoft is expanding the number of fixes delivered in each Patch Tuesday release for Windows 11 by using AI to surface potential security issues earlier. The adjustment comes amid rising AI-assisted vulnerability hunting and exploitation by both attackers and security researchers.

This shift responds to the growing trend of hackers, including those with limited skills, turning to AI tools to discover and weaponize flaws more rapidly in recent months.
Microsoft stressed that although AI will play a bigger role in spotting and addressing security problems, its developers will continue to validate the results and "make risk-based decisions" on which changes to ship.
Microsoft's integration of AI into its Secure Development Lifecycle and update validation pipeline signals a necessary evolution in enterprise security operations to match the speed of AI-augmented threats.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Microsoft disclosed CVE-2026-108452, an 8.8 path traversal RCE in SharePoint Server Subscription Edition before 16.0.20326.20190. KB5002927 fixes it; an authenticated Site Owner can exploit it over the network.
Microsoft disclosed CVE-2026-109468, a 7.5 ASP.NET Core denial-of-service flaw affecting Visual Studio 2022 before 17.14.42, Visual Studio 2026 before 18.10.4, and System.Formats.Cbor before 10.0.13.
CISA added AhsayCBS flaws CVE-2026-105134 and CVE-2026-105133 to its Known Exploited Vulnerabilities catalog on October 14, with an October 17 deadline for federal agencies. Attackers are chaining them to plant webshells and cryptominers, and Ahsay says its first patches did not fully fix them.
Apple has expanded its App Store rules to require developers to proactively prevent and remove AI-generated deepfakes and nonconsensual intimate imagery. The changes also target hidden nudify features and extend existing bans to alternative app distribution.
bbs-go through 4.4.6 has a Google One Tap login flaw (CVE-2026-111639) that skips ID-token audience checks, letting attackers replay tokens from any OAuth client to take over Google-linked accounts. VulnCheck rates it 8.1 (CVSS 3.1) and 8.6 (CVSS 4.0).