Crisis and continuity · 6 October 2026
966 is not a decision
On 8 September Microsoft published the largest Patch Tuesday on record. The board that argues about the number has already lost the hour.
By Rafael Núñez Aponte. Published on 6 October 2026.
Original text in Spanish. Read the original Spanish version
On Tuesday 8 September Microsoft published the largest patch bundle on record. BleepingComputer counted 966 flaws in what shipped that day. Malwarebytes arrived at 964: it subtracts the ones Microsoft fixes only in the cloud. Microsoft’s full list is higher.
The round number does not matter. The meeting that stays there has already lost the hour.
The two that do not wait
CVE-2026-81963 sits in the Windows Update stack. An attacker who already has a foot on the machine can reach SYSTEM. CVE-2026-85880 sits in ALPC, the channel Windows processes use to talk to each other. Same logic. They do not open the street door. They promote whoever is already inside.
BleepingComputer marked 105 as critical. Nobody patches one hundred and five at five on Tuesday. Someone has to say which ones are this week’s. If that someone is a sheet sorted by severity, the decision has already been delegated.
What to ask on Monday
- What is this week’s short list, and did a person sign it or a score?
- Are the two Microsoft marked as exploited on executive machines, or in the general queue?
- How many days does the company measure between the bulletin and the patch installed, not the patch announced?
- Which internet-facing box sits outside that Tuesday and can still stop the operation?
References
- Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days. BleepingComputer. Accessed: 2026-10-06. El martes 8 de septiembre de 2026 Microsoft publicó, según este recuento, 966 fallos, 105 de ellos críticos, dos ya explotados: CVE-2026-81963 en la pila de Windows Update y CVE-2026-85880 en ALPC.
- Microsoft fixes record 964 flaws, including 2 exploited zero-days. Malwarebytes. Accessed: 2026-10-06. Malwarebytes cuenta 964 fallos que el cliente debe parchear, porque resta los que Microsoft corrige solo en la nube. Los dos explotados son los mismos.