569 CVEs: AI drives Microsoft's largest ever Patch Tuesday
What it really says
Microsoft's Patch Tuesday on July 8, 2026 shattered all previous records: 569 security vulnerabilities (CVEs) were patched, including 56 rated critical and two zero-day flaws already actively exploited by attackers (CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server). The number is more than triple the previous record of approximately 200 CVEs set in June 2026, which itself was considered historic. Microsoft confirmed that its AI-powered multi-model scanning system MDASH (Multi-Model Agentic Scanning) autonomously discovers vulnerabilities. In parallel, Anthropic's AI model Mythos discovered 271 vulnerabilities in Mozilla's Firefox browser in April 2026 and developed working exploits for 181 of them. Mozilla now releases security updates weekly instead of monthly. The trend affects the entire industry: software vendors are shifting from monthly to shorter patch cycles as the window between patch publication and attacker exploitation can shrink to just hours.
Our assessment
569 vulnerabilities in one month, triple the previous record. Microsoft's AI system MDASH finds flaws faster than human researchers, and Anthropic's Mythos discovered 271 Firefox vulnerabilities in a single run. The numbers paint a dual picture: AI is making software more secure in the long term by finding bugs that went undetected for decades. At the same time, an arms race is emerging where attackers also use AI to exploit vulnerabilities faster. For IT departments, this means a new reality: monthly patch cycles are no longer sufficient. Organizations that don't update within hours risk being attacked. The trend is real and accelerating, but it does not mean software is becoming less secure. On the contrary, more discovered flaws mean more stable products over time.
Relevance for Germany
This development has immediate practical consequences for German businesses and government agencies. The BSI (Federal Office for Information Security) has long recommended timely patching as a baseline security measure, but when patch frequency triples, IT departments must fundamentally restructure their processes. Small and medium-sized enterprises and municipal governments are particularly affected, as they often lack resources for weekly update cycles. The EU Cyber Resilience Act (CRA), taking effect in 2027, will require manufacturers to deliver faster security updates. The combination of AI-accelerated vulnerability discovery and regulatory pressure is forcing German software vendors and IT service providers to automate their patch processes.
Fact check
The figure of 569 CVEs in July's Patch Tuesday is consistently documented by Tenable, Security Boulevard, and Help Net Security. CyberScoop describes it as tripling June's record. The two actively exploited zero-days (CVE-2026-56155 and CVE-2026-56164) are confirmed by Tenable and Windows Forum. DarkReading reports on the triage pressure from the rising numbers. Microsoft's confirmation that MDASH autonomously discovers vulnerabilities is cited by DarkReading and CyberScoop. The 271 Mythos-discovered Firefox vulnerabilities are documented by the Cloud Security Alliance and the World Economic Forum. heise online reports on the industry-wide shift to shorter patch cycles.
Source
- • https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164
- • https://www.darkreading.com/vulnerabilities-threats/records-broken-patch-tuesday-raises-triage-stakes
- • https://cyberscoop.com/microsoft-patch-tuesday-july-2026/
- • https://www.heise.de/news/Lueckenflut-durch-KI-Funde-Software-Hersteller-schrauben-an-Patch-Strategien-11360569.html