When your vendors ship more patches than you can read

Sometime this year your update notifications stopped being background noise. Microsoft’s 14 July 2026 Patch Tuesday shipped fixes for at least 570 security holes in a single release, nearly 60 of them rated critical [2]. August fixed another 421, with 236 of those in Windows alone [3]. If you run a business on a laptop, a phone, a website and a dozen software subscriptions, nobody has told you what you are supposed to do with a number like that. Reading the advisories is not a real option. Ignoring them is what you were already doing, and it now feels worse.

The cause is not that software suddenly got worse. It is that vendors turned AI loose on their own source code and found what was already there. This guide is a routine for a business with no security staff and no appetite for one: what to automate, what to put on a calendar, and which single signal to use when you have to decide whether something matters this week. If you have a security team, a compliance auditor, or customer data sitting under a regulator’s eye, you need a documented vulnerability management program, and this is not that.

Patch counts nearly tripled in a month, and they are not coming back down

The clearest public account of why comes from ProPublica, which on 29 July 2026 reported on a recording of an internal Microsoft meeting about the company’s use of Mythos, an Anthropic model. Anthropic “had given access to select organizations that make software used by regular people, companies and governments across the world” [1]. One slide showed that in April alone, Mythos had uncovered 90 critical bugs and 141 important ones in SharePoint [1]. After those categories were cleared, the group would begin work on roughly 300 moderate ones [1]. The version Microsoft was using, Claude Mythos Preview, was surfacing bugs faster than the company could patch them, and a manager said engineers were in “a mad dash” to close the gap [1].

You can watch the consequences in public. June’s release was already an all-time high at more than 200 fixes [1]. July’s total was “almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month” [2]. Microsoft’s Pavan Davuluri, quoted in Krebs’s write-up of that release, put it plainly: “The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis” [2].

Treat that as a description of the whole industry rather than a story about one company. Microsoft is simply the vendor whose numbers are public and whose internal meeting leaked. Rapid7’s read on August’s slightly smaller 421 is the line worth keeping: “There is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026” [3]. Whatever you run, the release notes are going to stay long. Any plan that depends on you reading them is already dead.

The list of bugs actually being attacked barely moved

Here is the part that almost nobody says out loud, and it is the reason you can stay calm. A patch count is a measure of what defenders found. It is not a measure of what attackers are using.

CISA maintains a catalog of known exploited vulnerabilities: flaws recorded as exploited, not merely discovered, each with a date CISA added it and a required action [4]. As of catalog version 2026.09.04 it held 1,695 entries in total [4]. Between 1 January and 4 September 2026 CISA added 211 of them, against 245 additions across the whole of 2025 [4]. That is a modest increase in pace, not a tripling. Narrow it to Microsoft products specifically and the gap is starker: 36 Microsoft entries added so far in 2026, against 39 in all of 2025 [4].

So one vendor’s monthly fix count nearly tripled while the count of that vendor’s products confirmed under active attack stayed roughly flat. The flood is a discovery flood. The attack surface that is actually being walked through is a much smaller, much slower-growing set, and somebody else maintains the list of it for free.

That does not mean the risk is imaginary. Verizon’s 2026 Data Breach Investigations Report found that “31% of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in”, and that “48% of all breaches now involve ransomware” [5]. Unpatched software is now the most common way in [5]. But the holes actually being used run to a few hundred a year, and much of what gets added is not new: 78 of the 211 entries CISA added in 2026 carry a CVE identifier issued in an earlier year, and the required action on essentially every entry is to apply the vendor’s own updates or mitigations [4]. The fix usually already existed.

Automatic updates are most of your security program

For nearly everything a small operator runs, the correct patch strategy is to not have one. Turn on automatic updates on every operating system, browser, phone and app, accept the restart prompts within a day rather than dismissing them for three weeks, and you have covered the large majority of your exposure without reading anything.

The failure mode is not that you missed an advisory. It is a device or an install that quietly fell off the update track: the old laptop in the cupboard that a family member still uses for invoicing, the phone that stopped getting security updates two years ago, the browser on the machine you only boot for one accounting program, the second Wi-Fi router nobody has logged into since it was installed. Each of those is running software whose bugs are now being found far faster than before and fixed on a track you are not on.

Operating system end-of-life is the version of this that catches most small businesses, because it is a date rather than a notification. Windows 10 reached end of support on 14 October 2025 [7]. Microsoft’s consumer Extended Security Updates program includes “critical and important security updates only” and “does not include new features, customer-requested non-security updates, or design change requests”, and it runs through 12 October 2027 [7]. Enrolment costs nothing if you sync PC settings with Windows Backup, or 1,000 Microsoft Rewards points, or a one-time payment of 30 US dollars plus tax, and one licence covers up to 10 devices [7]. If any machine in your business is still on Windows 10 and not enrolled, that is a larger real-world problem than every advisory you have not read this year.

The self-hosted corner is where the work actually lives

Everything you rent, somebody else patches. Everything you host, you patch. That distinction is the entire map of your remaining workload.

If your business is a set of subscriptions, the vendors absorb the flood on your behalf and your job is limited to keeping your own devices current. If you have put anything on a server, the picture changes: a WordPress site with plugins, a Docker container running an automation tool, a small database, a VPS you set up for one thing and forgot about. There you are the patch team, and nothing arrives to remind you.

n8n is a fair example because the project publishes its own guidance and because self-hosting it is a common small-business choice. Its documentation recommends updating a self-hosted instance at least once a month so you avoid several version jumps at once, checking the release notes for breaking changes, and using a test instance before you touch production [8]. That is roughly the right shape for any self-hosted thing you own. Once a month, in one sitting, on a calendar entry you actually keep.

Cost this out honestly before you add another self-hosted service, because the number is the real argument for paying for the managed version instead.

“Low” is a severity rating, not a verdict

The obvious way to cope with a 570-item release is to filter it: install the critical fixes, defer the rest. Two problems with that, and both come from the people who define the ratings.

The first is chaining. Vinh Nguyen, a senior technical adviser to Anthropic who formerly served as chief AI officer and chief data scientist at the National Security Agency, put it this way in the ProPublica reporting: “The problem now is that you can chain four low-level flaws, and that can equal a high severity” [1]. Severity is assessed per bug. Attacks are assembled from several. A queue of individually unremarkable issues is not the same thing as a safe queue.

The second is that the scoring standard says so itself. The CVSS v4.0 specification states that the Base Score “reflects the severity of a vulnerability according to its intrinsic characteristics which are constant over time and assumes the reasonable worst-case impact across different deployed environments” [6]. It is a property of the bug, not of your business. The same document tells consumers to use CVSS “as input to an organizational vulnerability management process that also considers factors that are not part of CVSS in order to rank the threats to their technology infrastructure and make informed remediation decisions” [6]. It also has a separate Threat metric group, including Exploit Maturity, which adjusts severity for the availability of exploit code and for evidence of exploitation [6]. That is precisely the information a base score leaves out and the exploitation catalogue supplies [4].

The practical version for a business your size: do not build a rule that says “critical only”. Build a rule that says “everything, automatically, on a schedule”, with one exception for anything appearing on the exploited list, which you patch the day you see it.

Where AI reads the pile for you, and where it makes things up

There is a genuine use for Claude or ChatGPT here, and it is narrower than it first looks. Paste a release note or a vendor advisory and an inventory of what you actually run, and ask which items in the notes touch anything on your list. That converts a long document into a short answer, and it is a summarisation job of exactly the kind these models handle well.

The failure is on the other side. A model does not know what you run, what version you are on, whether a feature is enabled, or whether you are internet-facing. Ask it whether a given vulnerability affects you and it will produce a fluent answer built on assumptions it invented about your setup. It may also produce vulnerability identifiers that look plausible and are wrong, or describe an advisory it has no current access to. Treat any output about your specific exposure as a draft question to check against the vendor’s own advisory, never as a finding.

So keep a plain text inventory file. Every device, every self-hosted service and its version, every domain and where it is hosted, every subscription that holds customer data. It takes an hour once. It is what makes the summarising step useful, it is what you reach for when a vendor discloses something serious, and it is the difference between knowing what you have to check and guessing.

What still goes wrong

Automatic updates break things. A patch that arrives on Tuesday and takes down the one accounting application your business runs on is a real cost, and the advice to accept restarts within a day is easier to give than to follow when you invoice on the last day of the month. The honest mitigation is unglamorous: know which single application would hurt most if it broke, keep a way back to the previous version of it, and take that one machine’s updates on a Friday rather than a Monday.

The exploitation catalogue is a lagging indicator. An entry is added once exploitation is known, which by definition is after somebody was attacked [4]. It will never contain the flaw being used against you first. It is a good triage signal precisely because it is conservative, and a bad early-warning system for the same reason. Nothing in this routine protects you from a genuinely novel attack, and nothing available to a business without a security team does.

None of this addresses the imbalance inside your vendors that the ProPublica reporting exposed. The model was “surfacing bugs faster than the tech giant could patch them”, and the group meant to field those bugs, the Microsoft Security Response Center, “has been perennially understaffed” because, in the reporting’s words, “Plugging security holes is a cost center, while making new products is a profit center” [1]. You cannot close that gap from outside. What you can do is make sure that when a fix does ship, it reaches you in hours rather than never, and that you have a short written list of what “you” consists of. That is the whole of it, and it is the part that is actually within your control.