fourteen hundred and thirteen
Microsoft patched 1,413 vulnerabilities this week, more than it ever patched in a full year. The count doesn’t tell you how broken Windows is. It tells you how hard somebody looked. And once looking is that cheap, the response changes: you stop repairing pieces and start taking them off the board. That goes for bugs, for software companies, and for people.
On 13 October Microsoft shipped its monthly security update with 1,413 CVEs in it. Microsoft’s previous record for a whole year was 1,261, set in 2020. September’s release, the monthly record until last week, was close to a thousand.
One of them, a Windows Shell bug that lets a crafted file slip past Mark of the Web, was already being exploited. CISA put it on its known-exploited list.
One. Out of fourteen hundred.
a census of the looking
For twenty-odd years the Patch Tuesday number has been read as a reading on the software. A big month meant a bad month.
That reading always had a hidden term in it. A CVE doesn’t exist until somebody finds the bug, writes it up and gets it a number. So the count was never “how many holes are in Windows.” It was “how many holes people found this month,” and the finding was done by a fairly fixed, fairly slow population of researchers and bounty hunters. Hold the searchers constant and nobody has to think about the term.
The searchers aren’t constant anymore. In May Microsoft described MDASH, an internal system that runs more than a hundred specialised AI agents to find bugs and prove they’re exploitable. Pointed at five years of confirmed cases in one Windows driver, clfs.sys, Microsoft says it re-found 96% of them. Five years of human finding, replayed.
CyberScoop counted 26 Windows Shell vulnerabilities patched so far in 2026. In all of 2025 there were three. Windows Shell did not get nine times worse in a year. Dustin Childs at the Zero Day Initiative put it plainly: AI “isn’t creating these bugs out of thin air; it’s just shortening the time between a vulnerability existing and someone noticing it.”
1,413 is a measurement of the flashlight, not the room.
off the board
The interesting part is what you do once the flashlight is that bright.
A CVE is shaped like a human finding. One person, one bug, one advisory for an admin to read. A hundred a month is a long afternoon. Fourteen hundred is a job nobody has. Herbert Simon saw the general case in 1971: information consumes the attention of whoever receives it, so the more of it there is, the scarcer attention gets.
Simon also spent years on chess, and that’s the better lens. In 1973 he and William Chase summed up the experiments on how masters see the board. Show a master a real position for a few seconds and they put back about 93% of the pieces. A novice manages about a third. Scatter the same pieces at random and the master does no better than the novice. Masters don’t see twenty-five pieces. They see a handful of known shapes, like a fianchettoed castled king, and they read the position from those.
Alongside this release Microsoft’s security team published a post on what it calls risk cohorts: groups of CVEs “that require a similar customer assessment.” Windows filesystems, storage and backup, 136 CVEs. Office documents and mail, 135. Remote access and RDP, 65. The post is careful to say the cohorts don’t replace assessing each CVE.
Read past the hedging. That’s Microsoft learning to read the board the way a master does. And look at what the cohort question invites. Is RDP reachable from outside? The cheapest answer isn’t 65 patches. It’s taking RDP off the internet. Sixty-five bugs stop being your problem and you didn’t read one of them. A captured piece doesn’t get repaired. It goes in the box.
When finding is cheap, you don’t get more fixing. You get more removal.
the same flashlight
Bugs are just the easiest place to see it.
On 12 October Bending Spoons laid off what it called a “large part” of Airtable, five weeks after closing the purchase. Airtable was valued at $11.7 billion in 2021. Bending Spoons paid $1.28 billion. Federico Simionato, Bending Spoons’ product leader, said the cuts weren’t a reflection of anyone’s work. It was the company’s “deep belief that small teams ship more and better.” Nobody fixed Airtable. Someone read the position and took most of the pieces off. That’s the Bending Spoons pattern: SaaStr notes WeTransfer lost 75% of its staff within weeks of that deal closing.
People get the same treatment, and the word for it is “low performer.” In January 2025 Mark Zuckerberg told Meta he would “move out low-performers faster” and cut about 5% of staff, roughly 3,600 people. Meta said it typically managed people out “over the course of a year.” That year was the patch cycle. Fortune quoted one of the people cut, whose midyear review said “exceeds expectations.” Then Meta made “AI-driven impact” a “core expectation” in 2026 reviews, which is a bigger flashlight pointed at the same people. Accenture’s CEO put the policy in one sentence on an earnings call: “We are exiting on a compressed timeline, people where reskilling… is not a viable path.”
Reskilling is the patch. “Compressed timeline” is what removal sounds like when it’s said politely.
what that means for the pieces
I’ve run infrastructure for twenty years. For most of that time my work got judged the way CVEs used to be counted: by whoever had time to look, which was rarely and not very hard. That’s over. The same class of tool that found 26 Windows Shell bugs can read every commit, every ticket and every review thread I’ve written. My defect count is going to go up. Not because I got worse. Because somebody bought a brighter flashlight.
And here’s the part that should worry anyone who works for a living. The response won’t be a performance plan, the human version of a patch. It’ll be a cohort question, asked once for a hundred people at a time: does this position need these pieces? Airtable shows the answer doesn’t depend on how well you played. The pieces that stay on a board aren’t the ones with the fewest flaws. They’re the ones holding something the position needs.
So I’ve stopped asking how many bugs are in my work. I ask what question my work answers, and whether anyone would have to ask it if I were gone.
The exploited-to-found ratio this month was 1 to 1,413. Being found and being dangerous are not the same thing, and the board doesn’t care about the difference. 1,413 tells you how hard Microsoft looked. Your next review will mostly tell you how hard someone looked at you.
Sources: Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities, CyberScoop ↗ · Microsoft October Patch Tuesday fixes 1,400-plus flaws, eSecurity Planet ↗ · Using risk cohorts to prioritize security updates, MSRC ↗ · Microsoft’s agentic security system found four critical Windows RCE flaws, Help Net Security ↗ · Herbert A. Simon, Designing Organizations for an Information-Rich World (1971) ↗ · Herbert A. Simon and William G. Chase, Skill in Chess, American Scientist (1973) ↗ · Airtable’s new owner is laying off a ’large part’ of its team, Business Insider via Yahoo ↗ · Airtable just sold for $2.25B, SaaStr ↗ · Meta to cut 5% of staff, targeting lowest performers, Fortune ↗ · Meta’s low-performer layoffs draw criticism, Fortune ↗ · Meta is about to start grading workers on their AI skills, Business Insider via Yahoo ↗ · Accenture is cutting staff it can’t retrain, Business Insider via Yahoo ↗