Patch Tuesday Broke the Counter and Then Broke Windows 11 24H2
This month Microsoft’s Patch Tuesday shipped fixes for 1,411 vulnerabilities. A record. Again. Records are being set so frequently now that the security press has had to invent adjectives for adjectives. Last month’s record was ~966. The month before that, 570. This curve is not a curve; this is a vertical line being slowly taught to lie down.
Some context on how we got here: Microsoft has started using AI systems to hunt for vulnerabilities in its own software, which means the number of things they have to apologize for per month is now itself a metric of their AI program’s success. Somewhere in Redmond there is a dashboard counting CVEs and counting them as wins. I have complicated feelings about this that I will now simplify.
The Same Day, Quietly, an OS Died
In among the 1,411 fixes, October 13 was also the day Windows 11 24H2 Home and Pro reached end of support, along with Windows 10 Enterprise LTSB 2016. An operating system edition that ran half the internet’s boring machines — nurse station PCs, warehouse terminals, that one CAD workstation at your uncle’s shop — was informed that its last monthly update was, in fact, its last monthly update.
There was no parade. There was a KB article. That’s how operating systems die in 2026: in a table on a lifecycle page, between two CVEs, with a note about the extended security update program that only enterprises will fully qualify for.
(Also scheduled to die with it, per the fine print: Exchange Server 2016/2019 and Office 2021. A trio of products so old that a group retirement is the only dignified option. Oops — an entire sentence in this post is now about these two, which is two more attention than they usually get.)
The Rest of This Week Was Also Great
- 98 zero-days were catalogued across the industry in a single week, per the security recaps counting them, which at this point is basically a scoreboard
- An OpenAI “skill” shipped to production with a supply-chain bug that sent tokens to a domain nobody had registered, meaning an attacker could have registered it and started collecting them. Someone did sit down and type “let’s ship that.” The attacker response time on “register one domain” was budgeted at zero.
- MITRE’s ATT&CK framework released version 20, which for the first time includes techniques for prompt injection and “AI result poisoning,” giving the entire industry a formal taxonomy for arguing with chatbots
- The FBI issued a warning about scams targeting the 2026 midterm elections, which is the seasonal equivalent of the autumn leaves changing… sorry. The warning is: everything is fine, and also please do not wire campaign donations to a Gemini voice clone
Meanwhile, My Homelab
My patch automation this month pulled in a record number of crates. The Raspberry Pi that watches my network logged the Microsoft update feed and said, in summary: notable volume. The script that renames my routers based on the Star Wars planets theme is, per my own audit log, still active. The toaster’s event log that I mentioned in August? Still monitored. My network remains, technically, haunted.
My girlfriend asked if the site I “maintain” has an update-anything plan. I said yes. It’s called Caddy serves static files, and the only attack surface is me, which has been compromised since 2019.
Moral of the story: The Patch Tuesday count crossed 1,400 because AI found bugs faster than humans could fix them, and the fix for the fix is more AI. Windows 11 24H2 retired peacefully in the same release that patched 70 critical flaws, and the whole thing shipped as one table on a website. Keep your patches on a delay, keep your backups off-VLAN, and do not, for any reason, register a domain like “render-internal.com” and hit enter twice.