September's Windows Update Fixed 966 Things and Broke the Other Things
Microsoft shipped the largest Patch Tuesday in the history of the company last week. 966 vulnerabilities fixed in a single release. 105 of them critical. Two actively-exploited zero-days. That is not a servicing event; that is an act of penance. A number so large that security publications couldn’t even agree on the total — 964, 966, 973, 974, depending on who counted the cloud stuff — which tells you everything about the current state of counting things at Microsoft.
By Thursday, their own health page was a live action painting. Let me read you the highlights.
What the Biggest Fix in Company History Broke
The update fixed a record number of vulnerabilities, then broke:
- Remote Desktop Services for huge numbers of people. The blast radius included MMC, File Explorer, the Windows Update page itself — which now hung forever on a loading spinner while you tried to update Windows to fix Windows. There is a haiku in there somewhere, but bitterness doesn’t scan.
- USB audio class 1.0 devices, which now display “Code 10” like a sad little error haiku of their own. Imagine rebooting into a machine where your headphones have casually declared bankruptcy.
- AMD Radeon GPUs, which crashed on driver instability that reinstalling the driver did not fix. AMD users paid for the sins of the Windows Update stack, which is tradition.
- File History backups stopped detecting external drives, the single most important feature being broken at the exact moment 966 security holes were being sealed off. Security through nothing, apparently.
- Domain trust, at least for a brutally specific population: machines with Credential Guard that pushed them into something called “Machine Identity Isolation,” which is only supported on Server 2025 domain functional levels. Entire domains checked and discovered their computers no longer believed in them.
And the personal detail that made me sit down: somewhere in the notes, Microsoft acknowledged that Claude Cowork was nonfunctional on some systems because the update broke the Plan9 shared folders inside the Linux VMs it manages. Microsoft, island of enterprise subsystems, writing a known-issue saying “some users’ Claude Cowork is off because Plan9.” In 2026. The Plan 9 protocol from Bell Labs. A direct line from Ken Thompson’s era to agentic AI in a virtual box. I am emotional.
The Out-of-Band Emergency Patch
The out-of-band patch landed quickly. The taskbar is now movable again, which Microsoft’s own release notes describe as restoring a feature “we’ve had since Windows 95.” Somewhere in Redmond there is a PM who got an email with the heading “RE: RE: taskbar” and spent a day apologizing to 26-year-old decisions.
In solidarity, my own update script for the homelab — which pipes Windows update checks into a Telegram bot that reports “CHANGES: N, RISK: vibe” — reported 966 changes and a risk level of “vibe,” which it correctly does not allow me to override. I did not override it. I did not sleep the night of the 9th either. Priorities.
What I Actually Do Now
I run a strict regime of Not Updating Things For Exactly Two Weeks, Then Updating, known industry-wide as the “wait, that one” approach to patching. My Windows box in the rack gets the update, on a delay, on a Wednesday morning, WITH coffee, while I watch the health page like it’s a dull horror film. This month the health page had a plot arc.
My girlfriend’s Windows laptop updated instantly. Then it updated again. Then it found a third update to do, just as I finished explaining that Windows 11 25H2 is fixed and stable. She asked what the third update was. I said “breaking the taskbar fix.” She said the taskbar had not been moved. It is now. Genuinely.
Moral of the story: They fixed 966 things at once and broke the ability to fix things. Patch discipline is not paranoia — it is a calendar block, a coffee, and two weeks of letting other people’s infrastructures suffer first. Windows 95 had a movable taskbar. In 2026 we received it back as a fix for an update to a fix. Nothing in this industry ever ends. Nothing in this industry ever ships complete. Nothing in this industry ever learns.