Engineers at Microsoft typically enjoy a quieter summer to take vacations and spend time with family, as is common at many companies. But this year, the season has been unusually busy for Windows and security engineers, thanks to new AI models that are discovering software vulnerabilities at a rapid pace. Sources tell me that Microsoft will set another patch Tuesday record today, the third in just a few months.
It all kicked off in April when Anthropic's new Mythos model found security vulnerabilities in “every major operating system and web browser.†A few weeks later, OpenAI released its own cybersecurity-focused model to trusted partners. Sources familiar with Microsoft's security work tell me both of these models have contributed to a record-breaking series of patch Tuesdays over the summer period.
Microsoft typically patches around 100 flaws every month, but in June it set a new record of around 200 fixes. July's patch Tuesday was even bigger, with Microsoft patching at least 570 security holes, almost triple the number of June's record-breaking release. Microsoft engineers had a chance to catch their breath a bit in August when they plugged nearly 400 security vulnerabilities.
I understand today's September patch Tuesday is about to set a new record, with more than 650 security fixes for Windows alone. That's six times the number that usually got patched before the AI models arrived. Engineers have been busy over the summer verifying fixes for hundreds of important patches, which include remote code vulnerabilities, privilege escalations, and more.
As Microsoft uses more and more security-focused AI models to discover software vulnerabilities, the number of flaws that need patching keeps increasing. While today's patch Tuesday is another record-breaking event, I wouldn't be surprised to see this record broken again — particularly if there's another model advance soon.
Like many other software companies, Microsoft is urgently hunting for vulnerabilities before the advances in AI let malicious actors exploit undiscovered weaknesses in Windows, Azure, and other software. While Microsoft is issuing an unusual number of fixes, the sheer amount is also putting pressure on businesses that rely on Microsoft's software to apply the patches as soon as possible.
IT admins typically have to test patches from Microsoft to ensure any fixes don't interfere with critical business applications. This process can create what's called a “patch gap†between a vulnerability being disclosed and people applying the fix. In an AI era of security vulnerabilities being rapidly discovered and disclosed, there's a huge amount of pressure on businesses to close the patch gap.
Anthropic discovered earlier this year that Mythos could even create working exploits for newly disclosed software vulnerabilities in a matter of hours, instead of weeks. This puts businesses at risk of being hit by an exploit if they don't patch soon enough. It's particularly risky if Microsoft discovers remote code vulnerabilities that are easy for hackers to exploit.
The patch gap has always been a risk in cybersecurity, but with the sheer volume of vulnerabilities being discovered in the AI era, I'm sure we'll see Microsoft and others warning companies once again to apply patches as soon as they're released. When hundreds of vulnerabilities are now being discovered every month, time is very much of the essence.
Forza Horizon 6 isn't racing onto the PS5 this year
Microsoft is planning to delay the release of Forza Horizon 6 on PS5, according to sources familiar with Playground Games' plans. While the game was initially announced as coming to PS5 later this year, I understand there's going to be a slight delay, pushing it into early 2027.
Forza Horizon 6 has been hugely popular on Xbox and PC, and the previous instalment of the series, Forza Horizon 5, proved popular on PS5, after Microsoft released it on Sony's console last year. I understand that the PS5 release delay is more about lining up with the first expansion for Forza Horizon 6, than anything else. Forza Horizon 6 first debuted on Xbox and PC on May 15th, and I'm expecting it to launch on PS5 ahead of the 12-month anniversary mark.
- Microsoft is enabling a Windows 11 security feature that can hurt gaming performance. Microsoft is getting ready to roll out its memory integrity security feature for Windows 11 to more devices next month. The kernel-level protection feature is designed to stop malicious code or drivers running on a Windows 11 machine, but it also impacts PC gaming performance on certain CPUs. There's less of an impact if you have a more modern CPU, but you might notice more of a frame-rate drop in select games on older processors. Microsoft won't automatically enable memory integrity again next month if you've already previously disabled the feature.
- Microsoft is turning off text predictions in Word and Outlook. It turns out that a lot of people hate text predictions in Word and Outlook, so Microsoft is turning them off by default. The feature was supposed to help you write documents and emails faster by guessing what word you'd type next, but Microsoft's predictive text could often be more of a distraction. The change is rolling out on Word for Windows, iOS, and Android, as well as Outlook on Windows and Mac.
- Microsoft discloses Azure revenue as part of major financial reporting changes. Microsoft is changing how it reports its finances to investors by splitting its businesses into two segments and disclosing quarterly revenue for its Azure cloud business for the first time. The changes mean there's a new “Devices and Consumer†segment, which is essentially search, ads, Xbox, Windows, and Surface revenue. The other segment is “Agents and Infra,†which is the rest of Microsoft, including Azure, Microsoft 365 Cloud, Microsoft 365 commercial and consumer, server products, and more.
- Lenovo's new MacBook Neo competitor comes in two sizes and seven colors. At the IFA tradeshow last week, Lenovo announced its IdeaPad Vibe, taking on Apple's MacBook Neo with a similar starting price and range of colors. The Vibe will be available in both 14- and 15-inch sizes, with AMD or Qualcomm chip options. Lenovo has picked seven colors for the Vibe, up from the four hues available on the MacBook Neo. It's good to see more Windows laptop makers stepping up to compete with the Neo on pricing in this RAMageddon era.
- Nvidia's new RTX Spark laptops launch in October with two different configs. Speaking of RAMageddon, Nvidia announced last week that its Arm-based RTX Spark chips will debut in October in two different N1X configurations. The first, which is akin to a miniature PC config, will come with a 6144-core Blackwell RTX GPU and up to 128GB of unified memory. The second, which can be considered a laptop config, cuts that down to a 5120-core GPU and between 24GB and 32GB of unified memory. I think most laptop manufacturers will use the second chip config, simply because 128GB of unified memory is going to be extremely expensive. Still no exact release dates or pricing for RTX Spark laptops yet.
- Microsoft slashes Xbox Cloud Gaming to just 15 hours a month for Ultimate subscribers. The big Microsoft news over the past week was an overhaul of Xbox Cloud Gaming. Microsoft is cutting the number of hours you can use Xbox Cloud Gaming to just 15 for Game Pass Ultimate subscribers, 10 hours for Premium members, and a measly 5 hours for Game Pass Essential subscribers. The changes may well help Microsoft avoid more price increases to Game Pass in the short term.
- Microsoft opens up Xbox Cloud Gaming with new pay-as-you-go option. While the Xbox Cloud Gaming hours for Game Pass subscribers are being cut down dramatically, Microsoft is also opening up its streaming service to anyone. You'll be able to purchase bundles of hours to use with Xbox Cloud Gaming, allowing people without an Xbox console or a Game Pass subscription to stream and play Xbox games from a variety of devices. This move seems like a big part of trying to meet an ambitious and nearly impossible goal to make Xbox “one of the few companies that entertains more than a billion people each day.â€
- Xbox app is coming to TCL TVs. Microsoft is partnering with TCL to bring its Xbox app to supported TCL smart TVs. The Xbox app lets you connect to Xbox Cloud Gaming and stream Game Pass titles or select games you own as part of a subscription. The Xbox app will arrive on TCL TVs at some point “in the coming months,†which is just in time for Microsoft's new pay-as-you-go option for Xbox Cloud Gaming in November.
- Microsoft's Project Zenith is a “distraction-free Windows experience†for developers. At its Build developer conference earlier this year, Microsoft unveiled a developer-optimized Windows effort. It's now putting a name on that experience, Project Zenith, and coupling it with new developer-focused devices with 64GB or more of unified memory. These Project Zenith devices will include preinstalled developer tools like Visual Studio Code, GitHub Copilot, PowerToys, WinAppCLI, and Windows Dev Skills. Microsoft is also making changes to File Explorer and the Start menu to disable distracting tips, as well as enable things like file extensions and hidden files.
- Microsoft says virtually nobody was grabbing NYT articles through its chatbot. Microsoft is in the middle of a copyright fight with The New York Times, and as part of the case it has provided 8.2 million Copilot chat logs. The company says Copilot rarely reproduces full sentences from news articles and books, and argues that using copyrighted content for AI training datasets should be considered fair use. The filings were made as part of a legal battle brought by publishers and authors against Microsoft and OpenAI, which the plaintiffs claim built products on their works and now compete with them directly, in part by regurgitating copyrighted content. The Seattle Times and Newsday are also suing OpenAI and Microsoft for infringement.
I'm always keen to hear from readers, so please drop a comment here, or you can reach me at notepad@theverge.com if you want to discuss anything else. If you've heard about any of Microsoft's secret projects, you can reach me via email at notepad@theverge.com or speak to me confidentially on the Signal messaging app, where I'm tomwarren.01. I'm also tomwarren on Telegram, if you'd prefer to chat there.
Thanks for subscribing to Notepad.
