Microsoft Plugs Nearly 400 Security Holes – Krebs on Security
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Microsoft's August Patch Tuesday addresses 398 security vulnerabilities, including 42 rated critical. One zero-day (CVE-2026-68820), a privilege escalation flaw in afd.sys, is actively being exploited via a race condition attack chain. Two other flaws were publicly disclosed before patching. The massive patch volume — double June's then-record batch — is attributed to AI-assisted vulnerability discovery. However, 1Password research found LLMs fail to correctly patch complex vulnerabilities more than half the time, producing broken or newly introduced flaws. Experts recommend human-in-the-loop testing, iterative improvement, and no rushed deployments. Adobe, Cisco, Google, Mozilla, and Oracle are also shipping patches more frequently due to AI-driven discovery.
Questions this post answers
What is CVE-2026-68820 and is it being actively exploited?
CVE-2026-68820 is a privilege escalation vulnerability in afd.sys, the Windows driver behind socket connections on effectively every endpoint. It is actively being exploited as the second step in an attack chain: an attacker first gains a low-privilege foothold via phishing, then uses the race condition flaw to escalate. Its CVSS score is 7.0, reflecting high attack complexity — the exploit must be attempted repeatedly until timing aligns. Teams tracking actively exploited Windows CVEs find the latest advisories and expert analysis on daily.dev.
How accurate are LLMs at generating security patches for newly disclosed vulnerabilities?
LLMs fail to correctly patch complex, newly disclosed vulnerabilities more than half the time. Research by 1Password found that models either failed to fix the flaw, introduced a new weakness in the process, or both. Experts recommend treating AI as a patching partner that still requires skilled human review, iterative testing, and verification rather than one-shot automated fixes. Developers weighing AI-assisted security tooling in their workflows can follow the debate on daily.dev.