Microsoft's Biggest-Ever Security Update Fixes 974 Flaws, Two Already Used in Attacks
A record-breaking September patch release plugs two security holes that criminals were actively exploiting, plus 20 vulnerabilities serious enough that a single infected machine could spread the attack to others automatically.
Key points
- Microsoft fixed 974 security vulnerabilities in its September 2024 update, the largest single patch release the company has ever issued.
- Two of the flaws were zero-days: Microsoft had no warning and criminals were already exploiting them before a fix existed.
- Both zero-days allowed privilege escalation, where an attacker already inside a system secretly upgrades their own access to full administrator control.
- Twenty of the patched vulnerabilities are rated potentially wormable, meaning malicious software could spread from machine to machine on its own, without anyone clicking anything.
- Windows users should apply the update immediately through Windows Update.
Microsoft released its monthly security update this September carrying 974 individual fixes. That is not a typo. SecurityWeek confirmed it's the highest number the company has ever shipped in a single batch.
Each fix addresses a specific crack in the wall of a Microsoft product. Finding and sealing 974 of those in one go is, frankly, a lot.
Should ordinary users be worried?
Yes, but the fix is already available. The two most urgent flaws are the zero-days, and both involve privilege escalation. A burglar finds a way in through a ground-floor window, then locates a hidden master key that unlocks every room in the building. That's privilege escalation. Criminals were using both flaws in live attacks before Microsoft even knew the cracks existed.
The failure mode is the gap between discovery and patching. During that window, no defence existed at the software level. Attackers who knew about these flaws could silently promote themselves from a limited account to full system administrator. We covered a similar privilege escalation path in our 3 September report on the FalconFlank zero-day, which handed SYSTEM-level access on Windows machines by abusing a trusted process.
What makes 20 of these flaws especially dangerous?
The wormable rating. A wormable vulnerability lets malicious software copy and spread itself automatically across a network without human help. That's the kind of thing that turns one infected laptop into a hundred overnight. Twenty vulnerabilities carrying that potential in one update isn't a number to brush past.
Wormable flaws matter most inside large organisations: schools, hospitals, local councils running many Windows machines on the same internal network. One unpatched device becomes the entry point for all of them.
| Detail | Figure |
|---|---|
| Total vulnerabilities patched | 974 |
| Zero-days actively exploited | 2 |
| Potentially wormable flaws | 20 |
| Patch release month | September 2024 |
| Vulnerability type (zero-days) | Privilege escalation |
Any postmortem written after an organisation gets hit through one of these will note the same thing: the patch was available the day the news broke.
Home users: open Settings, go to Windows Update, install everything waiting. Business IT teams running Microsoft Endpoint Configuration Manager or Windows Server Update Services should already be in the queue. If you manage a fleet of Windows machines and you're not patching today, you're the wormable flaw.
Apply the update.
