“我们已经突破了4000个CVE的里程碑，还有两个月的时间，”Tenable的Satnam Narang对Brian Krebs说道。
“We’ve now crossed the 4,000 CVE mark with two months left to go,” Satnam Narang of Tenable told Brian Krebs.
微软在一个月内修复了超过1400个安全漏洞，这是有史以来规模最大的微软补丁星期二。这些更新于10月13日发布，Krebs在Krebs on Security上报道。这一数字超过了9月份近1000个的纪录，而9月份的数量已经是微软正常月度修复量的大约十倍。
Microsoft has fixed more than 1,400 security flaws in one month, the largest Microsoft Patch Tuesday on record. The updates came out on 13 October, Krebs reported on Krebs on Security. They beat September’s record of nearly 1,000, which was already about ten times Microsoft’s normal monthly load.
仅10月份就超过了微软在2020年全年修复的1261个漏洞的数量，而2020年是之前的纪录年，Narang表示。本月至少有78个漏洞被评为严重。其中大多数允许攻击者在目标系统上运行他们选择的代码。
October alone beats the 1,261 flaws Microsoft fixed in all of 2020, the previous record year, Narang said. At least 78 of this month’s flaws are rated critical. Most of those let an attacker run code of their choice on the target system.
目前正在被利用的漏洞 目前只有这一个漏洞已经被攻击者利用。CVE-2026-96951位于Windows Shell中。它允许攻击者绕过“网络标记”。这是Windows为来自互联网的文件添加额外检查的标签。微软将该漏洞评为“重要”，CVSS评分为8.8。
The flaw already under attack Only one of the flaws was already in use by attackers. CVE-2026-96951 sits in the Windows Shell. It lets an attacker get around Mark of the Web. That is the Windows label that adds extra checks to files from the internet. Microsoft rates the flaw Important, with a CVSS score of 8.8.
微软在其安全建议中表示，该攻击需要受害者主动操作。攻击者可能通过电子邮件或即时消息发送精心构造的文件，或发送指向恶意网站的链接。然后用户需要打开它。此次修复覆盖了Windows 10、Windows 11、Windows Server和Outlook.com。
The attack needs the victim to act, Microsoft said in its advisory. An attacker would send a crafted file by email or instant message, or a link to a malicious site. The user then has to open it. The fix covers Windows 10, Windows 11, Windows Server and Outlook.com.
微软感谢富士通的Riku Bamba和Yuya Chudo以及一名名为yhw的研究人员。它还感谢Benoit Sevens，他被列为“使用Anthropic的Claude”。微软尚未透露谁在利用此漏洞或谁是攻击目标。
Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu and a researcher named yhw. It also credited Benoit Sevens, listed as “using Claude with Anthropic”. Microsoft has not said who is exploiting the flaw or who the targets are.
另一个漏洞位于.NET Framework中，在修复发布前就已经公开。这可能让攻击者有更多时间来研究如何利用它，Krebs写道。微软表示，目前尚未发现对此漏洞的攻击迹象。
A second flaw, in the .NET Framework, was public before the fix. That could give attackers extra time to work out how to exploit it, Krebs wrote. Microsoft said it has seen no signs of attacks on it yet.
AI正在发现更多漏洞 微软将漏洞数量的激增归功于大型语言模型，Krebs报道。今年7月，该公司表示AI发现了当月创下纪录的漏洞背后的原因。
AI is finding more bugs Microsoft credits large language models for the jump in bugs found, Krebs reported. In July, the company said AI found the bugs behind that month’s record.
本周，美国银行首席执行官表示，有1000名承包商正在修复AI暴露出的漏洞。
This week, Bank of America’s chief executive said 1,000 contractors are fixing flaws that AI exposed.
安全团队面临更大负担 批量更新规模如此之大，安全专家警告称，这会给企业安全团队带来额外压力。克雷布斯写道，这些团队通常在推出更新前会先对每个更新进行测试。
A heavier load for security teams Batches this large put extra strain on corporate security teams, security experts warn. Those teams often test each update before rolling it out, Krebs wrote.
福特拉公司的泰勒·雷古利告诉克雷布斯，截至目前，今年只有26个微软漏洞被收录进美国政府的已利用漏洞目录。他表示，团队应优先修复这26个漏洞。
Tyler Reguly of Fortra told Krebs that only 26 Microsoft flaws have entered the US government’s catalogue of exploited bugs so far this year. Teams should patch those 26 first, he said.
“安全领导者应聚焦于可利用的风险，并询问他们的团队是否具备清晰的认识、足够的能力以及必要的支持来采取行动，”雷古利说。
“Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.