September Patch Tuesday: Microsoft Patches Its Own Patches

Microsoft spent the summer proving it can find bugs faster than anybody else. Since June, every monthly bulletin has fixed them by the hundred, and the 8 September 2026 batch came within touching distance of a thousand — a house record, built on AI-assisted bug hunting with its MDASH harness and Perception infrastructure. Nine days later, Next totted up what the avalanche took with it on the way down.

To fix is to change; to change is to break

A regression is collateral damage: the patch goes off to repair one thing and dents another, with QA none the wiser. The arithmetic is unforgiving — the more flaws you fix, the more lines you touch, and the more chances you hand to exactly this kind of accident. Next raised the question back when the record was set. September answered it without being asked twice.

Two emergencies fixed on 14 September

Microsoft shipped KB5129195 out of band, meaning it couldn’t wait for October. Those releases are rare, and they normally exist to slam a security hole shut rather than to un-break features — it’s the glass you smash in an emergency, not part of the weekly round.

The ugliest one hit Remote Desktop Services. Per Bleeping Computer, companies watched their RDS servers hold up for a few hours, sometimes less, before connections simply stopped landing; existing sessions wouldn’t close down cleanly, and in some cases only a forced reboot brought the service back. The outage wasn’t the real danger. Some admins ended up uninstalling the offending update — the very one patching an RDS flaw rated 9.8 on the CVSS scale. Fixing this fast wasn’t a nicety, it was the only way to stop admins disarming themselves.

The second fix on 14 September: folder sharing to HCS-managed Linux virtual machines stopped working whenever Plan9 was in use on the Windows host, with knock-on damage to the Linux subsystem (WSL) and to Claude Cowork. Classic Hyper-V machines came through unscathed, provided they steered clear of Plan9.

Sound, trust, and what’s still open

Not everything is shut. USB audio devices turned into paperweights: no sound, system volume stuck, audio settings refusing to open, all of it clustered around multichannel functions. The 14 September update only patches part of the picture — 8-channel and 3D modes are back, other devices are still silent, and so are some microphones, Windows Latest notes.

The other sore spot is aimed squarely at businesses: on accounts protected by Credential Guard, machines lose their domain trust and announce that the relationship with Active Directory is broken. Microsoft says in its release notes that it has identified the cause. As of 17 September, problems remain open on the Excel and Active Directory side.

Is the AI really to blame?

Careful with the shortcut here: in what Next describes, the AI found the flaws — it didn’t write the fixes. What it changed is throughput. And all that throughput pours into the same testing pipeline as before, staffed by people who still get twenty-four hours in a day.

A machine can now turn up a thousand flaws a month. Reading them back, it turns out, still runs at human speed.