Estimated reading time: 6 minutes
Microsoft fixed 1,411 flaws this week, its fourth record release in five months. Cyber insurer Coalition says it sent 49 zero-day alerts in three months, and most policyholders got none. Its picks show vulnerability prioritization at work, and why a severity score is only a starting point.
Microsoft fixed 1,411 security flaws on 13 October, BleepingComputer counted. It rated 70 critical, and attackers were already exploiting one. It was the fourth record-breaking Patch Tuesday in five months.
June set the first record. Microsoft listed 206 of its own flaws that month, The Record reported. Trend Micro’s Zero Day Initiative put the previous record at 177, set in 2025.
July reached 569, Tenable counted. September hit 974, Infosecurity Magazine reported.
Microsoft points to AI. It has said an internal AI system, codenamed MDASH, found 16 of May’s flaws before any human researcher did. It expects releases to keep growing. Britain’s National Cyber Security Centre has warned organizations to prepare for a wave of urgent updates.
Exploit-writing is speeding up too. Anthropic’s Mythos Preview model can build working exploits for newly disclosed flaws in hours, Axios reported in June. Coalition’s post says warnings of a “vulnpocalypse” now crowd conference agendas and headlines.
Vulnerability Prioritization At A Cyber Insurer
Coalition sells cyber insurance and Coalition Control, a risk management platform. It scans policyholders’ internet-facing systems. When a serious flaw appears, it emails the policyholders whose systems look exposed. It calls these Zero-Day Alerts.
Coalition sent 49 between 1 May and 1 August, it said in a 14 October blog post by Ryan Chadwick. That window closed before the September and October releases. Ninety-four percent of policyholders received none. Of those who did, 91% received just one.
Coalition argues “the vulnerability surge is manageable.” Its case for vulnerability prioritization is that teams should stop chasing hundreds of flaws labeled critical. They should fix the few attackers actually use.
Coalition’s own figures support the point. Between 2018 and 2025, fewer than 2.2% of newly published flaws had confirmed exploitation, it says. Annual volume grew 2.5 times over the same period.
Microsoft has started offering its own help. With the October release, it grouped related flaws into 15 “risk cohorts,” BleepingComputer reported. The largest held 136 flaws in Windows filesystems, storage and backup. The cohorts sort flaws by the part of the system they affect. Microsoft says they do not necessarily show which flaws are most dangerous. It calls the approach experimental.
What Coalition’s Zero-Day Alerts Flagged In July
On July’s Patch Tuesday, then a record 569 flaws, Coalition sent two alerts covering four flaws. Microsoft rated 56 of the 569 critical. Three were in SharePoint Server. One was in Windows Message Queuing.
Only two of the four carried Microsoft’s critical rating.
Microsoft scored one SharePoint flaw, CVE-2026-56164, at 5.3 out of 10. Attackers were already exploiting it. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of known exploited flaws the same day. The National Vulnerability Database later scored it 9.8.
Coalition explains why it mattered. The flaw grants the Site Owner privileges that a second, critical SharePoint flaw needs to run code remotely. Together, they form a chain.
Chaining flaws “was once labor intensive for attackers,” Coalition writes. AI agents now automate it, it says.
Zero-Day Alerts And Small Businesses
Fifty-nine percent of the policyholders Coalition alerted have fewer than 25 employees. For small firms, a Patch Tuesday of nearly 600 flaws “could present a month-long challenge,” Coalition says. October’s release was more than twice that size.
The post does not give the share of all Coalition policyholders that size. Without it, the 59% cannot show whether small firms are more exposed than larger ones.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
Where Vulnerability Prioritization Stops
Coalition says its alerts supplement a policyholder’s own patching. Three limits explain why.
The first is visibility. Coalition “regularly scans the external footprint of policyholders,” its help pages say. A flaw on an internal server sits outside that view.
The second is timing. CVE-2026-56164 was under attack before Microsoft shipped a fix. Mandiant’s M-Trends 2026 put the mean time to exploit at minus seven days in 2025. On average, attackers moved before a patch existed, as Cyber Insurance News reported.
The third is follow-through. The post does not say how many alerted policyholders patched, or whether alerts cut claims. It also does not say whether ignoring an alert affects cover.
Some carriers have written that question into their wording. Chubb’s Neglected Software Exploit endorsement gives policyholders a 45-day grace period. After that, a growing share of the risk shifts to them, as Cyber Insurance News reported.
Outside-in scanning shows what changes between renewals. Andrew Horkan of Cyber Tzar made that case on the Cyber Insurance News podcast. A company can be compliant in May and exposed in June.
Censys data reported this week shows how patching behaves without a push. Cleo file-transfer servers upgraded at a median of 1.9% a month. A critical flaw and reports of active exploitation pushed that to 63% by January.
Coalition’s 49 alerts show where an insurer chose to look. The next number worth publishing is how many policyholders acted on them.
FAQ – Vulnerability Prioritization
What are Coalition’s Zero-Day Alerts?
Emails Coalition sends to policyholders when a serious new flaw affects systems its scans can see from the internet. Each alert includes steps to fix it.
How many Zero-Day Alerts did Coalition send?
Coalition sent 49 between 1 May and 1 August 2026. It says 94 percent of policyholders received none.
How big is Patch Tuesday now?
Microsoft fixed 1,411 flaws on 13 October 2026, by BleepingComputer’s count. July’s release, the subject of Coalition’s alerts, fixed 569.
Why did Coalition flag a flaw Microsoft rated moderate?
The SharePoint flaw CVE-2026-56164 was already being exploited. It also grants privileges that a second, critical flaw needs, so the two can be chained.
Do Zero-Day Alerts replace patching?
No. Coalition says the alerts supplement a policyholder’s own patching. They cover only what its external scans can see.
Why is Patch Tuesday getting bigger?
Microsoft now uses AI to find flaws in its own code and expects releases to keep growing.
Related Cyber Insurance Posts
- Criminals Run AI On Stolen Keys. Some Insurers Now Cap The Bill
- Patch Management And Cyber Insurance: What The Adobe Reader Zero-Day Reveals(Opens in a new browser tab)
- Beazley Security Launches Exposure Management To Counter AI-Assisted Attack Risk(Opens in a new browser tab)
- The Video Wasn’t Fake. Nobody Could Prove What Happened to It. That’s a Cyber Insurance Problem.(Opens in a new browser tab)
- Black Kite 2026: Financial Services Faces A Two-Front Cyber Storm(Opens in a new browser tab)