570 fixes in a single day. "We will get to it" is not a patch strategy.

On July 14, 2026, Microsoft released the largest Patch Tuesday in its history: 570 security fixes in one day. Fifty-nine were rated Critical, and 48 of those allowed remote code execution. The full breakdown ran to 254 elevation of privilege flaws, 145 remote code execution, 102 information disclosure, 35 denial of service, 17 security feature bypasses, and 16 spoofing issues.

Three of them were zero-days. Two were already being exploited in the wild, affecting Active Directory Federation Services and SharePoint Server, which is to say the identity and collaboration infrastructure a lot of organizations run their whole day through. The third, CVE-2026-50661, was publicly disclosed and affects BitLocker, letting someone with physical access to a machine bypass device encryption and read the system drive.

Why the numbers keep climbing

Microsoft has attributed the rise to an AI-assisted vulnerability discovery system that is finding more flaws across the Windows codebase than human review ever did. That is genuinely good news. Flaws found by the vendor are flaws not found by somebody else first.

But it changes the arithmetic for everyone downstream. The patch load is not going back down, and a process that worked when a monthly release carried sixty fixes does not survive contact with 570.

The part that actually matters

Nobody, at any size, tests and deploys 570 fixes thoughtfully in a week. So the real skill is no longer patching, it is triage: knowing which handful of these are being exploited right now, which touch systems you actually run, and which can safely ride the normal cycle.

That is the distinction between a managed process and an informal one. An informal process treats every update as equivalent and works through them when there is time, which means the two zero-days under active attack get the same priority as a spoofing fix for a component you do not use. A managed process separates them on the day they ship.

What to have in place

• An inventory current enough to answer "do we even run this?" for any given advisory
• A defined fast path for actively exploited flaws, measured in days rather than maintenance windows
• Visibility into which machines actually received a patch, as opposed to which ones were sent one
• Someone whose job it is to read the advisories, every month, without being asked

The honest version

For a business without dedicated IT staff, 570 fixes is not a to-do list, it is noise. The value of a managed approach is not that somebody applies every patch. It is that somebody reads the release, decides what is urgent for your specific environment, handles those quickly, and lets the rest follow a routine. That is the difference between being covered and hoping.

If you are not certain what your current patch process actually catches, that is worth establishing before the next record gets set. It is a standard part of ongoing managed IT, and it is one of the least visible things we do.