Microsoft Patches a Record 570 Security Flaws

(krebsonsecurity.com)

28 points | by robin_reala 4 hours ago

6 comments

  • charonn0 1 hour ago
    It seems like bug hunting might be the one area where AI is actually making the world a better place.
    • ashleyn 34 minutes ago
      How many were introduced by misuse of AI coding/vibe coding though?
      • stackghost 4 minutes ago
        At Microslop? Evidently, lots.
      • DANmode 18 minutes ago
        How many were known, and put on the roadmap because war got hot?
        • iJohnDoe 13 minutes ago
          How many were put there for Israel, NSA, FBI?
  • lousken 1 hour ago
    It would be nice if microsoft had windows update for .net, visual c++, office, windows, edge ... just all their software in one updater, but that would be too easy...
    • netsharc 1 hour ago
      Isn't that... Windows Update? At least last time I looked it would update .net runtimes, Office, what else? OK, Visual Studio has its own update mechanism. Edge is part of the OS, isn't it?
      • ihsw 49 minutes ago
        [dead]
    • nobodyandproud 1 hour ago
      You mean…service packs?
  • freitasm 1 hour ago
    I wonder how many bugs will be introduced with these fixes...
    • ronsor 1 hour ago
      No bugs, only intentional backdoors
  • naturalmovement 1 hour ago
    Sounds like a lot but compare it to Edge also being patched for 428 Chromium CVEs this month.

    If 20 years ago you told me a single piece of software had 428 vulnerabilities I wouldn't have believed it.

    If Chromium has that many security bugs, perhaps the move fast and break things approach of spraying diarrhea masquerading as code into a keyboard — in a rush to add new features no one asked for — needs to be reexamined.

    • tokioyoyo 1 hour ago
      20 years ago software wasn't as much battle tested as today, had way less feature set, was less connected to the internet, and etc. 428 CVEs looks small, assuming not all have CVSS 9.8 or something.
      • lousken 1 hour ago
        It was more tested as real testers were testing it. Nowadays, AI just checks the code.
        • pixl97 7 minutes ago
          I guess we should find some of this old source code and test it for exploits to see what is true.
    • dylan604 1 hour ago
      Even if it had the Microsoft logo attached? Windows was always known to not be the most secure of products. I can't imagine anything else from the same company would be any better
    • georgemcbay 1 hour ago
      > If 20 years ago you told me a single piece of software had 428 vulnerabilities I wouldn't have believed it.

      For something as complex as an operating system or a web browser, even one from 20 years ago (say, Windows XP or IE/Firefox) I wouldn't have believed there were 428 vulnerabilities either, I would have assumed there were much more than that.

  • gerdesj 1 hour ago
    "Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence."

    If only real intelligence found the fucking things instead.

    As ye sew, so shall ye reap!

  • d0100 1 hour ago
    An employee just got phished by adding a number to a legitimate deviceAdd login route that bypasses 2FA and adds a device with full access to office and mail

    Probably working as intended...

    • xorl 1 hour ago
      I always click NO to these, that's full human error. edit: The underlying issue is that they send a 2FA before asking for a password at all.