Photo by Erick Cerritos on Unsplash
Every month, Microsoft releases a batch of security fixes for Windows and its other software. Most months those updates land quietly, get applied overnight, and business carries on as normal. This month is different.
The September 2026 release fixed 974 separate security flaws. That is not a typo. It is the largest single patch release Microsoft has ever produced. Among those fixes are two vulnerabilities in Windows itself that attackers were already using against real targets before any patch existed. In security terms, those are called zero-days, and the fact they were being actively exploited before a fix was available is the detail that should get your attention today.
What exactly is a zero-day vulnerability?
A zero-day is a flaw in software that attackers are exploiting at the same moment it comes to light, sometimes even before the software maker knows about it. There is no patch to apply because the patch has not been written yet. Your device is exposed regardless of how diligently you keep up with updates.
When Microsoft confirms a zero-day has been exploited in the wild, it means real organisations have already been compromised through that specific weakness. The fix is now available, but every device running a vulnerable version of Windows that has not yet received the update remains a live target right now.
Does this affect a small business?
A reasonable assumption is that mass Windows attacks are aimed at large enterprises or government networks. The reality is less comfortable. Automated scanning tools used by attackers do not filter by company size. They look for unpatched systems, and a five-person professional services firm running an unpatched laptop is just as discoverable as a corporate IT estate with a thousand machines.
The two zero-days in this release affect core Windows components. If your business runs Windows, and the overwhelming majority of UK small businesses do, your devices were vulnerable until the patch was applied. Devices that have not yet received the September update still are.
Nine hundred and seventy-four fixes is not a normal month
It is worth pausing on that number. Even if a large portion of the 974 flaws are lower severity and would require an attacker to already have a foothold in your network to exploit, the volume signals something important: the attack surface of modern software is growing, and keeping on top of what needs patching is becoming a real task, not a background chore that sorts itself out.
A release this size covers Windows components, productivity software, cloud services, and developer tools. Not every flaw affects every business setup. But identifying which ones matter to your specific devices, prioritising the critical ones, and confirming those fixes have actually landed is a genuine piece of work. It does not happen reliably by accident.
The honest problem with relying on automatic updates
Many small businesses depend on Windows Update running in the background to handle this. Sometimes it works exactly as intended. Sometimes devices are switched off overnight when updates are scheduled. Users dismiss restart prompts for days. A laptop that has missed two or three months of updates is carrying a long list of unresolved vulnerabilities, and the person using it typically has no idea.
A more dependable approach is automated patch management that pushes updates to every device on a defined schedule, confirms each one has been successfully applied, and flags anything that has slipped through. It removes the human variable from a process that should not depend on someone remembering to click update at the right moment.
If you want to understand your current exposure before doing anything else, a vulnerability scan will show which systems are behind on patches and where the gaps are. It is a useful starting point before committing to a longer-term approach.
What to do this week
- Check that Windows Update has run recently on every device your business uses, including laptops that travel between home and office.
- Prioritise devices used for financial tasks, email, and anything storing client data.
- If you have staff working remotely on company devices, confirm those machines have received the September update, not just the ones sitting in the office.
- If you manage any server infrastructure directly, treat this month as a priority this week rather than this quarter.
The two zero-days in this release are the ones to act on without delay. Microsoft flagging a vulnerability as actively exploited in the wild is the clearest signal they give that waiting is not a reasonable position. The remaining fixes can follow your normal patching cadence, but those two should not.
A practical thought for the longer term
Releases of this scale are becoming the new normal rather than an exception. If your current patching approach is informal, relying on updates running when conditions happen to be right, it is worth asking honestly whether that process is reliable enough given the number of vulnerabilities being disclosed every single month.
Consistent, verified patching is one of the five technical controls required for Cyber Essentials, the UK government-backed certification that sets a practical baseline for business cyber security. If that has been sitting on your list for a while, a month where Microsoft patches nearly a thousand flaws in a single release is a reasonable prompt to move it forward.
If you want to talk through what a managed patching approach looks like for a business your size, get in touch with CyberStark and we can walk through the options that make sense for you.