Microsoft’s July 2026 Patch Tuesday fixed 570 security vulnerabilities, nearly triple the previous month’s record. Almost 60 of them were rated critical. Three were zero-days, two of which were already being actively exploited before the patch shipped.
What was actually in the batch
A few of the specific flaws give a sense of what “570” actually covers: an elevation-of-privilege bug in Active Directory Federation Services, a similar flaw in SharePoint, a BitLocker bypass that had been publicly disclosed (though not yet exploited), and a remote code execution flaw in Microsoft Copilot rated 9.6 out of 10 in severity. Roughly 250 of the total 570 were elevation-of-privilege issues specifically — bugs that let an attacker who’s already gotten a foothold gain broader access, which is a meaningfully different threat than a flaw that lets someone in from outside in the first place.
Microsoft’s own explanation for the volume: AI-assisted vulnerability discovery is now finding bugs faster than before. That’s a double-edged development: the same AI tools helping defenders find and fix bugs are just as available to anyone looking for ones that haven’t been patched yet.
The advice that matters more than the number
The most practically useful part of the coverage wasn’t the vulnerability count. It was the caution that came with it: back up systems before applying a patch batch this size, and consider waiting a few days before installing, because large patch releases have a track record of introducing their own stability issues. That’s a real tension for anyone running a server: patch immediately and risk instability, or wait and stay exposed a little longer. There’s no universally correct answer, which is exactly why it matters who’s making that call on your behalf.
Why this is a hosting question, not just a Windows question
Most small business site owners aren’t managing server patching themselves — that’s implicitly part of what they’re paying a host for, whether or not it’s ever spelled out. A patch cycle this size is a useful moment to ask: does my hosting provider apply security patches on a defined schedule, and do they test before deploying at scale, or am I trusting that it happens?
That’s a fair question to ask any host, including us. AllCloudHost’s service level guarantees commitments exist because patch management isn’t optional maintenance — it’s the actual work that determines whether a record-breaking vulnerability month is a non-event for your site or a real problem.
The number 570 is startling on its own, but the more useful takeaway is what it implies about the pace going forward: if AI is accelerating vulnerability discovery on the attacker side and the defender side simultaneously, patch cycles this large may become the norm rather than the exception. Whoever’s applying those patches on your behalf matters more with every cycle like this one.