A Record-Breaking Patch Tuesday for June 2026
3 hours ago
- Microsoft released a record-breaking 200 security patches for June 2026 Patch Tuesday, with nearly three dozen rated critical.
- Exploit code for at least three of the vulnerabilities is publicly available, and AI tools are increasingly used to find bugs.
- Zero-day bugs include CVE-2026-49160 (denial of service in IIS) and two from researcher Nightmare Eclipse (GreenPlasma, YellowKey).
- Nightmare Eclipse, claiming to be a former Microsoft employee, plans to release more zero-day exploits in July.
- Microsoft faced backlash for threatening legal action against a researcher but later clarified it will only report illegal activity.
- Adobe and Google also shipped large security updates, with Google fixing 429 vulnerabilities in Chrome.
- A zero-day in Visual Studio Code allowing GitHub token theft was patched after a researcher published exploit details.
- Microsoft's own code repositories were infected with the Shai-Hulud worm, affecting Azure Durable Task SDK.