Microsoft Ships 972 Patches; Researcher Breaks Defender Fix Same Day

Microsoft's September Patch Tuesday was its largest ever with 972 vulnerabilities, including 113 critical and 20 wormable. The same day, researcher Nightmare Eclipse published a ShieldCrash PoC showing the CVE-2026-69414 Windows Defender patch fails.

• 972 CVEs in release, a Microsoft record, nearly double August
• 113 vulnerabilities critical, 20 allow wormable infection
• Two zero-days exploited before patch: CVE-2026-85880 and CVE-2026-81963
• ShieldCrash PoC enables SYSTEM file reads on all Windows versions