Microsoft has fixed nearly 1,000 vulnerabilities in a single update package, and two of them are already being exploited in real-world attacks—here's what a small business needs to do.
Microsoft releases a monthly security update package for Windows and its other products. This month’s release is the largest to date: nearly a thousand vulnerabilities patched at once, covering Windows, the Office suite, database and email servers, and cloud services. The number may seem overwhelming, but for a small business, the message boils down to one simple step: install the updates.
Two of these vulnerabilities deserve special attention, because they are not merely theoretical—they are already being exploited in attacks. The first allows an attacker who has already gained a foothold on a computer to elevate their privileges to the highest level, SYSTEM, meaning they can take complete control of the machine. The second one exploits the very mechanism that delivers updates to Windows. Both have been fixed, but the fix only takes effect on computers where it is installed.
This is the trap that small businesses fall into: updates are available, but they remain uninstalled. A computer used at the front desk, a laptop rarely taken out of its drawer, an accounting workstation that hasn’t been restarted in weeks—all of these remain vulnerable even if the company “has antivirus software.” Attackers count on precisely this gap between when the patch is released and when it’s actually installed.
The good news is that the fix costs nothing and doesn’t require a specialist. On every company computer, open Settings, then Windows Update, and click “Check for updates.” Let the system download and install everything it finds, then restart the computer—some fixes are applied only after a restart. It’s especially worth checking computers that are rarely used and laptops at home, since those tend to fall behind the most.
For a company without an IT department, spending a quarter of an hour on updates is one of the most cost-effective and efficient security measures available. If the process seems complicated or if you have many computers to check, a maintenance provider can set up automatic updates and confirm that all workstations are up to date.
Sources:
- BleepingComputer | https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/
- SecurityWeek | https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/
This article was generated with AI assistance.