570 Patches, 3 Zero-Days: Microsoft's Biggest Patch Tuesday Yet Is a Triage Problem Now

Microsoft's July 2026 Patch Tuesday landed with 570 fixes, including three zero-days already being exploited or publicly disclosed before the patch dropped. Two outlets covering this — BleepingComputer and The Hacker News — put the number differently (570 vs. 622), which itself tells you something: even the people whose job is counting these things can't agree on the count, because the sprawl has gotten that large.

This is the pattern Patch Tuesday has been drifting toward for years: fewer "patch when convenient" months, more "patch or get exploited" months. Zero-days bundled into a 500+ CVE release are the worst-case scenario for IT teams, because the volume itself becomes a smokescreen — the three flaws attackers are actively using get buried in a spreadsheet with hundreds of lower-priority entries. Historically, this is exactly how orgs get owned weeks after a patch existed: not because they ignored security, but because they patched in the wrong order, or didn't finish before the next Tuesday buried this one.

The SAL read: if your patch process is "apply everything eventually," you will lose the race on the three that matter while you're busy on the 567 that don't — triage the zero-days first, confirm they're closed within 72 hours, and let the rest follow on your normal cycle.