Microsoft Releases Record 206 Security Patches in June, Raising Questions About AI-Assisted Vulnerability Detection

Microsoft's June 2026 Patch Tuesday addressed 206 CVEs — the highest single-month total on record, surpassing the previous record of 175 set last October — with 38–39 flaws rated critical and none yet confirmed exploited in the wild as of release. Three vulnerabilities were publicly known before patching: CVE-2026-49160, an HTTP.sys denial-of-service flaw tied to the 'HTTP/2 Bomb' technique discovered with OpenAI's Codex agent; CVE-2026-50507, a BitLocker security feature bypass linked to the 'YellowKey' exploit; and CVE-2026-45586, a Windows CTFMON privilege escalation flaw dubbed 'GreenPlasma.' Both YellowKey and GreenPlasma were disclosed without coordination by a pseudonymous researcher known as Nightmare Eclipse or Chaotic Eclipse, who has now released proof-of-concept code for multiple zero-days in protest of Microsoft's vulnerability disclosure practices — and released yet another Defender zero-day, 'RoguePlanet,' within hours of Tuesday's patch release. Two critical 9.8-CVSS flaws stand out: CVE-2026-45657, a Windows kernel RCE exploitable via malicious TCP/IP packets with no credentials or user interaction required, and CVE-2026-47291, an HTTP.sys RCE Microsoft rates as 'more likely' to be exploited. Security experts including Zero Day Initiative's Dustin Childs noted that Microsoft's total CVE count for 2026 so far already exceeds its entire 2018 annual total, and warned that AI is 'supercharging flaw discovery at an uncontrollable scale' with no clear ceiling in sight.