Cyber Brief: Microsoft's 974-Patch Release and Shadow AI Risks

Today's brief reflects two significant operational challenges for UK organisations: the immediate pressure of managing an unprecedented volume of security patches, and the longer-term governance question of how to manage AI use across the workforce. The NCSC has published practical guidance on shadow AI that addresses why staff turn to unapproved tools, while Microsoft's record-breaking 974-vulnerability release highlights how AI is accelerating both vulnerability discovery and the operational burden of patch management. Meanwhile, Adobe has confirmed active exploitation of a Commerce platform zero-day, and US agencies have warned that Chinese AI companies are systematically extracting capabilities from Western AI models through large-scale distillation campaigns.

Microsoft releases 974 security patches in record-breaking Patch Tuesday

SecurityWeek reports that Microsoft has issued fixes for 974 vulnerabilities across its software portfolio in September 2026's Patch Tuesday, the largest single monthly release in the company's history. The update includes two actively exploited Windows zero-day vulnerabilities, both privilege escalation flaws, alongside 20 potentially wormable vulnerabilities and over 110 flaws rated as critical severity. The patches span Windows operating systems, Office, SQL Server, Developer Tools and other Microsoft products. The company has attributed the dramatic increase in vulnerability disclosures to the use of AI-assisted security research, which is accelerating the rate at which flaws are being discovered across its codebase.

For UK organisations, this represents a significant operational challenge in vulnerability and patch management. The sheer volume of fixes creates immediate prioritisation decisions for IT and security teams who must assess which patches address the most material risk to their specific environment. The two actively exploited zero-days require urgent attention, but the broader question is how organisations scale their patch testing, deployment and validation processes when monthly patch volumes are approaching 1,000 CVEs. This is not a one-off spike but a signal that AI-driven vulnerability research is fundamentally changing the volume and pace of security updates organisations must manage. Many UK businesses will need to revisit their patch management workflows, tooling, risk-based prioritisation frameworks and the resourcing required to maintain a sustainable and effective patching cadence.

Why it matters

For UK businesses, this is a prompt to review whether current patch management processes, tooling and team capacity are designed to handle this scale of monthly updates. Organisations should focus on risk-based prioritisation, ensuring that actively exploited vulnerabilities and those affecting internet-facing or critical systems are addressed first, and that patch testing and deployment timelines remain realistic and sustainable.

Source: SecurityWeek

NCSC publishes guidance on managing shadow AI in UK organisations

The National Cyber Security Centre has published new guidance addressing the security risks created when employees use unapproved AI tools, a practice commonly referred to as shadow AI. The NCSC blog post emphasises that understanding why staff turn to these tools is essential to managing the risks they create. Employees often adopt AI services to improve productivity, solve problems faster or work around limitations in approved systems, but this can lead to sensitive data being shared with third-party platforms, create compliance gaps, and introduce unmanaged security risks into the organisation. The guidance encourages organisations to engage with staff to understand their needs, provide approved alternatives where possible, and establish clear policies that balance security with practical usability.

This matters operationally because shadow AI is not a theoretical risk but a widespread reality across UK businesses. Staff are using generative AI tools for drafting documents, analysing data, summarising meetings and automating tasks, often without considering where that data is being processed, stored or used for model training. For many organisations, this creates exposure in areas such as intellectual property protection, client confidentiality, regulatory compliance and data sovereignty. The NCSC's focus on understanding user behaviour rather than simply blocking tools reflects a more mature approach to governance. Organisations that take a purely restrictive stance risk driving AI use further underground, while those that provide approved, well-governed alternatives and clear guidance are more likely to maintain visibility and control over how AI is being used across the business.

Why it matters

For UK businesses, this is a prompt to review whether there is a clear and practical AI acceptable use policy in place, whether staff understand what tools are approved and why, and whether the organisation is providing realistic alternatives that meet genuine business needs. Consider whether there is visibility into which AI tools are being used across the organisation and whether data classification and handling policies account for AI-related risks.

Source: NCSC UK

Adobe confirms active exploitation of Commerce platform zero-day vulnerability

SecurityWeek reports that Adobe has patched over 170 vulnerabilities across its product range, including an actively exploited zero-day flaw in Adobe Commerce. The vulnerability, tracked as CVE-2026-75650, allows unauthenticated attackers to execute arbitrary code on affected systems. Adobe has confirmed that the flaw is being exploited in the wild, though the company has not disclosed details about the scope or nature of the attacks. The Commerce platform is widely used by retailers and e-commerce businesses to manage online storefronts, payment processing and customer data. Adobe has released patches and is urging customers to apply the updates immediately. The September update also includes fixes for critical vulnerabilities in Adobe Acrobat, Reader, Photoshop, Illustrator and other widely deployed applications.

For UK organisations running Adobe Commerce or other Adobe enterprise software, this represents an immediate patching priority. E-commerce platforms are high-value targets because they process payment card data, customer personal information and commercially sensitive transaction records. An unauthenticated remote code execution flaw in this context creates significant risk of data breach, payment fraud, reputational damage and regulatory consequences under UK GDPR. The fact that the vulnerability is already being exploited in the wild means that organisations should assume adversaries have working exploit code and are actively scanning for vulnerable instances. Beyond Adobe Commerce, the broader Adobe patch release includes critical fixes across products that are widely deployed in UK businesses, particularly in marketing, creative, legal and professional services sectors where Adobe software is standard.

Why it matters

For UK businesses using Adobe Commerce or other Adobe enterprise products, this is a prompt to prioritise patching immediately, particularly for internet-facing systems. Organisations should review whether Adobe software is being actively monitored for security updates, whether patching responsibilities are clearly assigned, and whether there is a process in place to respond rapidly when vendors confirm active exploitation of critical vulnerabilities.

Source: SecurityWeek

US agencies warn of systematic AI model distillation campaigns by Chinese companies

CyberScoop reports that US federal agencies, including CISA, have issued a joint advisory warning that Chinese AI companies are conducting large-scale, systematic campaigns to extract proprietary capabilities from US-based AI models through a technique known as knowledge distillation. The advisory alleges that these companies are using sophisticated systems to route millions of data requests to US AI models across different accounts, platforms and access points in order to replicate the functionality, behaviour and performance of those models without the underlying training data, infrastructure or research investment. The agencies describe this activity as forming the core of Chinese AI development strategy rather than a supplementary research technique, and warn that it represents a significant threat to the intellectual property and competitive advantage of Western AI companies.

For UK organisations, this matters because it highlights a broader strategic risk in how AI models and services are being used, accessed and potentially exploited at scale. Many UK businesses are integrating AI capabilities from US-based providers into their operations, and this advisory suggests that adversaries are systematically targeting those same platforms to extract and replicate their capabilities. While the focus of the advisory is on nation-state activity targeting AI companies, the techniques described, such as large-scale automated querying, account manipulation and cross-platform data harvesting, are relevant to how organisations think about API security, usage monitoring and third-party access controls more broadly. It also raises questions about the security and resilience of AI supply chains, particularly for organisations that are building proprietary AI capabilities or integrating AI into sensitive or commercially critical business processes.

Why it matters

For UK businesses using or developing AI capabilities, this is a prompt to review how AI model access is monitored and controlled, whether there are usage anomalies or patterns that could indicate systematic data extraction, and whether API rate limiting, access logging and account security controls are appropriately configured. Organisations should also consider the broader supply chain risk associated with AI services and whether proprietary or sensitive data is being used to query third-party AI models.

Source: CyberScoop

Today's Key Actions

• Prioritise patching for the two actively exploited Microsoft zero-days and the Adobe Commerce CVE-2026-75650 vulnerability, particularly on internet-facing systems, and review whether your patch management process can sustainably handle the increasing volume of monthly security updates.
• Review whether your organisation has a clear and practical AI acceptable use policy in place, whether staff understand which AI tools are approved, and whether you are providing realistic alternatives that meet genuine business needs while maintaining visibility and control.
• Ensure Adobe Commerce and other Adobe enterprise software is patched immediately, and confirm that there is a clear process for responding rapidly when vendors disclose actively exploited vulnerabilities in business-critical platforms.
• Review how AI model access and API usage is monitored across your organisation, whether there are controls in place to detect unusual query patterns or account behaviour, and whether proprietary or sensitive data is being used to interact with third-party AI services.
• Confirm that ownership and accountability for vulnerability management, AI governance, third-party software patching and API security monitoring are clearly assigned and understood across IT, security and business teams.

Secarma Insight

Today's brief reflects a recurring theme in mature security practice: the most effective defences are built on clear ownership, realistic processes and habits that are already in place before incidents occur. Whether it's managing an unprecedented volume of security patches, governing how staff use AI tools, or responding to actively exploited vulnerabilities, the organisations that handle these challenges well are those that have already invested in sustainable workflows, risk-based prioritisation and practical governance frameworks. Good security is not about reacting to every headline with urgency, but about maintaining the discipline, visibility and operational capacity to make informed decisions when it matters most.