Daily IT Briefing – September 15, 2026
1. Record-breaking Patch Tuesday: Microsoft fixes 966 flaws, two zero-days already under active attack
Microsoft released its September security update, and it's a record one — fixing 966 vulnerabilities, 105 of them rated critical. That's a sharp jump from previous months (570 in July, 400 in August), which researchers attribute to increasingly widespread use of AI-assisted vulnerability discovery. Two of the fixed flaws are already being actively exploited: CVE-2026-81963 (an improperly handled link-following flaw in the Windows Update Stack) and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC) — both let an attacker who already has some access to a machine elevate privileges all the way to SYSTEM. Other critical fixes touch Entra ID, Azure AI Language, and Copilot Studio.
Why it matters: two actively exploited zero-days that grant privilege escalation mean an attacker with only minimal initial access (say, via a phishing email) can quickly gain full control of a machine. The critical flaws in Entra ID are directly tied to company identity and cloud access. Whether you manage updates in-house or through an IT partner, this month isn't the one to wait for the regular patch cycle — deploy September's updates as soon as possible, especially on servers and identity systems.
2. Apple releases macOS Tahoe 26.7 and Sequoia 15.8 — security fixes for older Macs
Apple has released macOS Tahoe 26.7 (build 25G229) and macOS Sequoia 15.8 (build 24H23), aimed at Macs that haven't yet moved to this year's macOS 27 "Golden Gate." Apple describes the updates as containing important security fixes and recommends them for all users, though it hasn't yet published the full list of patched vulnerabilities. Given that Apple has repeatedly used this type of update in the past to fix serious WebKit flaws, it's worth installing sooner rather than later.
Why it matters: not every company can jump straight to a new major macOS version because of software compatibility concerns — these smaller updates are how security fixes reach Macs that intentionally stay on an older release. If you're keeping older Macs in service on purpose (say, because of a specific line-of-business app), this update shouldn't wait as long as a full OS upgrade would.
3. CISA adds critical SonicWall and JFrog Artifactory flaws to its actively exploited list
CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with seven new entries. The most severe are a critical SSRF flaw in SonicWall SMA 1000 (CVE-2026-83548, CVSS 10.0) alongside a command-injection flaw in the same product (CVE-2026-83549), and an authentication-bypass flaw in JFrog Artifactory (CVE-2026-82329, CVSS 9.8). Researchers report attackers actively exploiting these to deploy reverse shells, mine cryptocurrency (XMRig), and steal API keys and database credentials; the ransomware group Qilin has been linked to exploitation of the related LiteLLM flaw.
← All postsWhy it matters: SonicWall SMA is a common remote-access/VPN appliance in small and mid-sized businesses, and Artifactory is increasingly used even by smaller development teams. If your company runs either of these products, these are near-maximum-severity flaws (CVSS 9.8–10.0) that are already being exploited in the wild — patching them should take priority over your regular monthly cycle.