Patch [FIX] Tuesday – [973 CVEs and a New Patch Tuesday Record], Ep. 36

Labor Day is over and Microsoft made up for the day off. Landon Miles and Serena DiPenti sort September's Patch Tuesday down to the six bugs that matter, starting with the only one Microsoft confirms is already exploited: a Windows Update Stack privilege escalation that hands attackers SYSTEM, published with no score and no affected-product list. They also cover: - An unauthenticated remote code execution in Windows DNS Server, rated more likely to be exploited, and why it's a domain controller problem for most shops - A Remote Desktop Services bug that scores 9.8 but carries an Important label, and why the label shouldn't set your patch order - SQL Copilot in Management Studio ignoring its own read-only restrictions, and where the real guardrail belongs - An Outlook flaw that fires from the Reading Pane with no click, and why a Microsoft 365 subscription doesn't mean the fix is already installed - An Exchange Server bug that lets one low-privilege mailbox impersonate every other user Plus macOS Tahoe 26.6.2 and what's behind the month's record CVE count. Know what you run, patch the exploited one first, then work down your list.