Last Week in Tech for Monday 14 September 2026, covering 7 to 13 September.

Microsoft's largest Patch Tuesday ever (8 Sep): around 970 CVEs — 974 per Microsoft's own release note, 964 per Tenable, 966 per BleepingComputer. Two were already being exploited, both Windows privilege escalation, both CVSS v3.1 7.8: CVE-2026-85880 (ALPC heap buffer overflow) and CVE-2026-81963 (Windows Update Stack link-following), per Tenable the first Update Stack flaw ever caught being exploited. Both are local escalation, not initial access. ZDI's Dustin Childs rates Exchange CVE-2026-55007 (8.1, malicious Visio attachment) the month's most important patch, and calls Windows DNS Server CVE-2026-69730 (9.8) the spiritual successor to SigRed. September's Windows Server updates break Remote Desktop Services — test first.

Magento and Adobe Commerce "StyleSm ...