Microsoft Just Shipped the Largest Patch Tuesday Ever Recorded, and North Korean Hackers Compiled Their Spy Tool Directly Into a Load Balancer's Own Source Code

The Largest Patch Tuesday Microsoft Has Ever Shipped

Start with the number that's genuinely without precedent: Microsoft's September Patch Tuesday fixed roughly 974 CVEs by the company's own release-note count — more than double August's total, and the largest single Patch Tuesday release in the program's history. Worth being upfront about the exact figure, since it's a real point of disagreement across the industry rather than one clean number: BleepingComputer counted 966, the Zero Day Initiative logged 972 new CVEs, and Tenable put the total at 964, with the gap coming down to how each organization counts advisories covering multiple products or revised after initial publication. Most security teams are working from 973 or 974 as the practical figure, and the exact count matters less than what's inside it: two actively exploited zero-days, 20 vulnerabilities Zero Day Initiative's Dustin Childs assesses as potentially wormable, and 37 bugs scored at CVSS 9.8 or higher.

The two confirmed zero-days deserve specific attention, because "exploited" and "Important-rated" sitting on the same line is exactly the combination that gets deprioritized by mistake. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call — Microsoft's advisory describes an attacker who can already execute code inside a low-privilege AppContainer using the flaw to escape that sandbox and elevate to System privileges, with no additional user interaction required. Notably, Microsoft hasn't patched an ALPC vulnerability since April 2023, and this is only the second ALPC zero-day resolved in nearly four years — a real, if narrow, target that attackers clearly returned to. The second, CVE-2026-81963, is an elevation-of-privilege flaw in the Windows Update Stack, also rated Important despite confirmed exploitation. Neither Microsoft's advisory nor outside researchers have disclosed who's behind the exploitation or which organizations were targeted, which is standard practice for an active investigation but does mean defenders are patching against a confirmed threat without yet knowing its shape.

The vulnerability drawing the most forward-looking concern this month isn't one of the two confirmed zero-days at all. CVE-2026-69730, a remote code execution flaw in Windows DNS, hadn't been exploited as of Tuesday according to Microsoft — but the company said explicitly that it expects it will be. An unauthenticated attacker can trigger it by sending a single specially crafted packet to an affected DNS service over the network, with no authentication or user interaction required, and researchers have already drawn the comparison directly to SigRed, the 2020 "wormable" Windows DNS Server vulnerability that set off a genuine industry-wide scramble at the time. As one researcher put it plainly: a global worm hasn't happened in years, but a DNS flaw built this much like SigRed's spiritual successor is exactly the kind of bug that could change that fast. If your organization runs Windows DNS Server anywhere in its environment, this is worth treating with real urgency even though Microsoft hasn't confirmed active exploitation yet — "expected to be exploited soon" is about as clear a warning as a vendor advisory gets.

This record Patch Tuesday didn't land in isolation, either. The same week saw Adobe ship an emergency, out-of-cycle fix for CVE-2026-75650 — the StyleSmuggler Magento and Adobe Commerce zero-day covered on this site earlier this week — alongside ten separate bulletins covering 172 more CVEs across Experience Manager, Acrobat, and Reader. Six significant vulnerability disclosures across five major vendors inside a single week is a genuinely heavier load than most security teams plan capacity around, and it points at something worth naming directly: patch prioritization has become a scarce resource vendors are effectively competing for, whether or not any of them intend it that way. If your organization's patch management process assumes a roughly predictable monthly cadence, this month is a useful stress test of what happens when six vendors' urgent releases all land in the same seven-day window.

A Backdoor Compiled Directly Into the Load Balancer's Own Code

The second story of the day comes from a different part of the world and a genuinely different kind of cleverness. Rapid7 Labs documented a previously undocumented Linux toolkit found compiled directly into the trojanized HAProxy load balancers running at two South Korean organizations, in the automotive and media sectors specifically. Rapid7 attributes the toolkit to North Korean state-sponsored actors with medium confidence, and named it "ted" after debug strings the attackers left behind in the binary — to be clear, this isn't a vulnerability in HAProxy itself; deploying it requires an attacker to already have code execution on the host and the ability to replace the running binary, meaning it's a post-compromise persistence and surveillance tool, not an entry point on its own.

What makes it worth understanding in detail is exactly how deeply it integrates with genuine, legitimate infrastructure. Rather than running as a separate malicious process sitting alongside HAProxy — the kind of thing a security tool might eventually notice as an unfamiliar binary — the ted backdoor is compiled directly into HAProxy's own source code as a custom filter plugin, using the software's native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept HTTP traffic. Genuine load-balancing traffic keeps flowing normally on top of it the entire time. The backdoor hooks HAProxy's own HTTP parser to inspect decrypted traffic before it reaches backend services, capturing source IPs, Host headers, Referrer values, User-Agent strings, and session cookies, and selectively deciding whether to inject malicious scripts into the page being served to a specific visitor — all while every other request through that same load balancer behaves completely normally. Because the manipulation happens at the load-balancer layer itself, Rapid7 notes that neither the originating application nor the backend server necessarily even records that anything was altered.

The toolkit doesn't stop at the one backdoor. Rapid7 also found trojanized versions of crond, agetty, atd, sshd, and polkitd — core Linux system utilities — compiled with the same technique, including a modified sshd that silently captures plaintext SSH passwords, encrypts them with a custom substitution cipher, and writes them to a fixed path on disk for later retrieval. A companion curl-based remote access trojan the researchers call CurlRAT checks in with its command-and-control server every 12 hours by default, dropping to a 30-second polling interval whenever an operator flags it for more active use, and supports command execution, payload delivery, reverse shell access, and full host profiling. Rapid7 traced initial access in the observed cases back to exploitation of a vulnerability in a Groupware login portal exposed on an edge server — the standard, unglamorous entry point that so many of this year's more sophisticated persistence toolkits keep turning out to start from. Both confirmed victims were running HAProxy 2.8.12, released back in November 2024, and researchers drew a direct comparison to Operation SyncHole, an earlier South Korea-focused campaign that used similarly targeted, server-side traffic manipulation to selectively serve malicious content to specific visitors rather than everyone who passed through. If your organization runs HAProxy or similar load-balancing infrastructure at the network edge, the practical takeaway is to verify the integrity of your running binaries against known-good builds directly, since a backdoor this deeply integrated into legitimate code is specifically designed not to look unusual from the outside.

The Common Thread

Two stories, wildly different in scale and origin, but both circling the same underlying idea: depth of integration is what makes a threat hard to see coming. Microsoft's record Patch Tuesday is, in one sense, the opposite of hidden — it's 974 disclosed, documented, patchable vulnerabilities, the visible tip of an enormous amount of code that's been running in trust for months or years before anyone found the flaw. The ted backdoor is the deliberately invisible version of the same idea, built specifically to be indistinguishable from the legitimate software carrying it. Between an overwhelming public patch list and a backdoor engineered to leave no trace, the practical lesson lands in the same place either way: verify what your infrastructure is actually running, on a real cadence, rather than assuming that because something has been working normally, it still is exactly what it was installed as.