The first entry is always the pin's source. Overall confidence is a weighted average of how firmly each reference supports the start and end times used above; a reference counts half as much for every 180 days older than the newest.
Stated as firm, per bleepingcomputer.com (8 September 2026): "Today is Microsoft's[6] September 2026 Patch Tuesday"; the time is Microsoft Learn's "second Tuesday of each month, typically at 10:00 AM Pacific Time", 17:00 UTC under daylight time.
Help Net Security covers the record count, the two exploited zero-days and their reporters, and ZDI's warning about 20 wormable bugs including DNS flaw CVE-2026-69730, a 'spiritual successor to SigRed'.
Malwarebytes Labs independently reports the September 2026 Patch Tuesday's record vulnerability count and its two actively exploited zero-days.
SecurityWeek reports on the day that Microsoft[6] rolled out a record 974 CVEs including the ALPC (CVE-2026-85880) and Windows Update Stack (CVE-2026-81963) zero-days, and quotes ZDI on 20 potentially wormable bugs.
Tenable Research's analysis counts 964 CVEs (104 critical, 860 important), calls it the largest Patch Tuesday, and details both exploited zero-days with CVSS 7.8 scores.
Something missing or wrong? Say it in your own words: a link that backs this pin up, a different start or end date and why, or a fact it lacks or gets wrong. The AI checks it against this pin's sources, searches for better ones, and adds any page that backs you up. The pin's own sources still count most.
