🤚 The Open-Palm Patch Dump

It’s the second Tuesday of June, which means Microsoft has once again gathered its quarterly shame into a tidy release and asked the entire internet to please update immediately. This month’s offering: 200 security vulnerabilities and three zero-days, because apparently even Microsoft’s bug count is subject to inflation.

The breakdown reads like a curriculum at a hacking academy:

• 65 Elevation of Privilege flaws
• 55 Remote Code Execution vulnerabilities
• 30 Information Disclosure issues
• 27 Spoofing vulnerabilities
• 19 Security Feature Bypass flaws
• 7 Denial of Service bugs

None of the three zero-days are currently being exploited in the wild, which in 2026 simply means nobody has told Microsoft yet.

👐 The Two-Handed CVE Tasting Menu

Let’s uncork the three publicly disclosed zero-days, shall we.

CVE-2026-45586 — Windows CTFMON Elevation of Privilege. The Windows Collaborative Translation Framework — a component most administrators didn’t know existed and probably wish still didn’t — contains a link-following vulnerability that grants SYSTEM privileges to any authorized attacker who knows where to point it. Discovered by a researcher tracked as “GreenPlasma” under the handle Nightmare Eclipse, because the cybersecurity industry has never met a pseudonym it didn’t want to dramatically capitalize.

CVE-2026-49160 — HTTP/2 Denial of Service. Regular readers of this publication will recognize this one. Back on June 4th, we reported that an AI agent had discovered a vulnerability capable of crashing any web server on Earth in ten seconds using HTTP/2 header compression abuse. Well, Microsoft has now assigned it a CVE, confirmed it affects HTTP.sys, and shipped a mitigation in the form of a new MaxHeadersCount registry setting. The original discoverers — Quang Luong and Codex of Calif.io — can now add “crashed the internet and got a registry key named after it” to their résumés. Two out of five major platforms still have no patch, so the HTTP/2 Bomb remains a live weapon with a fresh CVE number and an expanding blast radius.

CVE-2026-50507 — BitLocker Security Bypass. Windows BitLocker, the encryption feature that protects your data from anyone who steals your laptop, can be bypassed by anyone who steals your laptop. A physical attack allows local access to encrypted drives, which rather defeats the purpose of encrypting them. Also discovered by Nightmare Eclipse, this time tracked as “YellowKey”, because one pseudonym per vulnerability would be insufficiently dramatic.

🌿 The Gentle Awakening

There is something almost meditative about Patch Tuesday. Every month, like clockwork, Microsoft reveals that the software running most of the planet’s critical infrastructure contained — and we are being generous here — a few oversights. Every month, security teams cancel their afternoon plans. Every month, the number goes up.

Two hundred vulnerabilities in a single patch cycle is not a crisis. It’s a cadence. We have industrialized the discovery of our own incompetence, and that’s either the most mature thing the software industry has ever done or the saddest. Possibly both.

The fact that none of the three zero-days are being actively exploited is genuinely good news, of course. But it also means the clock is ticking. The CVEs are public. The details are published. And somewhere, a threat actor is reading the same BleepingComputer article you are, except they’re taking notes in a different kind of notebook.

👑 The Gold-Leaf Patch Cycle

The real story this month is CVE-2026-49160 — the HTTP/2 Bomb graduating from “terrifying proof of concept” to “official Microsoft vulnerability with a mitigation that requires editing the Windows registry.” If you are a sysadmin and your response to a denial-of-service vulnerability is “I’ll just add a registry key,” then congratulations: you are now Microsoft’s last line of defense, and the line is a .reg file.

Meanwhile, two out of five affected platforms still haven’t patched at all. The CVE number gives the vulnerability legitimacy, a tracking ID, and — most importantly — a deadline. Exploit code has been on GitHub since the discovery. The only question is how long the unpatched platforms will treat this as someone else’s problem before it becomes everyone’s problem.

Patch Tuesday is not a reminder to update your software. It’s a reminder that your software needed updating before you knew it did.

“Two hundred vulnerabilities, three zero-days, and a registry key walk into a bar. The bartender says ‘We’re closed for maintenance.’ The zero-days say ‘We know.'” — The Slap of Wisdom Patch Management Bureau, applying updates in a change window that closed forty-five minutes ago