Microsoft's 'atypical' emergency Windows patches are becoming awfully typical

Administrators sigh: OOBs, they did it again

Opinion Microsoft has had a bad start to the year. Two out-of-band updates in the weeks after the first Patch Tuesday of 2026 rattled administrators' already shaky faith in the company. But are things getting worse?

According to Register readers, and the company's own release health dashboard, the answer has to be yes. It isn't just you. The frequency of emergency out-of-band releases for the company's operating systems has been rapidly increasing to the point where, for every Patch Tuesday update, there'll likely be at least one out-of-band patch to fix whatever got broken.

To be fair to Microsoft, it is also more than capable of emitting out-of-band releases when it finds things have been broken that were not part of the Patch Tuesday cadence.

Microsoft states that out-of-band releases "are used in atypical cases, such as security vulnerabilities or a quality issue, when devices should be updated immediately instead of waiting for the next monthly quality update release."

We asked Microsoft Copilot what "atypical" meant. It responded: "The word 'atypical' simply means not typical – something that is unusual, irregular, or out of the ordinary."

As opposed to "something that seems to be happening quite a lot lately."

In April 2025, Windows Server 2022 got an out-of-band update. It was soon joined by Windows Server 2025. May last year was a busy month for the Microsoft bork fairy as multiple out-of-band updates were released for the company's desktop as well as its server products, and so it goes on.

Even Windows 10, the general demise of which was announced last year, has continued to require out-of-band updates, despite the ending of free support. With much fanfare, Microsoft pulled the plug on many versions in October, but offered the olive branch of Extended Security Updates. However, with every update since, the company has had to follow up with at least one fix.

While it is important not to mix causation and correlation, it is difficult not to note that the current spate of emergency updates has coincided with Microsoft laying off thousands of employees and CEO Satya Nadella boasting that more than 30 percent of the company's code was the result of AI contributions.

That Microsoft rapidly pushes out fixes is a good thing. That stuff got broken in the first place is not so good. And certainly it's not good for the legions of administrators tasked with managing fleets of Windows devices and virtual machines. Since there is a very good chance that a critical security update might break something and be followed by an out-of-band release (some unkind wags have begun referring to the depressingly regular fixes as OOPs rather than OOBs), many administrators could be tempted to hold off installing a critical security patch for fear that it might result in an unfortunate event.

Reg reader Chris Hill said: "The out-of-band updates mainly complicate the risk assessment of patch timing – whether to leave your company at risk of cyberattack by waiting to patch – or whether to press on, knowing that productivity could also be impacted by a showstopper issue in the update."

Hill also noted that the potential productivity loss could be huge, "both in terms of people trying to work with the bugs themselves (from the bad patch) and the installation and reboot time required for users and infrastructure."

The faffing around with administrative tools, the reboot time, and everything else associated with an out-of-band update all mount up, particularly given the millions (or more) of Windows devices worldwide.

We asked Microsoft whether its testing regime had changed over the last year and if it had been making greater use of AI tools in its development processes, but the company has yet to share anything.

For a business keen to promote the productivity gains from its AI tools, such as Copilot, the loss of user productivity caused by the increasing frequency of emergency patches to fix whatever was broken by a previous update is less than ideal.

As administrators deal with two emergency updates in the weeks since January 2026's Security Update, the words of Microsoft's CEO – "2026 will be a pivotal year for AI" – will be greeted more with dread than anticipation. ®