206 Patches, 3 Zero-Days: How to Triage June's Record Patch Tuesday Without Burning Out Your Team

A Tuesday morning, a coffee going cold, and a patch list that runs to 206 entries. That was the reality for plenty of IT teams when June's update cycle landed — one of the heaviest single batches Microsoft has ever shipped. Three of those flaws were zero-days, meaning attackers were already using them before a fix existed. The rest ranged from genuinely frightening to barely worth a second glance.

Here's the thing nobody tells you when a record-breaking Patch Tuesday hits: you don't have to patch all 206 at once, and trying to will wear your people down before you've fixed the things that actually matter. Triage is the skill. Knowing which dozen updates need attention today, which can wait until the weekend maintenance window, and which can ride along with your normal monthly cadence — that's what separates a calm response from a chaotic one.

Let's walk through how a small UK business and its IT team should approach a month like this without burning anyone out.

Why 206 is a number, not an emergency

The raw count is designed to frighten you. Vendors and headline writers love a big number because it travels well. But a vulnerability count tells you almost nothing about your risk. What matters is three things: can an attacker reach the flaw without already being inside your network, can they exploit it without a logged-in user clicking something, and is anyone actually using it in the wild right now?

Apply those three filters and 206 shrinks fast. Most of the patches in any given month cover bugs that need local access, a privileged account, or a very specific configuration that your business doesn't run. They still need fixing eventually, but they don't justify dragging your engineer out of bed.

The job, then, is to sort the list. Think of it as a triage tent rather than a to-do list — you're deciding who gets seen first based on how badly they're bleeding.

Tier one: the three zero-days

Start here, always. A zero-day means criminals were exploiting the flaw before the patch shipped. There is no grace period and no waiting to see whether anyone bothers to weaponise it — they already have.

For a typical SME, the practical question is simple: are the affected systems exposed to the internet or used daily by your staff? A zero-day in a component nobody runs is interesting trivia. A zero-day in Windows itself, or in a browser your whole team uses, is a same-day job.

When you're working through June's three zero-days, check each one against your actual estate. If it touches your end-user machines or your servers, schedule the fix for today or tomorrow at the latest. Don't wait for the monthly window. The window exists to reduce disruption from low-risk patches — it isn't a rule that overrides an active attack.

Tier two: network-facing remote code execution

After the zero-days come the remote code execution (RCE) flaws that an attacker can hit from across the network without authentication. This is the category that turns a single exposed server into a ransomware incident.

The critical DHCP flaw in June's batch is a textbook example. DHCP is the quiet plumbing that hands out IP addresses to every device on your network — laptops, printers, phones, the lot. Because it sits at the heart of network traffic, a serious flaw there can let an attacker run their own code on the server or knock your network offline. If your DHCP service runs on a Windows server, this one deserves a prominent place near the top of your list.

The rule of thumb for tier two: if the flaw is rated critical, allows remote code execution, and doesn't require the attacker to be authenticated or to trick a user, treat it as urgent. Patch internet-facing systems first, then internal servers, then everything else. A vulnerable mail server or VPN appliance reachable from the public internet is a far bigger problem than the same flaw on a machine buried three layers deep inside your office network.

Tier three: everything that needs a user to slip up

A large slice of any Patch Tuesday covers flaws that only work if someone opens a malicious file, visits a booby-trapped website, or runs a dodgy attachment. These matter — phishing is still how most breaches start — but they sit a rung below the network-facing RCEs because they depend on human action.

These fixes belong in your normal patching rhythm. Roll them out through your usual managed update process over the following days. Pair the technical fix with a reminder to staff about not opening unexpected attachments, and you've covered both halves of the risk.

Tier four: the long tail

The remaining majority — privilege-escalation bugs that need an attacker to already be on the machine, flaws in features you don't use, information disclosures with limited impact — can follow your standard schedule. Test them, deploy them in your next planned window, and move on. There's no shame in a patch waiting a fortnight when it poses no realistic threat to your business.

A simple workflow your team can actually follow

When the next big batch lands, run it through these steps:

• Filter by exposure. Which of these systems can be reached from the internet? Those go first.
• Flag the zero-days and known exploited flaws. Cross-reference against the affected products you actually run.
• Identify the unauthenticated RCEs. These are your tier-two priorities.
• Schedule the rest. Slot the user-interaction and low-severity fixes into your regular cadence.
• Document what you deferred and why. If a flaw doesn't apply to you, write that down. It saves arguments later and proves you made a deliberate choice.

That last point matters more than people expect. The pressure during a heavy month often comes not from the patches themselves but from a vague sense that you might be missing something. A short written record of your decisions turns that anxiety into a defensible plan.

Protecting your people as well as your systems

Team burnout is a security risk in its own right. A tired engineer working through their fourth late night makes mistakes — skips a reboot, misses a server, applies a patch to the wrong group. Asking a small team to treat all 206 fixes as equally urgent guarantees exhaustion and worse outcomes.

Good triage protects both ends. The dangerous handful gets fixed quickly and carefully. The rest gets handled in daylight, properly tested, with someone who's had enough sleep to notice when something breaks.

If your business doesn't have the in-house capacity to sort 206 patches into sensible tiers on the day they drop, that's exactly the kind of work a managed IT provider takes off your plate. We watch the advisories, identify what touches your specific systems, and keep the urgent fixes moving without dragging your staff through every line of the bulletin. A record Patch Tuesday should be a busy afternoon, not a crisis — and with the right priorities, that's all it needs to be.