What This Month's Record Patch Tuesday Says About Machines Reading Your Content

Nearly 1,000 Fixes And What It Means

Microsoft shipped its largest Patch Tuesday ever on September 8. Nearly 974 CVEs in one release, including two zero-days already being exploited in the wild. For context, that is the kind of number that used to take a full year of disclosures to reach.

Security researchers are attributing a lot of that volume to AI-assisted vulnerability discovery that has been ramping up since mid-2026. Models are now good enough to comb through massive codebases and flag patterns a human reviewer would miss or simply not have time to check.

That is worth sitting with if you run a website, because the same underlying capability, machines parsing enormous amounts of structured information and pulling out what matters, is exactly what is happening every time ChatGPT, Perplexity, or Gemini decides what to cite in an answer.

Microsoft's patch count is a security story on the surface. Underneath, it is a proof point. AI systems are getting dramatically better at reading structure at scale, whether that structure is a codebase or a webpage.

If a model can find a buried vulnerability in millions of lines of code, it can certainly find your pricing page, your FAQ, or your Article schema. Whether it can read it cleanly is a different question, and that is where the checklist comes in.

The Schema That Still Counts

Google made this simpler in 2026, whether or not marketers noticed. FAQPage schema, the thing half the internet's SEO plugins were bolting onto every blog post, got quietly retired from rich results on May 7. Checklists that were still recommending it by August were already out of date. Citelity rebuilt its own AEO checklist that month and cut FAQPage along with HowTo out of the 47 items that remained.

What survived the cut matters more than what got dropped. Article JSON-LD is still there, and the detail worth noting is the author field. It needs to be structured as a Person object, not just a name string sitting in the byline. Citevera's checklist, updated in early May, weights the schema cluster highest of anything it tracks for citation lift, and that cluster leans on Organization and WebSite schema living on your homepage, not buried three pages deep.

None of this requires a special AI-flavored markup. Google has been clear that there is no separate schema standard built for AI Overviews or answer engines. The models are reading the same JSON-LD that has been sitting on well-built websites for years. The bar isn't inventing new tags. It's making sure the old ones are actually there, actually correct, and actually pointing at a real person and a real organization.

Source Pages Models Actually Cite

Schema tells a model your content exists and who wrote it. It does not give the model a reason to quote you over the next result. That reason has to come from what is actually on the page, and the 2024 GEO study on generative engine optimization found the same thing checklist after checklist keeps circling back to: original data is what gets pulled into an answer. Benchmarks, survey numbers, anything that did not already exist somewhere else on the internet before you published it.

Think about why. A model answering a question about, say, average response times for small business email support is not going to cite your opinion on the matter. It is going to cite a number. If you ran a survey of forty of your own customers and published the result, you are now the source for that number, at least until someone else runs a bigger one.

A source page built for this does not need to be complicated. It needs a clear methodology line, so the model and the reader both know where the number came from. It needs the actual figures, not a summary of the figures. And it needs a date, because freshness is part of how these systems decide whether to trust what they are reading.

Skip The Fake AI Schema Trend

Search "AI schema for AEO" and you will find vendors selling exactly that. A special markup, a proprietary tag set, something you buy to make ChatGPT notice you. Google addressed this directly in 2026: there is no unique schema required for AI Overviews or answer engines. Standard JSON-LD, done correctly, is sufficient. That statement alone should have killed a whole category of consulting pitches. It probably has not.

The pattern is familiar if you have watched SEO long enough. A new acronym shows up, and within a year someone is charging four figures a month for a service that amounts to things a developer could implement in an afternoon.

For this week, here is what actually moves the needle. Confirm your Article schema has an author field structured as a Person object, not a plain name. Add Organization and WebSite schema to your homepage if it is missing. Pull FAQPage schema off any page still running it. Publish one page with a real number your business generated, not a summary of someone else's data. Put a date on it.

That is the whole list. No fake AI schema required, because it does not exist.