The scary surprises in the largest security update ever include defense bypasses and unauthenticated RCEs.