The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs.