enterprise environments Archives

Winsage

September 1, 2026

TerminalFix Attacks Use Fake CAPTCHAs To Secretly Hack Windows PCs

Microsoft Threat Intelligence has identified a new variant of the ClickFix malware campaign called "TerminalFix." This variant uses deceptive CAPTCHAs that mimic trusted services like Cloudflare and directs users to PowerShell or a command prompt, allowing for the execution of complex scripts. TerminalFix aims to orchestrate a multi-stage attack that provides attackers with persistent, network-level proxy access through the compromised host, potentially leading to significant data theft and malware propagation within unsecured enterprise networks. Recommendations for defense against TerminalFix include restricting access to PowerShell and Windows Run dialogs, monitoring for DLL sideloading indicators, blocking Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. The attacks primarily target enterprise environments rather than individual consumers.

Winsage

August 20, 2026

Microsoft shares detailed guide for IT admins on saving massive internet data on Windows 11

Microsoft has released a guide for IT administrators focused on optimizing Windows deployments and reducing bandwidth usage through Windows Delivery Optimization configured via Microsoft Intune. Delivery Optimization uses a peer-to-peer sharing system, allowing devices to download content from each other instead of solely from Microsoft servers, which helps reduce internet strain for organizations with many Windows PCs. Administrators can create specific peer groups based on network topology and control bandwidth usage for downloads, with options to set different limits for business and off-hours. Microsoft also introduced Connected Cache, which stores frequently accessed content locally to further minimize bandwidth consumption. A statistic shared by Microsoft indicates that using Delivery Optimization can significantly reduce internet traffic, as a 1 GB update for 10,000 devices could otherwise generate 10 TB of internet traffic. The guide recommends starting with a small seeder ring of devices to populate peer caches before wider deployment. Microsoft provides specific policy settings for Delivery Optimization, including default and recommended values for settings such as download mode, peer selection, cache size, minimum file size for caching, cache age, and monthly upload data cap. Proper configuration of Delivery Optimization is suggested to benefit organizations managing large numbers of devices.

Winsage

August 16, 2026

LeakWatch CW 33/2026: Windows Zero-Day, AMD, Intel and Malware

- The August Patch Tuesday release included 421 vulnerabilities, with 236 affecting Windows, highlighting CVE-2026-68820, a critical use-after-free vulnerability that allows privilege escalation to SYSTEM level without user interaction. - CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation. - AMD's Ryzen Master software has vulnerabilities, including CVE-2025-54512 (DLL hijacking) and CVE-2026-0465 (use-after-free), which could allow code execution with elevated privileges. - AMD's advisory on CVE-2026-6726 and CVE-2026-6727 indicates vulnerabilities in the TPM 2.0 reference code affecting Ryzen platforms, leading to potential information disclosure. - Intel's advisories included updates for microcode, Wi-Fi software, and NPU drivers, with CVE-2026-20760 addressing privilege escalation risks. - Google’s Chrome update on August 11 fixed five high-severity vulnerabilities, including use-after-free flaws. - Gunra malware has evolved into a ransomware-as-a-service model using a double-extortion strategy. - WindRelay malware combines SpyNote RAT with an NFC relay component, allowing attackers to relay NFC communication between a victim's bank card and a remote device. - The findings emphasize the need to view vulnerabilities as part of potential attack chains, highlighting the complexity of modern cybersecurity threats.

Winsage

July 20, 2026

Windows Server Update Services buckle under Microsoft’s metadata mountain

Microsoft's Windows Server Update Services (WSUS) is facing significant challenges, particularly with existing deployments experiencing synchronization issues described as "sync purgatory." The problems stem from "severe degradation" due to a "buildup of publishing metadata," leading to slow synchronization processes and timeouts. This issue is not related to the recent Patch Tuesday update but has seen a "heightened impact" since July 13, 2026. Although WSUS is a critical tool for managing updates in enterprise environments and remains supported, Microsoft has recommended transitioning to alternative solutions, especially cloud-based options, since October 2024. Many administrators continue to rely on WSUS, which poses risks of failed synchronization and potential vulnerabilities. As of now, Microsoft has not provided a workaround for affected servers but has implemented a mitigation for new installations as of July 18. Existing servers are still experiencing difficulties, and Microsoft is working on solutions to help remove problematic metadata. The issue affects nearly all desktop and server operating systems supported by WSUS, including Windows 11 26H1 and older versions like Windows 10 1607 and Windows Server 2012. Administrators currently have limited options and must monitor the situation as it develops.

Winsage

July 20, 2026

July 2026 Patch Tuesday: KB5101650 Windows 11 Update

On July 14, 2026, Microsoft released cumulative update KB5101650 for Windows 11 versions 25H2 and 24H2, addressing OS Builds 26200.8875 and 26100.8875. This update includes essential security fixes, updates to Secure Boot certificates, and enhanced Remote Desktop Protocol (RDP) defenses against phishing attacks. It consolidates July 2026's security content, addressing known vulnerabilities and introducing functional improvements. The update is critical for minimizing exposure to identified threats and is prioritized for systems managing remote access or nearing certificate expiration. The update enhances Remote Desktop security by supporting SHA-2 certificate thumbprints while retaining SHA-1 for legacy compatibility. It includes new Group Policy options to mitigate phishing risks associated with malicious .rdp files. The curl upgrade to version 8.21.0 incorporates security patches for command-line tools in Windows environments. Secure Boot certificates are automatically updated through Windows updates, ensuring boot security across various hardware. KB5101650 installs primarily through the Windows Update interface, requiring a restart to activate changes. Enterprise environments can use the Microsoft Update Catalog for manual distribution. A temporary restriction affects certain Dell devices with Intel Innovation Platform Framework drivers, which Microsoft plans to address in a future update. The cumulative update resolves a total of 622 Microsoft CVEs, including 416 affecting Windows components. Users are advised to verify and install the update promptly to secure the full suite of improvements.

Winsage

July 17, 2026

Windows 11 Gets Policy to Automatically Grant SSO Permissions

Microsoft has introduced a new policy to simplify the Windows sign-in process for IT administrators by allowing automatic approval of Single Sign-On (SSO) permissions on eligible managed devices. This feature will be available with the July 2026 security update for Windows 11 versions 24H2 and 25H2. Users in the European Economic Area (EEA) have been facing prompts for consent due to regulatory changes, prompting Microsoft to streamline access for managed devices. IT administrators can use a specific registry setting (HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, Value: AutoAcceptSsoPermission (DWORD) = 1) to automatically grant SSO permissions. This feature is designed for managed enterprise devices linked to Microsoft Entra ID and does not affect personal accounts or unmanaged devices. Organizations must ensure their devices are updated and can enable the feature through various enterprise management tools.

Winsage

July 16, 2026

Microsoft makes Windows SSO prompts easier to manage

Microsoft is introducing a registry-based policy to improve the management of Single Sign-On (SSO) permissions for devices running Windows 11 versions 24H2 and 25H2, specifically for those managed through Microsoft Entra ID. This policy allows IT administrators to automatically accept SSO permissions, enhancing the user experience in corporate environments. Users with personal Microsoft accounts or unmanaged devices will still receive prompts for SSO permissions. The change aims to provide users, particularly in the European Economic Area (EEA), with more control over their account usage across Microsoft applications. Deployment options for IT administrators include Group Policy, Microsoft Intune, other mobile device management solutions, Microsoft Configuration Manager, and any management tool that supports registry policy deployment. Administrators are advised to validate SSO behavior after deployment.

Winsage

July 13, 2026

Microsoft demystifies how Windows updates work

Microsoft has released a guide on the Windows servicing model, detailing monthly security updates, optional preview releases, hotpatch updates, and feature rollout mechanisms. Patch Tuesday occurs every second Tuesday of the month, delivering cumulative security updates to supported Windows versions. For consumers and small businesses, updates are managed through Windows Update, while enterprises can use various tools like Windows Autopatch and WSUS. Hotpatch updates, which focus on security fixes, can be installed without a restart, unlike quarterly baseline updates that require one. Optional non-security preview updates are released in the fourth week of each month for testing upcoming fixes and new features, available only for the latest supported Windows versions. Unmanaged devices can access these updates through Windows Update settings, while IT-managed devices depend on organizational policies. Microsoft also issues out-of-band updates to address urgent issues, which can be deployed through enterprise management tools. New features for Windows 11 are rolled out throughout the year via various channels, with a gradual rollout strategy to monitor quality and compatibility, using the Controlled Feature Rollout approach.

Winsage

July 7, 2026

Windows 11 24H2 and 25H2 Issue Causes Black Screen, Start Menu Failure, and Taskbar Crashes

Microsoft has addressed critical user interface failures affecting Windows 11 versions 24H2 and 25H2 in enterprise environments, documented under update advisory KB5072911. These issues arise from cumulative updates released after July 2025, including KB5062553 and KB5065789, primarily impacting enterprise-managed systems and virtualized environments. Users may experience black screens, unresponsive Start menus, and taskbar failures following updates, particularly in non-persistent environments like Virtual Desktop Infrastructure (VDI). Core components such as Explorer.exe and XAML-dependent applications may fail to initialize or crash due to a timing issue in the update process, where required application packages are not properly registered. Microsoft has released updates starting June 23, 2026, under KB5095093 to address these issues and recommends temporary workarounds for affected systems, including manual registration of missing packages and deploying logon scripts in non-persistent environments. Organizations are encouraged to install the latest updates and review their update procedures to prevent future disruptions.

Winsage

July 4, 2026

Microsoft Edge 150 Adds Google Account Sign-In on Windows and macOS

Microsoft has introduced the ability to sign into its Edge browser using a Google account, starting with version 150 on Windows and macOS. This feature allows users to integrate their Google accounts alongside Microsoft accounts and is being rolled out gradually. System administrators can manage this feature through the NonMicrosoftAccountSignInEnabled policy, which organizations can enable or disable based on compliance and security needs. Edge 150 is the last version compatible with macOS 12 Monterey, and users are encouraged to upgrade to macOS 13 Ventura or later. The update has transitioned the Workspaces feature to a new architecture but removed the sharing function. Users can sign in to Google accounts by updating to version 150.0.4078.48 or newer and following the sign-in process in Edge Settings.