Patch Tuesday releases Archives

Winsage

July 29, 2026

Missed Windows 11 Secure Boot? Don’t panic, Microsoft is still pushing it in the coming months

Microsoft reassured Windows 11 and Windows 10 users that their PCs will continue to boot normally and receive updates even if they have not yet received the new Secure Boot 2023 certificates. The rollout of these certificates is expected to continue over the upcoming months. The initial Secure Boot certificate expired on June 24, 2026, and Microsoft has been replacing older 2011 certificates since 2024. The latest update, KB5101650, transitioned Windows 11 to OS builds 26200.8875 and 26100.8875 for versions 25H2 and 24H2, respectively. The 2023 certificates replace older certificates with modern cryptographic standards, allowing Microsoft to deliver DBX revocation updates without interruption. Devices using the 2011 KEK can only receive DBX updates signed with that key, which is no longer valid after June 24. Microsoft has been rolling out the 2023 certificates for the past two years, and many devices remained in a yellow or red status by the June deadline. To check Secure Boot status, users can navigate to Windows Security > Device Security. A green checkmark indicates successful application of the certificates, while yellow and red alerts indicate compatibility issues or firmware incompatibility. PCs that are older or operating in Legacy BIOS mode will not receive the updates. Windows 10 also receives Secure Boot updates, but enrollment in Extended Security Updates (ESU) is required.

Winsage

July 20, 2026

Windows 11’s biggest updates may need multiple reboots, but that’s normal, don’t force shutdown

Users may experience double reboots when installing substantial Windows updates, such as the April and July 2026 Updates, due to factors like Secure Boot and .NET Framework updates. The July 2026 .NET Framework update specifically requires a separate reboot. Microsoft is still rolling out the Secure Boot 2023 certificate update, which may also lead to multiple reboots. Users are advised not to panic during these reboots and to allow the system time to complete the installation process. Additionally, Microsoft has warned against delaying updates for more than three days due to increasing update sizes related to security vulnerabilities. Some users may encounter SCEP certificate errors in the Event Viewer after the July 2026 Update, but these errors do not indicate a failure of the update process.

Winsage

July 20, 2026

July 2026 Patch Tuesday: KB5101650 Windows 11 Update

On July 14, 2026, Microsoft released cumulative update KB5101650 for Windows 11 versions 25H2 and 24H2, addressing OS Builds 26200.8875 and 26100.8875. This update includes essential security fixes, updates to Secure Boot certificates, and enhanced Remote Desktop Protocol (RDP) defenses against phishing attacks. It consolidates July 2026's security content, addressing known vulnerabilities and introducing functional improvements. The update is critical for minimizing exposure to identified threats and is prioritized for systems managing remote access or nearing certificate expiration. The update enhances Remote Desktop security by supporting SHA-2 certificate thumbprints while retaining SHA-1 for legacy compatibility. It includes new Group Policy options to mitigate phishing risks associated with malicious .rdp files. The curl upgrade to version 8.21.0 incorporates security patches for command-line tools in Windows environments. Secure Boot certificates are automatically updated through Windows updates, ensuring boot security across various hardware. KB5101650 installs primarily through the Windows Update interface, requiring a restart to activate changes. Enterprise environments can use the Microsoft Update Catalog for manual distribution. A temporary restriction affects certain Dell devices with Intel Innovation Platform Framework drivers, which Microsoft plans to address in a future update. The cumulative update resolves a total of 622 Microsoft CVEs, including 416 affecting Windows components. Users are advised to verify and install the update promptly to secure the full suite of improvements.

Winsage

July 12, 2026

Microsoft is now using AI to fix Windows bugs before hackers exploit them

Microsoft is integrating artificial intelligence into its vulnerability detection processes for the Windows operating system to enhance security. This will lead to more frequent security updates during monthly Patch Tuesday releases. The company aims to address the rise in AI-driven exploits and is refining its secure software development model to combat evolving tactics used in AI-driven attacks. While AI will assist in identifying vulnerabilities, human oversight will remain essential, with developers reviewing code and validating AI-generated findings before deploying updates.

Winsage

July 10, 2026

Microsoft explains the different types of Windows updates you get

Microsoft provides various types of Windows updates, including Patch Tuesday updates, which occur on the second Tuesday of each month. An example is the KB5094126 update for Windows 11, released on June 9, which includes both security and non-security content. IT administrators can use tools like Autopatch, Intune, and WSUS to deploy these updates. Hotpatching allows security updates to be applied without restarting devices. Optional non-security preview updates are released in the fourth week of each month for testing purposes and can be accessed by users on non-IT-managed devices. Out-of-band (OOB) updates can be issued at any time to address significant issues or vulnerabilities. Microsoft also enhances Windows 11 through annual updates, monthly updates, and Microsoft Store offerings, utilizing Controlled Feature Rollout (CFR) for feature deployment. Users are encouraged to keep their systems updated and can join the Windows Insider Program for early access to new features.

Winsage

January 17, 2026

How to fix Nvidia GPU FPS drop due to the Windows January 2026 update?

Users with Nvidia GPUs are experiencing decreased gaming performance after the January 2026 Windows update (KB5074109), which was intended to enhance security and address vulnerabilities. Reported issues include drops in frames per second (FPS), black screen freezes, display hangs, and driver crashes related to nvlddmkm errors. Nvidia has released a new GPU driver to address these problems. A temporary solution for affected users is to uninstall the KB5074109 update, although it is a security patch that may need to be reinstalled later. Users can also update their Nvidia drivers to the latest hotfix version and use Display Driver Uninstaller (DDU) in Safe Mode for better results. It is recommended to pause Windows updates until a fix is provided by Microsoft.

Winsage

August 11, 2025

‘Win-DDoS’: Researchers unveil botnet technique exploiting Windows domain controllers

SafeBreach researchers have identified several vulnerabilities in Windows environments that could lead to denial of service (DoS) attacks. These include: 1. CVE-2025-26673: A flaw in the Netlogon service that allows remote crashes via crafted Remote Procedure Call (RPC) requests without authentication, potentially locking users out of domain resources until a reboot. 2. CVE-2025-49716: A vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) that enables remote attackers to destabilize the service through specially crafted Lightweight Directory Access Protocol (LDAP) queries, causing immediate DoS. 3. CVE-2025-49722: A DoS vulnerability in the Windows Print Spooler that can be triggered by malformed RPC requests, disrupting printing operations and system stability. Microsoft has addressed some vulnerabilities but has not yet resolved the three identified by SafeBreach, and there has been no response to inquiries about these issues. SafeBreach recommends organizations apply the latest patches, limit exposure of Domain Controller services, segment critical systems, and monitor for unusual LDAP or RPC traffic for early attack detection.

Winsage

August 11, 2025

Win-DoS’ Zero-Click Exploit Could Weaponize Windows Infrastructure for DDoS Attacks

Security researchers have identified a "zero-click" denial-of-service (DoS) exploit that can covertly turn Microsoft Windows Domain Controllers (DCs) into a global botnet. DDoS attacks increased by 56% year-over-year in late 2024, with Cloudflare blocking an attack that peaked at 7.3 Tbps in 2025. The average minute of downtime from these attacks costs businesses approximately ,000, with incidents for small and midsize firms exceeding 0,000. The exploit, known as Win-DDoS, leverages the Lightweight Directory Access Protocol (LDAP) client in Windows, allowing DCs to automatically target victim servers through LDAP referrals without user interaction. This results in thousands of DCs inadvertently overwhelming a target with TCP traffic. Four vulnerabilities (CVEs) related to this exploit were disclosed to Microsoft in March 2025 and addressed in subsequent patch releases in June and July 2025. These vulnerabilities include: - CVE-2025-32724: LSASS (LDAP client) - None needed, causes memory exhaustion/DC crash, patched June 2025. - CVE-2025-26673: NetLogon (RPC) - None needed, causes TorpeDoS memory crash, patched May 2025. - CVE-2025-49716: NetLogon (RPC) - None needed, causes Stateless RPC DoS, patched July 2025. - CVE-2025-49722: Print Spooler (RPC) - Authenticated user needed, causes any Windows endpoint crash, patched July 2025. The vulnerabilities indicate significant architectural flaws in the LDAP client’s referral logic and RPC interfaces. SafeBreach advises administrators to apply patches promptly and limit DC exposure to the Internet. The emergence of Win-DDoS marks a shift in attack strategies, utilizing legitimate servers for amplification without leaving malware traces, complicating detection and response efforts. Enterprises are urged to enhance their threat models and implement DoS hardening measures.

Winsage

April 3, 2025

Microsoft adds hotpatching support for Windows 11 enterprise users as it looks to end unnecessary downtime for work devices

Microsoft has introduced hotpatch updates for Windows 11 Enterprise version 24H2, allowing compatible business devices to install OS security patches without requiring a restart. This feature minimizes downtime and user disruption while maintaining security. Hotpatch updates take effect immediately and provide the same level of security as traditional Patch Tuesday releases. Companies must establish a hotpatch-enabled quality update policy through Microsoft Intune to implement this feature. Devices will still require a reboot for security updates installed quarterly, but updates can occur without a restart during the other months. Arm64 devices are currently in public preview, with general availability for hotpatching set for April 2, 2025.

Winsage

November 22, 2024

Microsoft fixes update error in Windows 10 22H2

Microsoft has released a non-security update, KB5046714, which resolves an issue that prevented Windows 10 users from updating applications through the Microsoft Store. This problem was linked to the release of WinAppSDK version 1.6.2 on November 12, which was subsequently retracted. The update KB5046714 specifically addresses the update issues for Windows 10 22H2. Additionally, Windows 11 users received two interim updates: KB5046740 for Windows 11 24H2 and KB5046732 for Windows 11 22H2 and 23H2.