Patch Tuesday

Winsage
October 4, 2026
In October 2026, Microsoft is addressing ongoing issues from its September updates for Windows 11, particularly related to audio decoding. Certain applications and games using Windows' built-in AC-3 (Dolby Digital) audio decoding may crash when users adjust volume or audio settings. This issue primarily affects older applications and games, while most modern apps are expected to function normally. Microsoft has issued multiple updates, including a mandatory Patch Tuesday update and an emergency patch, but some audio problems remain unresolved. The September updates also introduced a significant increase in security fixes, addressing 974 vulnerabilities compared to 86 in September 2025. Additionally, an emergency update disrupted the functionality of File History, which Microsoft is investigating. An optional update aimed to fix File History but led to new crashes in various applications. Microsoft is currently working on a resolution for the audio-decoding bug without a specified timeline.
Winsage
October 2, 2026
Microsoft has shifted its approach regarding the Copilot key on laptops, moving away from a mandatory integration strategy. Users have reported that the key is often underutilized, with some finding it inconveniently placed. Microsoft has responded to feedback by allowing users to customize the Copilot key's functionality through Windows 11 settings. Users can assign various functions to the key, such as launching applications or acting as a shortcut for system functions. Additionally, Microsoft PowerToys can be used for more advanced customization, enabling users to remap the key for tasks like taking screenshots, managing clipboard history, or enhancing gaming experiences. Future updates may include a "Do nothing" option for the key.
Tech Optimizer
September 28, 2026
Two newly identified Critical CVEs have expanded Microsoft's September identity infrastructure vulnerabilities to over ten verified weaknesses across more than ten distinct services. The Azure Database for PostgreSQL is vulnerable to CVE-2026-85878, an Improper Authorization flaw (CWE-285) with a CVSS score of 9.9. Azure Billing is impacted by CVE-2026-62874, which presents an Insufficient Data Authenticity Verification issue (CWE-345) with a CVSS score of 10.0. Both vulnerabilities were disclosed on September 18 and validated by Tenable and MITRE. CVE-2026-85878 allows an authorized attacker to elevate privileges over the network with minimal complexity, while CVE-2026-62874 requires no authentication, enabling unauthenticated attackers to jeopardize financial integrity. The vulnerability cluster first emerged during the Patch Tuesday cycles on September 3 and September 8, with initial reports highlighting critical flaws in core services. Other September disclosures include CVE-2026-83711 (Azure AD B2C, CVSS 10.0), CVE-2026-70352 (Azure AI Language, CVSS 10.0), CVE-2026-83941 (Entra ID, CVSS 9.9), CVE-2026-62916 (Entra ID, CVSS 9.1), CVE-2026-69857 (Azure Cosmos DB, CVSS 8.5), and CVE-2026-69854 (Spring Cloud Azure, CVSS 9.0). Activity heightened between September 17 and 18 with the introduction of CVE-2026-77903 (Microsoft Dataverse, CVSS 9.0) and CVE-2026-69843 (Microsoft Fabric, CVSS 10.0). The attack surface has broadened from authentication concerns to encompass trust in AI endpoints, data storage locations, and billing verification processes. Seven out of the ten vulnerabilities are unauthenticated, and all issues were addressed through server-side fixes by Microsoft. The extensive range of affected services suggests these vulnerabilities indicate a shared architectural dependency on authentication logic.
Winsage
September 26, 2026
Windows 11 users previously experienced a dual-search environment where local and web results were mixed, often leading to cluttered searches. Many resorted to registry edits to disable web results, but these workarounds were not fully effective. The search interface was complicated by irrelevant web links, making it difficult to find local files. With the introduction of version 26H2, Microsoft added a toggle in Settings that allows users to manage web searches independently, improving the search experience by prioritizing local files. This feature began rolling out after the September 2026 Patch Tuesday update. Disabling web results streamlines the search panel but removes the Copilot entry and may not be immediately available to all users.
Winsage
September 26, 2026
Microsoft has acknowledged that some users may experience desktop loading issues, specifically black screens, after installing the August 2026 preview updates and subsequent releases. This problem mainly affects Azure Virtual Desktop (AVD) hosts using FSLogix. Symptoms include a black screen post-sign-in and crashes related to Windows Explorer, which can be temporarily resolved by manually launching Windows Explorer through Task Manager. For enterprise customers, Microsoft has introduced a mitigation strategy via Known Issue Rollback (KIR), allowing IT administrators to reverse problematic updates by applying specific group policies. Additionally, Microsoft has addressed issues related to the loss of mouse and desktop settings on certain Windows 11 systems caused by the KB5120998 update.
Winsage
September 25, 2026
Microsoft has released the KB5124010 September 2026 non-security preview update for Windows 11 versions 24H2 and 25H2, introducing 46 enhancements, including improvements to Bluetooth functionality and the ability to remap the Copilot key. This update is optional and focuses on quality improvements without security fixes. Key features include support for Emoji 17.0, a new accessibility setting for maximizing app windows, and a recovery remote management plug-in. Bluetooth issues have been addressed, including crashes related to audio streaming and microphone compatibility. Users can remap the Copilot key to function as the Right Ctrl or Context Menu key. The update elevates Windows 11 25H2 and 24H2 devices to builds 26200.9550 and 26100.9550, respectively. Other highlights include the ability to use slideshow wallpapers across multiple desktops, enhanced gesture controls for precision touchpads, and a Camera roll backup feature for OneDrive. Microsoft has fixed a known issue with the File History backup feature and removed the PC-to-PC Migration tool, recommending Windows Backup instead. KB5124010 is the last preview update for Windows 11 24H2, which will reach end of support in October 2026.
Winsage
September 24, 2026
Microsoft has released preview updates for Windows 11 versions 24H2, 25H2, and 26H1 as part of its Week D schedule. Users of versions 24H2 and 25H2 can install the preview cumulative update KB5124010, updating their systems to builds 26100.9550 and 26200.9550, respectively. Enhancements include refinements to File Explorer, support for Emoji 17.0, a new Tips widget, improved desktop backgrounds, enhanced Bluetooth functionality, upgrades to the Settings app, additional touchpad gesture controls, new key remapping options in Copilot, and Wi-Fi support in the Windows Recovery Environment. The final monthly update for Windows 11 version 24H2 will be shipped next month, with the version set to reach the end of its support lifecycle on October 13, 2026. Users of version 26H1 can install the preview cumulative update KB5124006 to upgrade to build 28000.3086. This update includes a resizable Taskbar, customizable Start menu, revamped Windows Search, improvements to File Explorer, enhanced progress indicators, and better app update support.
Winsage
September 23, 2026
Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, released a zero-day exploit called BigDiskBuster that targets Microsoft Defender, preventing antivirus updates and leaving systems vulnerable. BigDiskBuster operates across all supported Windows versions and must run in the background to block updates. Naceri has previously released a similar exploit called UnDefend and has a history of releasing multiple zero-day exploits since April 2026 amid a dispute with Microsoft. Two weeks before BigDiskBuster, he introduced another exploit named ShieldCrash, which grants SYSTEM access and circumvents a patched flaw. Naceri's recent exploits include tools like LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, and MiniPlasma, all targeting Microsoft Defender and other Windows components. Microsoft has warned of potential legal action against malicious activities but has not commented on BigDiskBuster.
Winsage
September 22, 2026
Users of Windows PCs with AMD Radeon GPUs, including models such as RX 6600, RX 7700 XT, RX 7800 XT, RX 7900 GRE, RX 7900 XTX, and RX 9070 XT, may experience persistent issues until October 13th, 2026. These issues include error messages in Device Manager (Code 10), absence of audio output, unresponsive volume controls, inaccessible sound settings, and failures in multi-channel or 3D audio features. Additional problems reported are driver timeouts, black screens, missing displays, and system crashes. Issues with File Explorer and File History have emerged after September's Patch Tuesday updates, affecting the creation and accessibility of backups. Some problems have been resolved through an emergency update, including fixes for Claude Cowork and Remote Desktop Services, and a misleading Defender warning.
Search