security risks Archives

Winsage

June 20, 2025

Microsoft Ends FrontPage RPC in Secure 365 Update

Microsoft plans to block outdated protocols, including FrontPage Remote Procedure Call, as part of its "Secure by Default" initiative to enhance cybersecurity within its Microsoft 365 ecosystem. This decision aims to phase out legacy technologies that pose security risks, reflecting a broader industry trend toward prioritizing robust cybersecurity over maintaining older systems. The impact will be significant in enterprise environments, where legacy systems are often critical, requiring IT teams to identify dependencies on these protocols. While Microsoft provides guidance for migration, the responsibility lies with customers, which may strain relationships with long-time clients.

Winsage

June 20, 2025

Old apps and third-party providers blocked: Major Microsoft 365 security impact

Microsoft is implementing default blocks on legacy protocols and third-party applications for Microsoft 365 to enhance security. This includes deactivating the RPS protocol for SharePoint and OneDrive, as well as blocking the FPRPC protocol. Administrators will now need to give explicit approval for third-party applications to access files and pages, limiting user consent. These changes will begin in mid-July 2025 and are expected to be completed by August. Additionally, new security settings for Windows 365 will disable clipboard, storage, USB device, and printer linking by default on newly set up cloud PCs, with VBS, Credential Guard, and HVCI activated by default for those using a Windows 11 Gallery image. These updates for Windows 365 are planned for the latter half of 2025.

Winsage

June 20, 2025

Microsoft boosts default security of Windows 365 Cloud PCs

Microsoft is enhancing its Windows 365 Cloud PCs with new security features starting in May 2025. All newly provisioned and reprovisioned Cloud PCs using a Windows 11 gallery image will have Virtualization-Based Security (VBS), Credential Guard, and Hypervisor-Protected Code Integrity (HVCI) enabled by default. VBS creates a secure environment to protect system processes, Credential Guard secures authentication credentials, and HVCI ensures only verified code runs at the kernel level. Additionally, beginning in the latter half of 2025, clipboard, drive, USB, and printer redirections will be disabled by default on newly provisioned and reprovisioned Cloud PCs to mitigate security risks, although IT administrators can re-enable these features if needed.

Winsage

June 20, 2025

Microsoft to remove legacy drivers from Windows Update for security boost

Microsoft is removing legacy drivers from the Windows Update catalog to enhance security and compatibility within its Windows ecosystem. The initiative aims to provide users with the most optimal drivers for various hardware devices. The cleanup process will begin with expiring drivers that have newer replacements, making them unavailable for any Windows system. Partners can republish removed drivers if they present a valid business rationale. Microsoft plans to expand the cleanup to include additional categories that may pose security risks. The company is also implementing changes to pre-production driver signing and has introduced new security defaults for Windows 365 Cloud PCs and updated security protocols for Microsoft 365 tenants.

Winsage

June 17, 2025

Windows 10 End Nears: Switch to Linux for Security

Microsoft will cease support for Windows 10 on October 14, 2025, leaving an estimated 200 to 400 million devices vulnerable to security risks due to a lack of updates. Users must choose between upgrading to Windows 11, which has strict hardware requirements, paying for extended security updates, or switching to alternative operating systems like Linux. The Document Foundation advocates for Linux and LibreOffice as viable options, emphasizing their ability to run on older hardware and provide robust security updates without vendor lock-in. Privacy concerns regarding data collection by major tech companies are highlighted, with Linux offering users greater control and transparency. The transition away from Windows 10 is seen as an opportunity to promote user empowerment and sustainability in technology choices.

Winsage

June 17, 2025

Millions Of Windows Users Get Microsoft’s Free Upgrade Offer

As of June 17, Windows 10's global market share has fallen below 50% for the first time, now at 48.9%, while Windows 11 is at 47.7%. This suggests that nearly 60 million users have switched from Windows 10 to Windows 11. In the United States, Windows 11 holds 55.2% of the market compared to Windows 10's 42.0%. In Asia, Windows 10's share has decreased from 59% to 49%, while Windows 11 has increased to over 46%. Approximately 700 million users remain on Windows 10, with over 240 million devices not meeting the upgrade requirements. Microsoft is encouraging users to upgrade and will introduce a migration tool to facilitate the transition. The upgrade from Windows 10 to Windows 11 is free for compatible PCs, but unsupported systems may face security risks post-October 14.

Winsage

June 10, 2025

Microsoft Patch Tuesday addresses 66 vulnerabilities, including an actively exploited zero-day

Microsoft addressed 66 vulnerabilities in a recent Patch Tuesday update, including a critical zero-day exploit, CVE-2025-33053, which has been exploited by the espionage group Stealth Falcon against a defense contractor in Turkey. Stealth Falcon has targeted high-profile government and defense entities in the Middle East and Africa since 2012. CISA has added CVE-2025-33053 to its catalog of known exploited vulnerabilities. The group employs innovative infection methods, including WebDAV and multi-stage loaders. Many organizations may be at risk due to inadequate security measures for WebDAV, with estimates suggesting up to 80% of organizations could be vulnerable. The update also includes another critical vulnerability, CVE-2025-47966, allowing unauthorized access to sensitive information in Power Automate, as well as 17 vulnerabilities affecting Microsoft Office products, with three likely to be exploited.

Winsage

June 6, 2025

Microsoft applies the thumbscrews to Windows 10 users, telling them to upgrade to be on “the right side of risk”

Microsoft is urging Windows 10 users to upgrade to Windows 11 before support ends on October 14, 2025, citing security risks. Many users are reluctant to upgrade due to affordability and compatibility issues with their current hardware. The Linux community is responding by offering alternatives for users considering a switch away from Windows, with initiatives like the End of 10 project and support from KDE for maintaining older PCs.

Winsage

June 4, 2025

Microsoft accused of ‘tech extortion’ over Windows 10 support ending in campaign to get people to upgrade to Linux

KDE has launched a campaign called ‘KDE for Windows 10 Exiles’ to encourage Windows 10 users to switch to Linux as support for Windows 10 is set to end on October 14. The campaign warns that without updates, users will face increased security risks and be pressured to buy new hardware for Windows 11, which has stringent requirements that may render older PCs incompatible. The initiative also highlights environmental concerns related to electronic waste from discarded functioning machines. While Linux can extend the life of older hardware, transitioning to it may be challenging for less tech-savvy users. Some KDE contributors are involved in the existing ‘End of 10’ initiative, indicating a shared goal to attract users dissatisfied with Microsoft’s practices.

Winsage

May 30, 2025

Microsoft Brings Post-Quantum Security To Windows 11 And Linux

Microsoft is incorporating post-quantum cryptography (PQC) into Windows 11 and Linux platforms to enhance its security framework against potential threats from quantum computing. PQC functionalities are now available to Windows Insiders via the Canary Channel Build 27852 and on Linux through SymCrypt-OpenSSL version 1.9.0, allowing customers to test quantum-resistant encryption. Microsoft is enhancing its core cryptographic library, SymCrypt, with new PQC algorithms designed to withstand future quantum decryption capabilities. The company emphasizes the importance of "crypto agility," enabling systems to adapt to new algorithms as they develop. This initiative is part of Microsoft's ongoing commitment to global quantum-safe initiatives and aims to foster innovation and preparedness within the cybersecurity community.