Security update Archives

Winsage

September 1, 2026

“More interruptions than necessary,” Microsoft on Windows 11’s forced reboots for updates, rolls out a fix

Microsoft is changing the Windows 11 update process to consolidate various updates into a single monthly restart, starting with updates released on or after July 28, 2026. This new system combines driver updates, .NET updates, and firmware updates with the monthly security update, allowing for one restart per month instead of multiple. Updates requiring a restart will wait until the scheduled monthly security update, which is typically released on the second Tuesday of each month. Users can find combined updates under Settings > Windows Update > Available updates and can choose to restart sooner if desired. Additionally, users can pause updates for up to 35 days through Settings > Windows Update.

Winsage

August 27, 2026

The Windows 10 deadline most ISVs haven’t planned for yet

Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB will reach their end of support on October 13, 2026, after which they will no longer receive security updates. These operating systems are designed for fixed-function devices like kiosks and point-of-sale terminals, which are often not actively managed, posing risks if the end-of-support date is overlooked. Microsoft offers an Extended Security Updates (ESU) program as a temporary solution, with escalating costs over three years, but it is not intended as a long-term fix. Customers must decide whether to continue paying for ESU, upgrade to newer hardware, or transition away from Windows.

Winsage

August 25, 2026

Windows 11 KB5121003: Game crashes caused by inpoutx64

Microsoft has acknowledged issues with the August security update KB5121003 for Windows 11, affecting versions 24H2 and 25H2. Users reported problems such as game freezing, unexpected closures, and system restarts after installing the update. The issues are linked to drivers and software for specific RGB-enabled peripherals or components, particularly involving the inpoutx64.sys driver. Games mentioned include ARC Raiders, MARVEL Tōkon: Fighting Souls, and THE FINALS. Embark Studios has released a support guide suggesting users stop and remove the inpoutx64.sys service as a temporary workaround. Microsoft is investigating the issue but has not provided a definitive fix or patch timeline.

Winsage

August 21, 2026

That April Windows update you skipped? Hackers are exploiting it now

Timely updates are crucial for home users to protect personal data and device integrity. Organizations should assess systems for vulnerabilities, especially those accessible via the internet. CVE-2026-33824 is a critical vulnerability in the Internet Key Exchange (IKE) service extensions within Windows, caused by a “double-free” error, allowing code execution. It affects various versions of Windows 10, Windows 11, and Windows Server, and is included in the CISA KEV catalog. Users are urged to install the April Windows updates immediately. CVE-2026-55040 is a critical vulnerability in Microsoft SharePoint that allows unauthenticated attackers to bypass a key security feature, with a CVSS score of 9.1. It affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Subscription Edition, with fixed builds already available.

Winsage

August 20, 2026

ShieldBreak: The Windows Defender Zero-Day With No Patch — Detect It, Mitigate It, With Qualys

ShieldBreak, identified as CVE-2026-69414, is a zero-day vulnerability in the Microsoft Malware Protection Engine that allows low-privileged local attackers to escalate privileges to SYSTEM. The public proof of concept was released on August 12, 2026, and Microsoft recognized the CVE on August 14, 2026. No patch is currently available. ShieldBreak exploits an elevation-of-privilege vulnerability by manipulating file processing during the cloud-file hydration process in Microsoft Defender, allowing attackers to control processes with elevated privileges. The exploit is functional on Windows 11 25H2 and Windows Server 2025. Qualys VMDR can detect this vulnerability using a specific query, and organizations can use Qualys TruRisk™ Eliminate for mitigation until a patch is released.

Winsage

August 14, 2026

August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw

Users can connect to SMB shares with features like RDMA, leases, and Continuous Availability, allowing efficient data transfer and session management. Hyper-V users can create, checkpoint, and export Generation 2 virtual machines, enable virtual TPM and BitLocker, and connect USB storage and MIDI devices. MSI package management has improved, allowing easy installation, repair, and uninstallation with UAC prompts. TAPI has 11 entries focused on parity fixes, with enhancements in TCP/IP, HTTP.sys, Windows Firewall, Bluetooth, wired 802.1X, and message queuing. Users can verify TAPI line status, HTTP.sys functionality across protocols, and confirm TCP/IP IPsec tunnels. Office updates include client updates for MSI Office 2016 and SharePoint Server updates for 2016, 2019, and Subscription Edition, requiring attention to browser-based editing functionality. On-premises Exchange Server receives a security update addressing seven CVEs, including one critical elevation of privilege vulnerability and six important issues.

Winsage

August 13, 2026

Windows 10’s latest patch keeps your Secure Boot certificates on track

A recent update has been released, addressing security vulnerabilities and improving system functionality. Key improvements include a fix for the Backup feature, resolving an "invalid credentials" error that caused automatic backups to fail when using Server Message Block (SMB). The update also enhances the Secure Boot feature by introducing high-confidence device targeting data, allowing more devices to receive new Secure Boot certificates. This update addresses outdated Secure Boot certificates for Windows 11 and Windows 10 users. The update, identified as KB5120249, is under 1 GB and is available only to PCs enrolled in the Extended Security Updates (ESU) program, which ensures Windows 10 PCs receive security updates until at least October 2027. Non-enrolled PCs lost security update support in October 2025.

Winsage

August 12, 2026

Windows 11 Gets Dynamic File Sizes in File Explorer, Low Latency Profile for Apps, and More

Microsoft's August update, KB5121003, includes several enhancements: - The File Explorer now displays file sizes in kilobytes (KB), megabytes (MB), or gigabytes (GB) dynamically, simplifying file management. - The Low Latency Profile is expanded to more applications, improving launch speeds for Microsoft apps like Edge and Outlook by up to 40%, and other system components by up to 70%. - Windows Search has been improved to better handle typos and incomplete queries, prioritizing relevant results and indexing files across the operating system. - The Start Menu now more effectively respects user preferences, ensuring consistent settings.

Winsage

August 12, 2026

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Chaotic Eclipse, a security researcher, has revealed a proof-of-concept (PoC) for a new vulnerability called ShieldBreak, which is a zero-day flaw in Microsoft Defender that bypasses the patch for the previously identified CVE-2026-50656 (RoguePlanet). This vulnerability could allow attackers to execute code at the SYSTEM level on affected Windows systems. Chaotic Eclipse tested the PoC on the latest versions of Windows 11 and Windows Server 2025, achieving a 100% success rate. Windows 10 and its server editions are not supported by the PoC but remain vulnerable. Microsoft had issued security updates for RoguePlanet, which has a CVSS score of 7.8, affecting the Malware Protection Engine and representing a local privilege escalation issue. Chaotic Eclipse has previously disclosed two other zero-day vulnerabilities, YellowKey and GreenPlasma, which affect BitLocker and the Windows Collaborative Translation Framework, respectively. Microsoft criticized the public disclosure of these vulnerabilities as irresponsible and emphasized the importance of Coordinated Vulnerability Disclosure.

Winsage

August 12, 2026

Microsoft Windows 0-Day Attack Deploys Lazarus Rootkit—Patch Now

Microsoft released a patch for a zero-day vulnerability, CVE-2026-68820, which is being exploited by cybercriminals, specifically the North Korean hacking group Lazarus. This vulnerability allows unauthorized attackers to elevate their privileges locally, posing a significant risk to affected systems. The August 2026 Patch Tuesday update addressed 421 vulnerabilities, including three zero-days, with CVE-2026-68820 being the only one confirmed to be actively exploited. The vulnerability's impacts on confidentiality, integrity, and availability are rated as High. Users of Microsoft Windows 10, Windows 11, and various versions of Windows Server should prioritize deploying the patch for this vulnerability.