server Archives

Winsage

September 9, 2026

Microsoft’s Two-Track Patch Tuesday: Cloud Identity Flaws Fixed Before Disclosure, Windows Still Catching Up

The September 2026 security cycle revealed a bifurcated approach to vulnerability management by Microsoft, focusing on cloud-side identity services with silent mitigations and traditional Patch Tuesday updates for on-premises Windows infrastructure. On September 3, Microsoft addressed nine cloud-side vulnerabilities, including two with a CVSS score of 10.0: CVE-2026-83711 (Azure AD B2C elevation of privilege) and CVE-2026-70352 (Azure AI Language Authoring missing authentication). Additionally, CVE-2026-83941 (Entra ID elevation of privilege, rated 9.9) and CVE-2026-80098 (Copilot Studio cryptographic flaw) were noted. On September 8, the Patch Tuesday update addressed 70 CVEs, including critical issues in the on-premises stack, such as CVE-2026-83939 (Windows Secure Kernel Mode elevation of privilege). CVE-2026-69414 (ShieldBreak), an elevation of privilege vulnerability in the Defender Malware Protection Engine, was patched out-of-band on September 3 after being publicly exposed for three weeks. Microsoft is shifting its Self-Service Password Reset (SSPR) enforcement to default to passkeys as of September 7, with plans to phase out SMS and voice-based authentication by February 2027. This aims to enhance security by moving away from legacy credentials.

Winsage

September 9, 2026

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft's September 2026 security update revealed 973 vulnerabilities, with 113 classified as critical. Two actively exploited vulnerabilities are CVE-2026-81963 (Windows Update Stack, elevation of privilege, CVSS 7.8) and CVE-2026-85880 (Windows ALPC, elevation of privilege, CVSS 7.8). Among the 113 critical vulnerabilities, 82 are remote code execution (RCE) vulnerabilities. Notable vulnerabilities include: - CVE-2026-69676: RCE in Windows Kerberos, CVSS 8.8, authentication bypass. - CVE-2026-69852: RCE in Windows RRAS, CVSS 7.5, heap-based buffer overflow. - CVE-2026-72957: RCE in Windows Deployment Services, CVSS 7.8. - CVE-2026-69854: Elevation of privilege in Spring Cloud Azure, CVSS 9.0, improper authentication. - CVE-2026-83501: Information disclosure in Windows VBS, CVSS 5.5. - CVE-2026-69730: RCE in Windows DNS Server, CVSS 9.8. Less likely to be exploited vulnerabilities include: - CVE-2026-69845: RCE in Windows DHCP Server, CVSS 9.8, heap-based buffer overflow. - CVE-2026-65772: Vulnerability in Microsoft Dynamics 365 On-Premises, CVSS 8.8, deserialization of untrusted data. - CVE-2026-66302: RCE in Skype for Business, CVSS 9.8. Additional critical vulnerabilities include: - CVE-2026-62916: Elevation of privilege in Microsoft Entra ID, CVSS 9.1. - CVE-2026-83941: Elevation of privilege in Entra ID, CVSS 9.9. - CVE-2026-80098: Vulnerability in Copilot Studio, CVSS 9.3, improper verification of cryptographic signatures. Talos is releasing a new Snort ruleset to detect attempts to exploit these vulnerabilities, with specific SIDs for Snort 2 and Snort 3 rule coverage.

Winsage

September 8, 2026

Microsoft releases Windows security update addressing 723 flaws

Microsoft released its September 2026 security updates, addressing two critical Windows elevation-of-privilege vulnerabilities: CVE-2026-85880 and CVE-2026-81963. Both vulnerabilities were exploited before their public disclosure on September 8. CVE-2026-85880 involves a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC), allowing low-privileged attackers to gain SYSTEM privileges. CVE-2026-81963 affects the Windows Update Stack due to improper link resolution and access controls, enabling similar privilege escalation. The September release also includes 974 Common Vulnerabilities and Exposures (CVEs) across various Microsoft products, with 723 affecting Windows. Users of Windows 11 24H2 and 25H2 receive updates via KB5124008, while Windows 11 26H1 receives KB5124012. Windows 11 24H2 Home or Pro editions will reach end of servicing on October 13, 2026. Users are advised to install the updates promptly and back up important data.

AppWizard

September 8, 2026

Are Free VPNs for Android Actually Worth Using

A free VPN for Android can improve internet privacy, especially on untrusted networks, but it has limitations, such as not guaranteeing complete anonymity or security. The VPN creates an encrypted tunnel between the device and the server, protecting traffic from local monitoring but not ensuring overall security if poorly implemented. Changing your IP address does not guarantee anonymity, as account logins and tracking technologies can still identify users. Free VPNs may be suitable for low-risk tasks, like occasional browsing on public Wi-Fi, but they do not protect against malware or phishing. Providers often rely on alternative revenue sources, such as advertising or data sharing, which necessitates careful examination of their privacy policies. Free VPNs may have limitations like data caps, slower speeds, and fewer server options compared to paid services. Users should evaluate the provider’s background, privacy policy, permissions, and performance before installation. A paid VPN generally offers better reliability, support, and transparency, making it a safer choice for sensitive activities.

Tech Optimizer

September 8, 2026

Microsoft Confirms False “Defender Antivirus Turned Off” Alerts Spreading Across Windows Devices

Microsoft has acknowledged a software bug causing persistent Windows Security pop-ups that incorrectly indicate antivirus protection is disabled. These notifications began appearing after the latest Microsoft Defender Antivirus updates, but the antivirus is functioning correctly. The issue affects various versions of Windows and Windows Server with the latest Defender updates. Microsoft has committed to resolving the issue in a future update, though no timeline has been provided. Users are advised to verify the status of their antivirus through the Windows Security app and disregard the notifications until a fix is released.

Winsage

September 8, 2026

Msckey Cuts 25% Off Windows 11 & Office 2024 for Back to Work/School

Msckey has launched a Back to Work/School sale from August 27 to September 15, offering a 25% discount on all Microsoft software licenses with the code BTS25. The sale includes various products such as Windows operating systems, Office 2024 suite, and professional tools like Microsoft Project and SQL Server. Current prices during the sale include Windows 11 Education for .99, Windows 11 Home for .74, and Office 2024 Professional Plus for .99. Msckey ensures that all licenses are genuine, clearly labeled, and delivered via email within minutes. Customers can pay using multiple options and receive personalized support.

Tech Optimizer

September 7, 2026

Top 10 Best Endpoint Detection & Response (EDR) Solutions in 2026

Endpoint detection and response (EDR) continuously records process, file, registry, and network activity on endpoints, applying behavioral analytics to identify attacker techniques while providing tools for investigation and containment. Several EDR platforms have emerged, each catering to different organizational needs: 1. CrowdStrike: Best overall for its rich telemetry and elite threat intelligence. 2. SentinelOne: Best for autonomous response, featuring strong containment and rollback capabilities. 3. Microsoft Defender for Endpoint: Best value for organizations already using Microsoft 365 E5. 4. Palo Alto Cortex XDR: Best for native data fusion across endpoint, network, and cloud telemetry. 5. Sophos: Best for generalist IT teams due to its user-friendly interface. 6. Trend Micro: Best for server and workload coverage, focusing on cloud and hybrid environments. 7. Bitdefender: Best mid-market value with strong detection capabilities at an accessible price. 8. Trellix: Best for organizations already using Trellix products, offering integrated solutions. 9. Huntress Managed EDR: Best for managed endpoint security, ideal for teams lacking full staffing. 10. Cisco Secure Endpoint: Best for Cisco environments, integrating well with Cisco security solutions. Key differentiators among these platforms include the analyst burden, alert management efficiency, and the impact of retention policies on investigation quality. The evaluation of EDR solutions should consider detection depth, response capabilities, operational costs, and the specific needs of the organization.

Tech Optimizer

September 7, 2026

Intego ONE now protects your iPhone too – and there’s 50% off in September

Intego ONE Complete has launched the Intego ONE: VPN & Wi-Fi Security app for iPhone, available at no extra charge to Complete subscribers. The app provides VPN protection, Wi-Fi security assessments, and checks on built-in iPhone security settings but does not function as antivirus software. It enhances existing Apple security measures by addressing vulnerabilities related to insecure Wi-Fi connections and unprotected internet access. The app is accessible to both new and existing subscribers, and Intego is currently offering a 50% discount on subscriptions until September 30, 2026. Intego ONE is available in three tiers: Essential, Advanced, and Complete, with the Complete tier including the new iPhone app. The app features a VPN that encrypts internet connections on public Wi-Fi, Wi-Fi security checks, and assessments of iPhone security settings. While traditional viruses are rare on iPhones, threats like spyware and exploits still exist. The app does not replace Apple's malware protection but complements it. Intego ONE Complete is recommended for Mac and iPhone owners, particularly those who travel frequently or connect to public Wi-Fi. The pricing includes various deals, with a 50% discount currently available and a subsequent 35% discount after the promotional period.

AppWizard

September 7, 2026

Xbox Cloud Gaming Caps Hours: 15 for Ultimate [2026]

On September 3, 2026, Microsoft announced that Xbox Game Pass subscribers will see a shift in cloud gaming access. Starting November 2026, unlimited cloud streaming will be replaced by a tiered hour bank system: 15 hours for Ultimate, 10 for Premium, and 5 for Essential subscribers. Once a subscriber exhausts their allotted hours, they must wait for the next billing cycle or purchase additional time. This change is the most significant since the beta launch of Xbox Cloud Gaming in 2019. The announcement was made on Xbox Wire, and the new structure is reflected on Xbox’s product pages. The new tiered system introduces a scarcity model, with every paid tier now having its own cloud gaming quota. Essential subscribers, who previously had no cloud access, will now receive 5 hours per month. The pricing for the Game Pass tiers is as follows: Ultimate at .99 for 15 hours, Premium at .99 for 10 hours, and Essential at .99 for 5 hours. The free ad-supported tier remains unchanged at 5 hours per month. Microsoft's rationale for the change is based on usage data indicating that most subscribers do not heavily utilize cloud streaming, coupled with the rising costs of operating cloud gaming services. The company has stated that additional hours can be purchased once a subscriber's monthly allotment is used up, although pricing details for these add-ons have not yet been disclosed. The new hour caps will take effect in November 2026, following a shorter notice period compared to NVIDIA's GeForce NOW service, which implemented a 100-hour monthly cap earlier in 2026. The response from gaming communities has been largely negative, with concerns about the limits falling short of typical usage patterns and conflicting with the marketing of Game Pass as offering unlimited access. The introduction of hour caps could impact Game Pass's subscriber base, particularly among those who rely on cloud gaming as their primary access point. Microsoft's internal usage data will determine the extent of this impact, as the company aims to control costs without raising subscription prices.

Winsage

September 6, 2026

Microsoft Now Lets AI Build Native WinUI 3 Apps for Windows 11 in Under 30 Minutes

Microsoft has released a quick-start guide for developers to create native WinUI 3 applications for Windows 11 in about 30 minutes, using tools like VS Code, .NET 10, GitHub Copilot's free tier, and Microsoft's winapp CLI, without requiring Visual Studio. The guide details project scaffolding, AI integration for features, testing, and packaging as an MSIX installer. The AI agent, winui-dev, is a specialized plugin for WinUI tasks, and developers are encouraged to connect it to the Learn MCP server for updated documentation. This initiative aims to move developers away from web wrappers and Electron-style applications, which use more RAM. Microsoft announced at the Build 2026 conference that "3" will be removed from WinUI's name, reinforcing its long-term stability. WinUI 3 is being integrated into Windows 11 components, although some apps still use WebView2 technology, which consumes more RAM than native options.