NewApp Digest
search bot

update management

Microsoft Refreshes Secure Boot Root of Trust Certificates
Winsage
February 13, 2026

Microsoft Refreshes Secure Boot Root of Trust Certificates

Microsoft is refreshing Secure Boot certificates across its Windows ecosystem ahead of their expiration in June 2026 to enhance firmware-level security. Most systems will automatically receive the new certificates via Windows Update, while older or specialized devices may require firmware updates from the original equipment manufacturer (OEM). Devices that do not receive the update will still boot but will gradually lose access to critical boot-level mitigations and future compatibility improvements. The deployment of the new certificates has started with regular monthly Windows updates and applies to home users, businesses, and educational institutions. Organizations can manage updates independently using tools like Group Policy. Many devices produced since 2024 and nearly all systems shipped in 2025 already have the updated certificates. If systems are not updated, they will continue to function but will enter a degraded security state, unable to adopt new Secure Boot mitigations. This could increase exposure to threats and lead to compatibility issues with newer operating systems and software. IT administrators should ensure that Windows Update is deploying the latest updates and that device firmware is current, especially for older hardware or specialized systems.
Evicting Copilot: The Insider’s Guide to Purging AI from Windows 11
Winsage
November 20, 2025

Evicting Copilot: The Insider’s Guide to Purging AI from Windows 11

Microsoft's Windows 11 has introduced Copilot, an AI assistant aimed at enhancing productivity, but it has faced criticism from users concerned about privacy and resource usage. Copilot offers features like document summarization and image generation, but some users have labeled it an unwelcome presence. During the March 2025 Patch Tuesday, some users experienced Copilot being inadvertently uninstalled. Privacy concerns and performance issues have led many to seek ways to disable or remove Copilot, with methods including hiding the Copilot button, using Group Policy Editor, editing the Windows Registry, and uninstalling the app through Settings or PowerShell commands. In corporate environments, IT administrators can disable Copilot using Intune or Group Policy. Users have reported that Windows updates can reinstall Copilot, prompting them to disable automatic updates or block related domains. Recent user sentiment indicates growing fatigue with AI features, and there is potential for Microsoft to introduce easier opt-out options in future updates.
Windows 11 update names got simpler, drops YYYY-MM. Now, IT admins are going mad
Winsage
November 2, 2025

Windows 11 update names got simpler, drops YYYY-MM. Now, IT admins are going mad

Microsoft has introduced a new naming convention for Windows Update titles, moving away from the YYYY-MM format and the term cumulative. The October 2025 optional update is now labeled as “Security Update (KB5034123) (26100.4747)” instead of the previous detailed titles that included the release date and specific Windows version. This change has raised concerns among IT professionals and users, as it complicates the identification of updates and may lead to confusion between different types of updates. IT administrators have expressed frustration over the lack of critical information in the new titles, which they believe hinders troubleshooting and update management. Microsoft has acknowledged the feedback but remains committed to the new naming scheme, while updates accessed through the Microsoft Update Catalog or WSUS will retain their original naming structure.
Windows Server WSUS bug exploits underway, Microsoft's mum
Winsage
October 25, 2025

Windows Server WSUS bug exploits underway, Microsoft’s mum

A critical vulnerability in Microsoft Windows Server Update Services (WSUS), identified as CVE-2025-59287, has a CVSS score of 9.8 out of 10 and affects Windows Server versions from 2012 to 2025. The vulnerability arises from the insecure deserialization of untrusted data, allowing unauthenticated attackers to execute arbitrary code on compromised systems. Servers without the WSUS role enabled are unaffected. Microsoft issued a patch on October 14, which did not fully resolve the issue, leading to an emergency update. Security researcher Kevin Beaumont reported that he could manipulate the second patch, raising concerns about the delivery of malicious updates. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-59287 to its Known Exploited Vulnerabilities catalog, while the Dutch National Cybersecurity Center issued alerts about ongoing exploitation activities. Private security firms, including Huntress and watchTowr, reported targeted attacks on WSUS instances, with fewer than 25 susceptible hosts identified. WatchTowr's CEO warned that any unpatched WSUS instance online is likely compromised, urging organizations to reassess their security posture.
Microsoft Releases Emergency Patch For Windows Server Update Service RCE Vulnerability
Winsage
October 24, 2025

Microsoft Releases Emergency Patch For Windows Server Update Service RCE Vulnerability

Microsoft released an emergency patch on October 23, 2025, to address a critical remote code execution vulnerability (CVE-2025-59287) in Windows Server Update Services (WSUS). The vulnerability, rated critical with a CVSS score of 9.8, allows unauthorized attackers to execute arbitrary code over the network through unsafe deserialization of untrusted data. Although WSUS is not enabled by default, organizations using it are at risk if unpatched. The CVE's temporal score was updated to 8.8 after proof-of-concept exploit code was confirmed. The patch is available through various Microsoft update channels but requires a server reboot. Temporary workarounds include disabling the WSUS server role or blocking specific inbound traffic. Affected versions include Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 (23H2 Edition), and 2025, each with corresponding patch KB numbers.
Microsoft quietly removes ability to permanently stop apps from automatically updating on Windows 11 — just like system updates
Winsage
October 21, 2025

Microsoft quietly removes ability to permanently stop apps from automatically updating on Windows 11 — just like system updates

Microsoft has changed the functionality of the Microsoft Store, affecting app update management on Windows 10 and Windows 11. Users can no longer completely disable automatic updates; instead, they can pause updates for one to five weeks. The Microsoft Store now indicates, "You may pause automatic updates for a period of time." This change has not been officially documented in a changelog. While some users appreciate the extensive app catalog and centralized update management, the inability to fully disable updates can be frustrating for those who prefer specific app versions. However, this change may enhance security by ensuring users have the latest versions of applications.
Windows 11 updates break localhost (127.0.0.1) HTTP/2 connections
Winsage
October 17, 2025

Windows 11 updates break localhost (127.0.0.1) HTTP/2 connections

Microsoft's recent updates for Windows 11, specifically the October update (KB5066835) and September's preview update (KB5065789), have disrupted the functionality of the "localhost" feature, affecting developers and applications reliant on local connections. Users are experiencing connectivity issues, with errors such as "ERRCONNECTIONRESET" and "ERRHTTP2PROTOCOL_ERROR" when attempting to connect to localhost (127.0.0.1). This has impacted applications like Visual Studio, SSMS Entra ID authentication, and the Duo Desktop app, which relies on local web server connections. Potential workarounds include modifying Registry entries to disable the HTTP/2 protocol and installing the latest Microsoft Defender intelligence update, though effectiveness varies. The most reliable solution appears to be uninstalling the problematic updates using the commands: wusa /uninstall /kb:5066835 wusa /uninstall /kb:5065789 After uninstalling these updates and restarting, users report that the loopback interface is restored, allowing HTTP/2 connections to function correctly again.
Search