Windows

BetaBeacon
May 6, 2026
- ScarCruft, also known as APT37 or Reaper, is a North Korean espionage group targeting government, military organizations, and companies in Asia. - BirdCall is a Windows backdoor attributed to ScarCruft, with spying capabilities such as taking screenshots and logging keystrokes. - The Android version of BirdCall collects contacts, SMS messages, call logs, and media files, and was actively developed over several months. - The BirdCall backdoor was discovered in a trojanized card game on a gaming platform tailored for ethnic Koreans living in Yanbian, China. - The attack was likely aimed at collecting information on individuals from the Yanbian region deemed of interest to the North Korean regime, such as refugees or defectors.
Winsage
May 6, 2026
Beginning in May 2026, Microsoft will introduce Hotpatching as a default feature for compatible systems, allowing security updates to be applied without requiring a restart. Hotpatching updates code directly in the memory of running processes, enabling selective updates without interrupting the entire system. It does not replace monthly security updates but alters their activation process on eligible systems, categorized as security updates within the monthly B releases. Eligible systems must be running Windows 11 version 24H2 or newer and possess suitable licenses such as Enterprise, Education, Microsoft 365, or Windows 365. Management of these updates will be facilitated through Windows Autopatch or Microsoft Intune. Microsoft will continue to utilize baseline updates that require a restart, which will alternate with Hotpatch months. Hotpatching aims to reduce the frequency of restarts tied to security updates, particularly benefiting environments where uptime is critical. However, planned restarts will still be necessary, and robust telemetry and maintenance practices will be needed to ensure smooth operation.
Winsage
May 6, 2026
The April 2026 Steam survey results show that the NVIDIA GeForce RTX 3060 with 8GB of VRAM remains the most common discrete graphics card among users. Approximately 25% of Windows users are utilizing Microsoft's Extended Security Updates (ESU) program as Windows 10 nears its End-of-Life phase. The usage of Linux and macOS has slightly decreased, with Arch Linux identified as the leading distribution for Valve's SteamOS. Despite Microsoft's recommendation for 32GB of RAM, 16GB is still the most prevalent configuration among users.
Winsage
May 6, 2026
Microsoft is transforming its Windows Update system to reduce user frustration and enhance the experience. The company aims to minimize disruption from updates, promoting a more predictable update rhythm and greater user autonomy. Key changes include a unified monthly restart cycle to avoid multiple restarts, simplified management of updates allowing users to start, stop, or pause updates easily, and the ability to restart or shut down devices without immediate installation of updates. New PCs will allow users to pause updates during the initial setup. However, updates can only be paused for a maximum of 35 days to ensure security and system stability. Additionally, users will receive alerts regarding critical updates, including warnings about the retirement of older Secure Boot certificates.
Winsage
May 6, 2026
Microsoft has acknowledged that some Windows 11 updates may require multiple reboots, particularly those related to Secure Boot certificates, which are essential for system security. These updates aim to protect against malware, especially rootkits, and ensure the effective functioning of Secure Boot. Some users have faced difficulties in receiving the new certificates due to firmware issues, but multiple reboots typically indicate that necessary security enhancements are being applied.
Winsage
May 5, 2026
Upon installing the April 2026 Patch Tuesday update, some users experienced two or three reboots, which Microsoft confirmed is intentional due to the installation of Secure Boot 2023 certificates. This behavior is expected for a limited number of devices and is part of the Secure Boot update process. The Secure Boot certificates are replacing older ones issued in 2011, set to expire in June 2026. Users can check their Secure Boot status in the Windows Security app, which indicates the status with green, yellow, or red badges. A green badge means the system is up to date, while yellow and red badges indicate issues with certificate updates. Microsoft is managing Secure Boot certificates on modern PCs, but older machines without OEM support may struggle to receive updates due to firmware limitations.
Search