Microsoft has issued an out-of-band update for its recent Windows 11 patch, which has caused a number of bugs and issues. The September 2026 update was just released last Tuesday, and although it packs a number of new features and fixes nearly 1000 security flaws (commonplace in this day and age), there are also a few unfortunate regressions.
The 25H2 update finally reintroduces a movable taskbar, just like we've had since Windows 95, with an option to make the height smaller for compact displays. Likewise, the Start menu now has multiple configurable layouts, and you can toggle each main section on or off. Microsoft also revamped Windows Search — perhaps to finally be useful — and users can now choose to only have it display local results. Explorer got a handy tweak in the form of using KB, MB, GB size indicators, as well.
The update has also surfaced some serious bugs. First off, PCs with AMD Radeon GPUs are crashing, apparently due to the update provoking driver instability. Reinstalling the driver doesn't appear to help, and the reports unfortunately cover most contemporary AMD graphics cards. Microsoft did not mention AMD GPUs specifically in its latest update.
Microsoft noted that it has fixed an issue with Remote Desktop Services where RDS might become unstable, causing connection and sign-in failures.
Microsoft is also aware of an issue with audio output and microphone input going dead. Additionally, there are seemingly reports of audio devices starting up with a botched configuration, like tweaked 3D audio settings or speaker setups. The apparent workaround seems to be putting audio in a standard 2.0 configuration, but Microsoft has now addressed this issue in the emergency patch.
Explorer may display a black screen after logging in, leaving you with a perfectly functioning operating system but no visible UI. The File History backup feature is reportedly not detecting external drives, effectively making it useless. Of particular concern to enterprises, systems administrators, and homelabs, the Remote Desktop Service is also experiencing issues. Last but not least, Microsoft says it has addressed an issue where Claude Cowork is nonfunctional due to the update breaking HC-managed Linux VMs with Plan9 shared folders
Owners of HP and Lenovo systems are also advised to consider holding off on this update. Ever since the August 2026 patch (and now, cumulatively, with the September update), there are reportedly serious issues on both camps. On the HP side, there are instances of the update triggering BIOS corruption, leading to a failed install with no ability to recover the OS — though seemingly the OEM has published a new BIOS revision, so it's hard to say which side is to blame. Meanwhile, Lenovo users might have their machines black-screen or shut down out of the blue, seemingly due to power mismanagement.
While it's heartening to see that Microsoft has significantly increased its Windows development speed and is seemingly listening to customer feedback, a string of bugs after a major feature update are still common.
The colorful CEO of Automattic, which controls WordPress, was forced out last Thursday by his board of directors, which put him on a leave of absence. He used his system access to remove the accounts of the acting CEO and others — an action that could get most employees fired. Instead, he was fully reinstated to CEO a couple of days later.
It’s not hard to compare this to the saga at OpenAI almost three years ago when an eerily similar series of events happened. The board fired the CEO for having repeatedly lied to it. Within a few days, the board reversed itself.
A weaker historical comparison is with Steve Jobs, who was ousted from his Apple CEO role, only to later return. But Jobs at least had the decency to wait a few years while he created and ran NeXT.
To be fair, boards have often been criticized for being puppets of the CEO, who often have a lot to say about who serves on the board. But that criticism doesn’t hold for the first OpenAI board nor for the initial Automattic board.
Some years ago, I was involved with a VC-funded startup, and we were at the stage of forming a board of directors. I was talking with the person who was to be the board chair and he needed candidates for board secretary, which is typically an attorney. That role is supposed to be a lawyer who cares about the board, as opposed to the company’s general counsel, who reports into the CEO and only cares about the company.
The chair said that we need someone who is trustworthy. I had the perfect candidate in mind, until I probed deeper and found that there is a vast chasm between “trustworthy” and “someone we can trust.”
I envisioned someone who was honest and had integrity, someone who would take their duties seriously and would tell the board the truth regardless of the implications. That turned out to be precisely what the chair did not want.
He wanted someone who would vote with us regardless of their legal opinion. He didn’t actually want trustworthy. He wanted blind unconditional loyalty. (That business, thank goodness, never ended up launching.)
But that seems to be what CEOs now want, which undermines the entire point of having an independent board. Other than deciding whether to accept an acquisition offer, the most important decision of any tech board is the hiring — and firing — of the CEO.
What does it say when a board makes that decision for what it seems to be a legitimate business reason — and then reverses itself within a couple of days?
In the case of Automattic, it is not a good look. The board said absolutely nothing about why it forced the CEO out, which made its reversal over the weekend even more perplexing.
When Automattic emailed reporters on Thursday to announce that the CEO had been ousted, the messages were cryptic: “Matt Mullenweg is currently on leave from Automattic. Mark Davies, Automattic’s CFO, will lead the company as interim CEO. The Board has full confidence in Mark’s leadership and in the team’s ability to execute against the company’s priorities.”
The next we heard was an equally cryptic message sent Saturday afternoon: “Matt Mullenweg is the chairman and CEO of Automattic, with full support of the board, and if you search online you can see many top executives and Automatticians supporting him as well.”
Huh? We then asked for clarification of what happened and why. At 2:26 AM Eastern on Sunday, the media team emailed: “Matt and Automattic’s leadership team have great respect for everyone involved. While we can’t comment on specific individuals, we’re thankful for their contributions to Automattic and its mission, and we remain excited about what’s ahead with Matt at the helm. Matt was away for only 33 hours and 20 minutes — we’re now back to work.”
My proposal: A board’s decision to hire or terminate a CEO should be defended with public specifics. And so should a hiring decision. Or, in this case, a reversal of a mandatory leave of absence decision.
If the board is going to take the extreme step of relieving the CEO, it should be required to say why. In some situations, it may need to be vague (as in “personnel situation involving a substantiated sexual assault”), but the board needs to give some kind of reason. That should happen so at the very least, a reversal is also explained.
Further reading:
Yet another security vulnerability has been discovered in GitLab infrastructure, this one a perfect 10 in severity.
CVE-2026-85706, the second flaw GitLab has disclosed in just a month, is a maximum-severity vulnerability that allows attackers to read arbitrary files in a single HTTP request. The path traversal flaw results from improper confinement and lack of authentication enforcement in GitLab’s repository commits API, the company reported.
Threat actors could exploit it “under certain conditions” and read arbitrary files (credentials, secrets, and other sensitive data) on vulnerable GitLab servers.
The company has fixed the vulnerability, which impacts GitLab Community Edition (CE) and Enterprise Edition (EE), and has advised customers with public-facing self-hosted GitLab instances to patch their servers immediately, or remove public access.
Experts say the flaw is alarming because GitLab’s DevSecOps platform is used by roughly 50% of the Fortune 100 and has more than 50 million estimated registered users.
“GitLab is not simply a source-code repository,” noted Safayat Moahamad, advisory director at Info-Tech Research Group. In many enterprises, it is connected to build pipelines, deployment processes, application security workflows, and other trusted systems.
As a result, unauthorized access to configuration files, secrets, or credentials on the GitLab server could “create consequences well beyond the affected instance,” he said.
GitLab has been a favorite hacker target of late: In January, it patched a high-severity flaw that allowed attackers possessing a target’s account ID to bypass two-factor authentication, and in August, it fixed a critical vulnerability that could give unauthenticated users the ability to make modifications inside code repositories or even completely delete them with a single HTTP request.
The current maximum severity bug, CVE-2026-85706, was reported through GitLab’s HackerOne bug bounty program. It affected CE and EE versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog, noting that this type of vulnerability is a frequent attack vector for malicious cyber actors, and particularly poses significant risks to the federal enterprise; watchTowr Intel has reported that it is already observing “in-the-wild probes.” “Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away,” it warned.
This is not a vulnerability that organizations should leave for the normal patch cycle, Moahamad emphasized. “It offers an unauthenticated path to arbitrary files on a platform that frequently sits at the center of source code, build, and deployment workflows,” he said.
Enterprises should patch immediately, hunt for suspicious repository-commits API activity, and investigate whether exposed files contained credentials or secrets that may now require rotation, he advised.
Beyond patching, the watchTowr Intel team said defenders should try to identify exploitation attempts by hunting through log files for HTTP POST requests to “/api/v4/projects/{id}/repository/commits/” URIs containing “file.path” parameters.
Organizations running affected self-managed GitLab CE or EE instances should be most concerned, Moahamad noted. Risk increases where GitLab is connected to sensitive repositories, CI/CD pipelines, cloud environments, or production-deployment processes.
The information and/or access that attackers could obtain depends on what the GitLab service can read and what organizations store on the server, he explained. It could include configuration files, secrets, credentials, and other sensitive server-side data. If those files happen to contain usable tokens, keys, or credentials, an attacker could attempt to access connected infrastructure
“The flaw directly creates an unauthorized file access risk,” he said. Credential theft, lateral movement, source code exposure, and supply chain compromise are possible follow-on scenarios.
Source code and CI/CD platforms must be governed as “critical trust infrastructure,” he said. While patching remains essential, resilience will depend on knowing where platforms can be exposed, limiting what they can access, detecting abnormal API behavior, and having a tested process for investigating and rotating credentials.
David Shipley of Beauceron Security described two factors colliding to generate “maximum pain” for GitLab users.
First is the vulnerability. “It’s a 10 for a reason: Unauthenticated read access to GitLab client source code,” he said.
Second, this especially hurts because developers still have bad habits: way too much code continues to ship or is in production with embedded SSH keys, cloud secrets, tokens, and other valuable data that attackers can use to get into infrastructure, Shipley said.
“So for attackers, you’ve got the classics,” he noted: Data exfiltration and extortion, ransomware, cloud infrastructure hijacking for crypto mining, and the stealing of AI tokens and infrastructure to enable other criminal activity.
“This level of vulnerability is the code and cloud equivalent of being able to get the credit card number, expiry and security number,” Shipley said. “It opens up a world of criminal data shopping.”
The bottom line: “Get those secrets out of production code and adopt modern coding authentication best practices,” he advised.
This article originally appeared on CSOonline.
While we wait to see if Apple really is experiencing huge demand for its newly introduced iPhones, today’s the day every iPhone user gets a completely new device experience, with iOS 27 rolling out internationally, along with the other members of Apple’s 27 series OS family. If you’re on the fence about installing the new release, here are 12 reasons you should upgrade today.
Apple seems to have worked hard to improve speed and performance in this release. Everything feels much zippier, but where it seems most noticeable is when launching apps. Apple says these now open up to 30% faster, while AirDrop transfers are almost twice as fast as before.
With the 20th anniversary glass iPhone waiting in the wings, Apple isn’t going to get rid of Liquid Glass. But the company is prepared to iterate the look, and iterate it has, with sharper icons, improved contrast, and a new slider control that lets you set the UI’s transparency.
iPhone Handoff lets you use one eSIM across two devices on supporting carriers. Once set up it’s remarkably easy to use — your SIM activates the moment you unlock one of your iPhones. Better still, if you use two lines on one device, you’ll find these both transfer across too.
We’ve been talking so much about Apple’s improved Siri that I demoted it to fourth place; that’s not a reflection on what it does, but on how often you’ll have seen how it has become so much better at understanding context. It now has a Chat GPT-like interface, a standalone app, and powerful on-screen awareness to help get things done. Sadly, many of these features aren’t available in the EU.
AI is everywhere, including in Reminders Smart Suggestions, which can read your Messages chats and prompt you to set reminders for agreed tasks. Notes also gains Markdown copying.
You can now create a shortcut just by describing what actions you want it to take. Apple Intelligence will string a shortcut together for you, which you can then use across all your systems.
Safari can watch a web page and automatically let you know when it changes. That’s not the only improvement; Apple Intelligence automatically groups your open tabs into topics so related pages are easier to find.
I feel like this feature hasn’t had the attention it deserved, but you can now get Apple Intelligence to build you extensions in Safari. Just tap the three-line menu on the left of the address bar, choose Describe Extension, and let the fun begin.
Spatial Reframing is amazing; it lets you extend backgrounds and reframe subjects using AI. The upgraded Clean Up tool removes distractions even more easily than before.
Apple’s Passwords app now does an even better job of keeping your online world safe, as it can now automatically visit a website to sign in and swap a weak or compromised password for a stronger one.
Apple has really thought about child protection. Parental controls have had a huge overhaul, including the introduction of new Ask to Browse, Ask to Buy, contact calling approval and settings to protect minors against nudity, gore, and violence. These arrive alongside new scheduling function which manages which apps kids can use during school hours, meals, or bedtime.
Maps now uses aerial imagery and vision intelligence models when you use Flyover. It makes for much more detail, and a real sense of immersion.
While you’ll have to wait for search indexing to complete, Mail has become faster to load with better search results and more accurate unread counts. (Though that’s a little moot for this writer, who currently has 4,719 unread emails.) Spotlight has also been improved with smarter, more relevant suggestions.
The new operating systems are expected to be made available at around 10am PDT. One more thing? They are bound to include security updates, which you likely need.
Please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on Bluesky, LinkedIn, or Mastodon.
Microsoft’s September 2026 Patch Tuesday is the year’s largest release, with 963 CVEs requiring customer action, 106 rated critical. Two are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange. The Readiness team has published an infographic summarising deployment risk by product family.
Three client issues are carried in from August close with this update, covering:
And Microsoft has left open a Microsoft Defender Antivirus notification defect, confirmed on 28 August, in which devices report that Defender is turned off while it is running correctly.
The quietest revision window of recent months arrived alongside the largest release. Between the August and September Patch Tuesdays, from 12 August to 7 September, the MSRC Security Update Guide touched 324 CVEs. Of those, 307 were routine Microsoft Edge and Chromium republications requiring no customer action.
That leaves 17 entries affecting Microsoft’s own products, and only one of those is a genuine revision. CVE-2026-59133, an elevation of privilege in the High-Performance Computing Pack, moved to version 1.1, and its own revision note records the change as informational. For comparison, August’s window carried 76 revisions to Microsoft’s own products, 60 of them flagged as requiring customer action.
The Readiness team has reviewed all 963 published updates. Microsoft has published no mitigations and no workarounds anywhere in this release.
Microsoft has published no new service or enforcement deadlines for September. The lifecycle picture is different, with multiple end-of-support notices for this coming October:
A second wave follows on 10 November 2026, and it is the one most likely to catch development teams rather than infrastructure teams. .NET 8 reaches the end of its long-term support branch, PowerShell 7.4 does the same, and Windows 11 Enterprise and Education 23H2 ends servicing alongside Windows 11 IoT Enterprise 23H2.
Microsoft’s test guidance for this release runs to 466 Windows entries, 55 of them flagged as high risk, against 109 and four in August. Given the large number of updates this month (who would have thought that we would be here at 963 CVEs), the Readiness team recommends the following testing priorities:
Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.
Microsoft has not released any updates for their browser products for the second month in a row. September’s Security Update Guide carries no Edge-specific CVEs at all, and the 307 Chromium republications in the revision window required no customer action. The nine Edge CVEs that did appear arrived mid-cycle on 28 August and were serviced through the browser’s own update channel rather than this release.
Estates on a managed Edge channel have nothing to do here beyond confirming the channel is current. It is the one quiet corner of an otherwise heavy month.
Windows carries 726 CVEs, 77 of them critical, which is three-quarters of the entire release. Elevation of privilege dominates by volume at 406 entries, with remote code execution second at 156, information disclosure at 94 and denial of service at 47. The pattern is the reverse of the severity picture: the bulk is local elevation, while the critical-rated entries cluster in the network-facing roles.
Add this Windows update to your Patch Now schedule, with DHCP and DNS servers first and the biometric stack close behind.
Microsoft released 137 Office CVEs this month, 24 of them critical, with remote code execution the through-line at 69 entries and information disclosure close behind at 52. September breaks the recent pattern in a way that matters for deployment: this wave is not MSI-only.
Nothing in Office is exploited this month. With 24 critical-rated entries and the Click-to-Run channel carrying most of the exposure, the September Office updates belong on the Patch Now schedule regardless.
Exchange is quiet and SQL Server is not, which inverts the usual relationship between the two.
Exchange goes on the Schedule list, and SQL Server goes on the Patch Now list. That is an unusual split, and it is driven by the four critical remote code execution entries on the database estate.
Microsoft released 24 CVEs across its developer tooling this month, 23 rated important and one critical. Security feature bypasses are the main focus with eight CVE entries, with remote code execution and information disclosure at four each.
Add these to your standard release schedule, behind this month’s Windows, Office and SQL Server priorities. Keep the 10 November date for .NET 8 and PowerShell 7.4 in view while you are in the developer estate, because a patch this month does not extend either branch.
September is the largest release of the year, and this (crazy, super high) volume is the least interesting thing about it. The 963 CVEs matter less than the 55 entries Microsoft flags as high risk, and those sit in printing and fonts. Adobe shipped two Acrobat builds one digit apart and only the second is a security update (nothing to worry about here). Of the CVEs Microsoft republished, 25 are not Microsoft’s. A version number tells you very little about the work in front of you. So, given my (super-secret knowledge) of how Microsoft operates over the summer, here is my prediction for next month (October). It won’t be as big as this month – but just you wait – November is going to be big. Let’s up those numbers (or not).
Equations once used to predict whether populations of rabbits would boom, stabilize, or collapse are now being applied to something potentially even more complicated: romantic relationships.
According to mathematician Laurent Pujo-Menjouet of Claude Bernard University Lyon 1, the forces that determine whether a couple survives life’s inevitable stresses can be studied much like other complex systems. Attraction can strengthen or fade, outside pressures can push a relationship away from stability, and perhaps most importantly, there may be a critical mathematical threshold beyond which recovery becomes increasingly difficult.
In his new book, Love! Valour! Equations! The Mathematics of the Couple, published by CRC Press, Pujo-Menjouet draws on mathematical ecology, psychology, literature, and even film to explore why some couples weather years of conflict, stress, children, illness, and financial hardship while others gradually drift apart.
The goal isn’t to produce an equation that predicts who will fall in love with whom. Instead, Pujo-Menjouet treats relationships as dynamical systems—systems that change over time, respond to disturbances, and can move toward either stability or decline.
“There is no mysterious enchantment or magic potion. By now, that would be known,” Pujo-Menjouet writes in the book, which draws on mathematics, psychology, literature, and film. “Is all hope lost then? Certainly not. That is precisely where everything becomes interesting.”
The mathematical models Pujo-Menjouet uses originated in ecology. His work uses Malthusian growth models and the Lotka-Volterra equations, originally developed to describe population dynamics in animals such as rabbits. He also studies the Allee effect, a phenomenon that explains how populations struggle to recover if they drop below a particular size.
Pujo-Menjouet adapts these concepts to relationships, using the idea of a critical threshold to examine when a couple may become increasingly vulnerable to separation. He also draws on the research of psychologist John Gottman, who showed that relationship behaviors can be quantified as data.
“Just as we can predict population growth or endangered species, we can model the evolution of feelings within a couple,” Pujo-Menjouet explains. “We’re not trying to predict who you’ll fall in love with, we’re trying to understand why some couples remain stable despite life’s inevitable shocks while others slowly drift apart.”
The basic idea is simple: a relationship may have a critical threshold, or minimum level of stability needed to keep the bond intact. Pujo-Menjouet’s model considers three main forces: mutual attraction, the gradual weakening of feelings over time, and each partner’s emotional response to the other.
“If your feelings fall below this threshold and stay there, the mathematics predicts an inevitable decline toward separation,” Pujo-Menjouet says. “However, understanding this threshold gives couples a powerful tool: they can recognize danger zones and take corrective action.”
These models emphasize how couples recover from drifting apart. The key question is not whether couples experience conflict, but whether they have the resilience to restore balance afterward.
“Life will always send its wolves: stress, illness, work, children, financial difficulties,” Pujo-Menjouet says, “mathematics helps us understand how to build the brick house rather than the straw one.”
Researchers such as Pujo-Menjouet are considering whether they could combine these mathematical models with artificial intelligence to create an early-warning system for relationships. Such a system could detect the signs of instability before they become apparent to the people involved.
Pujo-Menjouet compares this method to a GPS for relationships, showing where a couple currently is, where its dynamics may be heading, and the various ways they could arrive at a healthier place. Although the models don’t decide who somebody will love, they can help explain how relationships evolve and what actions might help couples maintain their connection. Early detection of problems would allow partners to make changes before reaching a stage where recovery becomes unlikely.
Pujo-Menjouet admits that present-day mathematical models have limitations. Most of these models are based on data from Western relationships. In contrast, the factors that impact whether a relationship succeeds or fails can differ from one culture, religion, or generation to another. He points out that the model must account for additional factors to be applicable everywhere.
Human behavior also introduces unpredictability that mathematical models cannot fully account for. People can change their habits, strengthen their commitment, seek therapy, or otherwise alter the dynamics of a relationship in ways the equations cannot anticipate. The equations identify tendencies rather than determine an unavoidable outcome.
“Mathematics can illuminate patterns and provide guidance,” Pujo-Menjouet says, “but ultimately, the success of a relationship depends on two people choosing, every day, to nurture their connection. The equations can show you the path, but you still have to walk it together.”
Austin Burgess is a writer and researcher with a background in sales, marketing, and data analytics. He holds an MBA, a Bachelor of Science in Business Administration, and a data analytics certification. His work focuses on breaking scientific developments, with an emphasis on emerging biology, cognitive neuroscience, and archaeological discoveries.
Long before Taco Tuesday became part of the pop-culture vernacular, Tuesdays were synonymous with security — and for anyone in the tech world, they still are. Patch Tuesday, as you most likely know, refers to the day each month when Microsoft releases security updates and patches for its software products — everything from Windows to Office to SQL Server, developer tools to browsers.
The practice, which happens on the second Tuesday of the month, was initiated to streamline the patch distribution process and make it easier for users and IT system administrators to manage updates. Like tacos, Patch Tuesday is here to stay.
Patch Tuesday coverage has long been a staple of Computerworld’s commitment to provide critical information to the IT industry. That’s why we’ve gathered together this collection of recent patches, a rolling list we’ll keep updated each month.
In case you missed a recent Patch Tuesday announcement, here are the latest six months of updates.
September’s Patch Tuesday is Microsoft’s biggest of 2026, with 963 CVEs, two exploited flaws and a clear message: prioritize Windows, Office and SQL Server.
Two vulnerabilities are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange.
Get more info on the September 2026 Microsoft security updates.
Microsoft’s August 2026 Patch Tuesday closes at 751 CVE entries (across all product families), with 108 rated as critical. One flaw is already exploited, CVE-2026-68820, an elevation of privilege in the Windows WinSock driver (afd.sys). Two more were disclosed but not exploited.
This security-only release earns Patch Now for Windows, Office and Exchange; no SQL Server updates this month. Unfortunately, several critical issues affect server roles: Windows DNS Server carries a cluster of critical RCEs; Windows DHCP Server is the most-populated Microsoft product family at 14 entries. Testing should lead with printing and fonts and the Remote Desktop client, then a WinSock smoke test given the exploited afd.sys flaw.
Get more info on the August 2026 Microsoft security updates.
Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.
The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today.
More info is available here on Microsoft Security updates for July 2026.
Microsoft this month released 206 updates affecting Windows, Office, Exchange Server, and its developer tools — including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.”
Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.”
More info is available here on Microsoft Security updates for June 2026.
Microsoft this month released 139 updates affecting Windows, Office, .NET, and SQL Server (though there were no updates for Microsoft Exchange Server). Despite the absence of zero-days, the May Patch Tuesday update still requires Patch Now recommendations for Windows and Office.
The combination of three unauthenticated network RCEs (Netlogon, DNS Client, and SSO Plugin for Jira and Confluence), four Word Preview Pane RCEs, the large TCP/IP vulnerability cluster, and the carry-over BitLocker recovery condition (still active on Windows 10 and Windows Server) warrants an accelerated deployment release schedule.
More info is available here on Microsoft Security updates for May 2026.
Windows admins are going to be busy this month, dealing with the largest Patch Tuesday cycle in memory. The April release involves 165 updates and roughly 340 unique CVEs from Microsoft — including two zero-days, one of which is already being actively exploited in the wild.
The Readiness team recommends “Patch Now” schedules for nearly every major product family: Windows, Office (with a zero-day), Microsoft Edge (Chromium), SQL Server, and Microsoft Developer Tools (.NET). April also brings Phase 2 of Microsoft’s Kerberos RC4 hardening with full enforcement set for July. There is a lot to cover, so here’s a useful infographic mapping the deployment risk for each platform.
More info is available here on Microsoft Security updates for April 2026.
Login