Patch Tuesday Reboot
The latest Patch Tuesday Reboot coverage — news, analysis, and updates from the WindowsNews.AI desk.
Microsoft 365 Calendar Hijacked as C2 Channel in New HOLLOWGRAPH Malware
HOLLOWGRAPH, a newly discovered Windows malware, abuses Microsoft 365 calendar events via Microsoft Graph API to covertly receive commands and exfiltrate data, while using DNS tunneling to refresh stolen credentials. Discovered by Group-IB, the implant has targeted a handful of Israeli entities, blending into legitimate Microsoft 365 traffic to evade traditional security controls.
Microsoft Fixes WSUS Sync for New Servers, But Existing Ones Wait for July 2026 Patches
Microsoft fixed a WSUS synchronization outage for new and rebuilt servers on July 18, 2026, but administrators running long‑standing WSUS instances still cannot access July’s security patches. The incident, caused by an accumulation of publishing metadata at Microsoft’s end, disrupted patch deployment pipelines for organizations relying on WSUS and Configuration Manager. Microsoft is preparing guidance to help existing servers safely remove the problematic metadata, but until then, the July updates remain out of reach for many.
Why Microsoft Is Forcing a 72-Hour Patch Deadline on Windows PCs—and What IT Must Do Now
Microsoft is now recommending enterprises deploy Windows quality updates within three days, with a deadline that forces restarts if users postpone. This article explains the new baseline settings, the AI-driven security threat that prompted the shift, and practical steps IT admins must take to implement the 3-day cycle without disrupting operations. It covers policy configuration, exception management, and user communication strategies, emphasizing that lengthy patch delays are no longer a safe default.
HOLLOWGRAPH: Attackers Turn Outlook Calendar Into a Secret Command Channel
Group-IB has exposed a targeted malware campaign, HOLLOWGRAPH, that turns Outlook calendar appointments into a covert command-and-control channel by hiding encrypted tasking in events dated 2050. The malware abuses the Microsoft Graph API with valid credentials, blending into legitimate cloud traffic, and refreshes access via DNS tunneling. This article breaks down the attack mechanics, explains who is most at risk, and delivers actionable steps for hunting signs of compromise and strengthening Microsoft 365 security postures.
NVIDIA Ends Game Ready Driver Support for GTX 1060: Security Updates Only Until 2028
NVIDIA has ended Game Ready driver support for the GeForce GTX 1060, providing only critical security updates through October 2028. This marks the end of an era for the once-dominant Steam GPU, and owners should plan upgrades or ensure security patches are installed.
WSUS Sync Failures: Microsoft Delivers Partial Fix, Leaving Production Servers in Limbo
Microsoft has acknowledged severe WSUS synchronization failures caused by accumulated publishing metadata, impacting enterprises since mid-July 2026. A fix is available only for new or rebuilt installations, leaving existing servers without a workaround and disrupting patch deployment through WSUS and Configuration Manager.
Entra Domain Services RC4 Kerberos Encryption Shutdown Starts July 6: Prepare Now with These Audit Steps
Microsoft is running an advance dependency test for RC4 encryption in Entra Domain Services starting July 6, 2026, to help organizations find and fix legacy Kerberos dependencies before the cipher is permanently disabled a week later. The test forces AES-only authentication, which can break apps and services that still use RC4. IT admins can prepare by enabling security audits, running a specific query for events 4768 and 4769, and methodically remediating each found dependency. A temporary rollback option exists during the test, but the real fix means moving all workloads to AES before the July 13 enforcement date.
Your SMS MFA Is Expiring: Microsoft’s 2027 Passkey Push and How to Prepare
Microsoft is retiring SMS and voice authentication in Entra ID by February 1, 2027. Starting September 1, 2026, users will be automatically prompted to set up passkeys. Organizations need to migrate users now to avoid lockouts.
Windows 11 Enterprise 23H2 Drops Support in 2026: Why 25H2, Not 24H2, Is the Upgrade You Need
Windows 11 Enterprise version 23H2 reaches end of support on November 10, 2026. IT administrators face a critical choice: upgrade to 24H2 and face another migration in 2027, or leap directly to 25H2 for a support window extending to 2028. This article explains why 25H2 is the strategic default and provides a phased migration plan to beat the deadline.
Dell Windows 11 Overheating Fix: KB5121767 Emergency Patch Ends Shutdowns and Battery Drain
Microsoft has released an out-of-band update, KB5121767, to fix overheating, shutdowns, and battery drain on select Dell laptops running Windows 11 24H2 or 25H2. The emergency patch resolves a conflict between the July 2026 Patch Tuesday update and Intel’s Innovation Platform Framework driver, which disrupted power and thermal management. While only a limited set of Dell models are affected, users experiencing symptoms should install the update via Windows Update to restore normal operation and security patch levels.
Critical ServiceNow RCE Flaws Under Active Attack: What Users Must Do Now
ServiceNow users are facing active attacks targeting two critical unauthenticated RCE flaws, CVE-2024-4879 and CVE-2024-5217. CISA added both to its Known Exploited Vulnerabilities catalog in July 2024, confirming exploitation. This article explains who is affected, the patch levels required, and step-by-step actions for hosted, self-hosted, and partner-managed deployments to secure their instances immediately.
Screenshot Block for Protected PDFs Arrives on OneDrive Web Next Month—But There's a Browser Catch
Microsoft will enforce screenshot blocking for PDFs with Purview sensitivity labels that deny copy permissions when viewed through OneDrive or SharePoint in Edge, starting August 2026. Other browsers and mobile are unsupported, making Edge the only compliant viewer. IT admins must review label configurations, browser policies, and user training to avoid disruptions.
CVE-2026-63794: Linux KVM Host Bug Exposes AMD SEV-Protected Windows VMs to Memory Overflow
A buffer overflow vulnerability in Linux KVM's AMD SEV code, tracked as CVE-2026-63794, can compromise the memory encryption that protects virtual machines, including Windows guests. While Windows updates won't fix it, host administrators must patch their Linux KVM servers with a kernel version that includes the fix (e.g., 5.10.260 or later), and then reboot. Cloud customers should verify their provider has addressed the issue; on-prem admins have clear steps to patch and verify.