Security
Stay ahead with our essential Windows security news: Patch Tuesday updates, threat analyses, and expert guidance to safeguard your Microsoft environment.
Microsoft Teams Adds Numeric-Only Meeting Passcodes—But Only for Those Who Need Them
Microsoft Teams now allows admins to assign eight-digit numeric meeting passcodes to specific organizers instead of sticking with alphanumeric codes across the board. The feature, launched in April 2026, is intended for frontline, accessibility, and shared-device scenarios but comes with a firm security warning. A safe rollout means scoping the policy narrowly, hardening lobby and anonymous join controls, and never applying it to high-stakes meetings.
Microsoft Purview's New Panel Will Recommend Insider Risk Policies You're Missing
Microsoft is adding a Policy Recommendation Panel to Purview Insider Risk Management that will proactively identify missing protections and suggest high-value configurations. The feature, scheduled for preview in November 2026 and GA in December 2026, aims to move organizations from reactive policy checking to strategic coverage optimization. Admins should prepare by documenting existing policies, fixing health warnings, and establishing governance processes to evaluate future recommendations.
Microsoft Purview DLP SLA Dashboard Lands August 2026 Preview, Giving Orgs MTTA and MTTR Tracking
Microsoft is adding an SLA-based alert reporting dashboard to Purview DLP, with preview in August 2026 and GA in September 2026. The dashboard tracks MTTA, MTTR, and top sensitive info types, letting teams set custom severity-based targets. Organizations should prepare now by defining alert lifecycles and baselining performance to ensure the metrics drive real improvement.
Microsoft Purview DLP Alerts Finally Explain the ‘Why’ Behind Exchange Policy Matches
Microsoft is rolling out enriched Exchange Online DLP alerts that now display every condition that triggered a policy match, not just the sensitive data type. Sender domains, recipients, subject keywords, attachment details, and message headers appear directly in alerts and Activity Explorer, speeding incident triage and making policy tuning more evidence-based.
Microsoft Purview Will Soon Let You Permanently Delete OneDrive and SharePoint Files—Here’s the Plan
Microsoft is adding a hard-delete option to Purview Priority cleanup for OneDrive and SharePoint, targeted for October 2026. The feature will let admins permanently remove files without sending them to the recycle bin, answering compliance and security needs but raising the stakes for governance. Administrators should begin planning formal approval workflows and audit processes now.
Microsoft Purview DLP to Let Admins Auto-Close Low-Risk Alerts and Tag Workflows by September 2026
Microsoft will introduce rule-based auto-resolution and tagging for Purview DLP alerts in September 2026, allowing admins to automatically close low-risk, predictable alerts and label others for better routing. The feature aims to cut alert fatigue while maintaining audit trails and governance.
Chrome 149 Patches Android GPU Flaw That Could Leak Browser Memory—Windows Update Included
Google’s Chrome 149 update fixes a high-severity GPU memory disclosure bug (CVE-2026-13030) that primarily threatens Android devices but also shipped as part of desktop security patches. Windows and Mac users aren’t explicitly identified as vulnerable, but the fix’s inclusion, combined with other bundled security updates, makes immediate patching essential for all platforms. We explain the real risks, the platform differences, and the simple steps users and admins must take.
Android Users Must Update Chrome Now: CVE-2026-13037 Exploits WebView for Sandboxed Code Execution
Google has patched a high-severity use-after-free bug in Android's WebView engine that could let attackers execute code within the browser sandbox via a crafted HTML page. The fix, version 149.0.7827.197, requires updates to both Chrome and Android System WebView, and it demands immediate attention from users, IT admins, and app developers because WebView is embedded in countless Android apps.
Chrome 149 Patches Critical WebGL Sandbox Escape — Here’s What Windows Users Need to Do
Google’s June 2026 Chrome 149 update silently patches a critical WebGL use-after-free vulnerability tracked as CVE-2026-13028. Although the CVE entry only mentions Android, the fix applies to Windows, macOS, and Linux, closing a hole that could allow sandbox escape via a malicious webpage. Windows users should immediately update Chrome to the latest version and restart the browser to ensure protection.
Android Chrome Users Must Patch Now: Critical WebGL Flaw Could Let Attackers Escape Browser Sandbox
Google disclosed CVE-2026-13032, a critical use-after-free flaw in Chrome’s WebGL on Android that can escape the browser sandbox via a malicious webpage. Android users must update Chrome to version 149.0.7827.197 immediately. While Windows desktops are not directly affected, the related update fixes other high‑severity issues and should be applied.
A Spiked, Camera-Wielding Steam Deck Is the Funniest Anti-Family Deterrent—and a Cautionary Tale
A Reddit user built a spiked, camera-equipped security system for their Steam Deck to stop family from draining the battery. The satirical contraption worked but is impractical and risky. This article explores safer, simpler ways to protect a handheld PC using Steam’s built-in account tools, charging habits, and physical storage—without resorting to industrial theatrics.
Microsoft’s Secure Boot Certificate Rollout Marches On: What the July KB5101650 Update Means for Your PC
Microsoft’s July 2026 cumulative update KB5101650 assures Windows 11 users that missing the recent Secure Boot certificate expiration dates won’t brick their PCs. The rollout of the newer 2023 certificates continues automatically over the coming months, and a simple traffic-light status in Windows Security helps users understand what action—if any—they need to take.
igloohome Smart Lock Flaw: What Windows Users Need to Know About the Android App Vulnerability
CISA disclosed CVE-2026-16581, a flaw in the igloohome Smart Lock Mobile App for Android that could have allowed unauthorized access to backend services. igloohome has tightened server-side authorization, and users should update their app. The advisory highlights how smart-lock security depends on the entire management chain, including Windows PCs often used for remote administration.