Security
Stay ahead with our essential Windows security news: Patch Tuesday updates, threat analyses, and expert guidance to safeguard your Microsoft environment.
SMS MFA Dies in Microsoft Entra by 2027—Here’s Your Migration Roadmap
Microsoft will stop providing SMS and voice MFA for Entra ID on February 1, 2027, forcing affected users to register a passkey before they can sign in. This article explains the timeline, the security reasons behind the shift, and provides a practical migration plan for IT administrators, including device readiness, passkey selection, and the option to use customer-managed telecom providers.
Zoom for Windows Update Urgent: Unauthenticated Attackers Could Take Over Your Account
Zoom has released an urgent security update for its Windows clients to fix CVE-2026-53412, a critical flaw with a CVSS score of 9.8 that could allow unauthenticated remote attackers to take over user accounts. The patch also addresses three other high-severity issues. All Windows users and administrators should apply the update immediately.
Windows 11 Pro’s Best-Kept Secret: A Free Encrypted Vault Using BitLocker and VHDX
Windows 11 Pro, Enterprise, and Education users can create a free, password-protected encrypted vault by combining a virtual hard disk (VHDX) with BitLocker—no third-party software needed. The article explains how to build one, who can use it, what it protects, and its limitations.
Microsoft Acknowledges Windows Device ID That Helped Catch a Hacker—And It Can’t Be Turned Off
Microsoft confirmed that Windows assigns a persistent Global Device Identifier (GDID) that can track installations across services and networks, even behind a VPN. The identifier recently helped link VPN-routed criminal activity to an alleged hacker, raising privacy concerns because users have no way to disable it. This article explains what the GDID is, its implications, and what you can do to limit data linkage without breaking Windows.
October 2026 Microsoft Deadline Storm: What IT Must Do Before Office, Publisher, and Entra ID Vanish
Microsoft has packed multiple product retirements and support transitions into October 2026, including the end of Office LTSC 2021, the permanent removal of Publisher, the retirement of legacy Entra ID risk policies, and servicing deadlines for several Windows 11 editions. This article explains what each deadline means, which users are affected, and provides a prioritized action plan to secure identities, preserve files, and upgrade systems before the cutoffs.
A Forgotten Linux Test Driver Hid an Out-of-Bounds Bug for 16 Years. Here's What WSL 2 Users Must Do
A newly disclosed Linux kernel vulnerability (CVE-2026-64191) in the I2C stub test driver can cause out-of-bounds memory access, but only affects systems that explicitly load the module—such as custom WSL 2 kernels or hardware-development setups. The fix is already in stable kernels back to 5.10. Most Windows users are unaffected, but developers using custom Linux environments should check their configuration and apply updates promptly.
Linux Bluetooth Deadlock Fix Lands—Windows Hosts with Linux Guests Must Act
The Linux kernel patch for CVE-2026-64206 fixes a Bluetooth L2CAP deadlock that can hang connection teardown. While native Windows systems are unaffected, anyone running Linux under Windows—through WSL2, VMs, or managed fleets—should update those Linux kernels immediately. The fix is already available in stable releases 6.18.39, 7.1.4, and upstream 7.2-rc3.
WSL 2, Azure Linux VMs Face Crash Risk from CVE-2026-64190 Kernel Flaw — Update Now
CVE-2026-64190 is a Linux kernel vulnerability in the Team network driver that can cause a kernel crash during a mode change if traffic is transmitted simultaneously. The fix requires updating the kernel; Windows users running WSL 2, Hyper-V, or Azure Linux VMs should check for and apply vendor patches.
CVE-2026-64205: How a Linux Kernel Bug in Intel’s SMBus Driver Can Hang Your System—and How to Fix It
A newly disclosed Linux kernel flaw (CVE-2026-64205) in the Intel i801 SMBus driver causes persistent hangs and livelocks when an error path incorrectly clears hardware state. The bug affects kernels 6.3 through unfixed versions and is corrected in stable releases 6.18.39, 7.1.4, and 7.2-rc1. Linux admins should update immediately and verify that “SMBus is busy” log floods disappear post-patch.
Why a Malformed XFS Disk Can Crash Your Linux VM—and the Fix for CVE-2026-64187
A newly disclosed Linux kernel vulnerability, CVE-2026-64187, can cause a NULL pointer dereference and instant crash when mounting XFS filesystems with corrupted journals. While home Windows users face little direct risk, anyone running Linux virtual machines, WSL with XFS volumes, or managing Linux servers must update their kernels promptly to avoid denial-of-service disruptions.
Your Firewall Automation Might Be a Kernel Crash Waiting to Happen: Inside CVE-2026-64189
A newly disclosed Linux kernel vulnerability, CVE-2026-64189, allows a race condition in the ipset firewall tool to trigger kernel panics during routine management tasks. Any system running a vulnerable kernel and using IP sets—including WSL2, VMs, and container hosts—should apply the backported kernel patch immediately to prevent crashes.
Qualcomm RMNET Driver Race Condition Fixed in Linux Kernel—Check Your WSL and Cellular Devices
The Linux kernel has fixed CVE-2026-64188, a use-after-free vulnerability in the Qualcomm RMNET driver that could crash or compromise systems using cellular modems. While most Windows users are not directly affected, those running WSL2 with custom kernels or working with Qualcomm hardware should update their Linux environments immediately. The fix defers memory freeing to prevent a race condition, and all users should reboot after patching.
NGINX 1.31.3 Fixes SSI Worker Crash—Here’s Who Needs to Upgrade Now
CVE-2026-56434 is a use-after-free vulnerability in NGINX's Server-Side Includes module that can restart worker processes when SSI is enabled, proxies are used, and upstream buffering is off. Fixed in NGINX 1.31.3, 1.30.4, and Plus R36 P7. Windows administrators should inventory all NGINX instances, check for the vulnerable configuration combination, and upgrade or apply temporary mitigations like disabling SSI or re-enabling buffering.