Windows updates
Microsoft ships Windows security updates on the second Tuesday of each month, Patch Tuesday. Fixes for problems those updates cause often follow in the weeks after. This page collects our reporting on Windows 10 and Windows 11 updates: what each update changes, known issues, and what to check before you roll it out.
Latest
Windows 11 October update tightens NTLMv1 default; MS-CHAPv2 VPNs may be hit On devices without Credential Guard and with the BlockNtlmv1SSO value unset, Microsoft warns that MS-CHAPv2 logins may be affected.Earlier reporting
October Windows update can stall Exchange mail on busy servers, Microsoft says A new default memory limit may be too low for heavy Exchange workloads. Microsoft has a workaround but no fix yet. Microsoft: October Windows 11 update may block Smart App Control Microsoft says some devices may be unable to turn the feature back on after installing KB5127648. Microsoft fixes a Windows update bug that left VPN connections stuck A September security update broke Always On VPN when a first connection failed. The fix arrived five weeks later. Keeping Windows 10 running now takes more than installing the monthly patch Microsoft's KB5126657 carries October's fixes, but the notes also list Secure Boot, install-media and USB audio work. Microsoft fixed 1,417 flaws in October; the exploited one needs a user's click A huge patch batch is a sorting problem. The SANS Internet Storm Center points to four items worth finding first. Microsoft releases October Windows 11 updates KB5127648 and KB5126653 The required Patch Tuesday updates carry security fixes and a set of new features. A fifth of UK security chiefs try to dodge Patch Tuesday, Socura poll finds Microsoft shipped a record number of fixes in September, and deploying them falls on security leaders who say they are stretched. Microsoft: Windows versions it no longer supports lose Windows Update in 2027 Devices on unsupported Windows versions lose Windows Update access when certificates expire; supported versions need a listed update. Microsoft's Office repair update left some devices without working Office Microsoft paused KB5002907 after reports of problems on Office 2016 and 2019 devices. It has not said why. Microsoft's on-premises patch release hit a record near 1,000 flaws in September Microsoft tells CISOs the hard part is shifting from finding flaws to choosing which to fix, and how fast. Microsoft: KB5124010 and later updates may crash apps using Windows' AC-3 audio Microsoft says some apps that rely on Windows' built-in Dolby Digital decoding might close unexpectedly, and a fix is still being worked on. Microsoft's 622-CVE Patch Tuesday and the Math of Accumulated Software Surface Two flaws were already under active attack when July's update batch — the largest in recent memory — shipped. 208 CVEs in One Patch Tuesday. Microsoft's Largest Ever. Including a Wormable Kernel Flaw Compared to EternalBlue. Your Web Server Has 72 Hours. June 2026 Patch Tuesday delivered 208 CVEs (571 with Chromium bundled), 37 Critical. CVE-2026-45657 (CVSS 9.8) is a use-after-free in Windows Kernel TCP/IP that requires no authentication and can self-propagate. CVE-2026-47291 (CVSS 9.8) hits HTTP.sys directly — a web server RCE. CISA's 3-day mandate means patching is no longer optional. 206 CVEs in One Patch Tuesday: AI Is Finding Bugs Faster Than Humans Can Fix Them Microsoft's June 2026 Patch Tuesday shattered records — 206 vulnerabilities, 33 critical, a wormable kernel flaw. The driver: AI-assisted vulnerability discovery is producing an order of magnitude more findings than human-only research.Other trackers: PHP2Shell, Node.js security releases, eMudhra certificate compromise, DeepSeek