In a weird way, I’ve been thinking about the idea of a Googlebook for well over a decade now — despite the fact that such a product has only officially existed for a matter of months.

I’m relatively unusual in the world of tech journalism, y’see, in that I’ve been both writing about Android and ChromeOS since the platforms’ earliest days and actively using devices from both ends of those ecosystems in my own day-to-day life that entire time. Most tech writers tend to be iPhone owners and Chromebook skeptics who see this part of the digital world from an outside view — once a year or so, when significant new devices come along for assessment — without having the perspective of someone who’s truly immersed in it day in and day out.

That distinction is always painfully apparent when you read a review that waxes on endlessly with out-of-touch iPhone comparisons and comments about the limiting nature of Google’s ChromeOS concept — positions that simply aren’t accurate for those of us who live in these ecosystems and embrace the philosophies they offer.

This won’t be one of those reviews, and I perhaps more than anyone have been champing at the bit to get my hands on one of Google’s new Android-ChromeOS-combining Googlebooks since the vaguest concept of these devices first appeared on the horizon earlier this year.

So keep that in mind when I tell you, coming from the perspective of someone who very much wanted to love this: Using a Googlebook is an extraordinarily strange experience — especially when you’re treating it like a regular laptop, as it’s being positioned by Google, and relying on it to get real work done.

But amidst all the oddness, there are some true high points along with plenty of intriguing, if unfinished-feeling, potential.

Here’s what it’s been like trying to actually work on a Googlebook — specifically, the Lenovo Googlebook, which sells for $1,149 (and was provided to me as a short-term loaner from Lenovo for the purposes of this article).

The Googlebook groundwork

First things first, let’s back up a minute and set the stage for what we’re even talking about here.

The Googlebook is a new type of laptop created by Google and built by a variety of third-party device-making partners — Acer, Asus, Dell, HP, and Lenovo, to start.

It’s meant to represent an evolution of sorts from the Chromebook, the initially simple laptop Google launched in 2012 and slowly morphed from a barebones web portal into an “everything OS” — a system that runs web apps, Android apps, Linux apps, and even sometimes Windows apps, for businesses that have specific needs that can’t be addressed in any other way.

But while ChromeOS and Android grew closer and more connected over time, Googlebook OS — the awkwardly clunky name of the operating system at the heart of every Googlebook — sets all of that aside to aim for a fresh start. The software here sports Android at its core alongside a variety of optimizations designed to bring in bits of ChromeOS-like elements and make everything seem more suited to a laptop setting.

With that in mind, starting to use a Googlebook is both immediately familiar and vexingly confusing. The interface feels a lot like Android, which is nice, but it also doesn’t quite feel in line with how you expect to work on a desktop computer. It’s a jarring sort of mashup, and it’s tough to wrap your head around to get comfortable working.

That’s true for relatively small touches like having the clock in the upper-left corner of the screen instead of in the lower-right corner, where’d you expect it on most non-Apple-made computers. It’s a little thing, but it keeps throwing me whenever I try to glance at the time during the day. That approach is similar to Android, yes, but it just doesn’t feel right in this environment or with what pretty much all of us who’d be considering this kind of device have been trained for ages to expect with a desktop computer experience.

It’s true, too, for keyboard shortcuts, which don’t work the same as they did on ChromeOS — even just basic, common things like opening items on the taskbar. (Googlebook OS does have an impressive array of customizable keyboard shortcuts, if you find ’em, but there’s a ton of new combinations and muscle memory to be learned.)

The confusion is probably most prominent, though, on the app front, where Google is really leaning hard into the Play Store and the idea of Android apps being the primary way to get stuff done, despite the fact that Android apps often aren’t ideal — or even available, in some instances — in a productivity-oriented, desktop computing scenario.

At least one of Google’s own apps addresses this elegantly. Installing Google Calendar from the Play Store basically just gives you an app-like shell around the Calendar website, and you can use the Android app’s widget alongside that, if you want. (The downside is that you can’t use the equivalent Android app in full even if you want to, as there’s no straightforward path to install it — and, strangely, the same web-widget combo is not available with other Google apps, like Gmail or Drive, which give you only the web version and no option to use any associated Android widgets.)

And since the version of Chrome on a Googlebook looks and feels like the full desktop version of the browser — like what you’d expect on a Chromebook or any other desktop computer — relying on this unusual mix of web and Android interfaces for productivity is mostly OK. Mostly.

Working in Docs, with as few as five or six tabs open, I continue encountering an occasional issue where the tab just blanks out for a second or two and then comes back — which, suffice it to say, isn’t exactly optimal for working.

The email app I use, Superhuman, appears to be completely incompatible here. The web version (which is powered by a Chrome extension) errors out anytime I open it, and the Android app is clearly not meant for large-screen, keyboard-and-mouse use and presents an incredibly awkward experience as a result.

The productivity tool Notion, meanwhile, came up for me as one of the Googlebook’s suggested tools that’s optimized for desktop use, so I followed that direction and installed the Notion Android app — only to find that the app is much more awkward and limited on a laptop than the regular Notion web experience, where all the functions are available and the keyboard shortcuts work as expected. So I decided to try to install the Notion web app for easy ongoing access to that, and I encountered a mysterious error.

D’oh.

Then there’s something like Slack, which you can install from the Play Store but with an accurate warning that it’s “better on the website.” So, OK: You go to the website, try to sign in and install the web app version of it from there, and…there’s that blasted “cannot be installed” error again. (Google says it rolled out an update last week that allows any web page to be installed as a web app, but as of this writing — even with that update present on my device — the same error-encountering pattern persists.)

Other apps appear to work fine but then behave in odd and unexpected ways. I tried to install the Android version of Vivaldi, for instance, and it installs and opens without issue — but then returns an error anytime I try to actually open a website within it. That definitely doesn’t happen on a Chromebook, nor do the other aforementioned issues.

There’s just a lot of weird stuff like that, where it feels like a typical Google not-quite-fully-baked product. To be fair, that may be at least in part because of third-party app developers not yet supporting what needs to be supported for full optimization in this new environment — but either way, that’s the experience you get on a Googlebook right now, and it’s an all-too-familiar chicken-and-egg challenge that there’s no telling how long might take to see resolved.

On a somewhat related note: While the ability to install Linux apps is technically present on a Googlebook, it isn’t at all a user-friendly experience. Linux app installation is available only in a limited manner within the confines of a command-line terminal, and any such programs consequently don’t integrate into the launcher or the main Googlebook interface. That means there’s no real way to use them as a part of the standard Googlebook experience — which is a shame, as having those more traditional desktop apps available on ChromeOS went a long way in filling in pertinent function gaps for a lot of people and businesses. (Google says better Linux app support is vaguely “on the roadmap.”)

The various layers Google created to make Windows apps available for businesses in ChromeOS aren’t present in this environment, either. The official line, as relayed to me by a Google spokesperson, is that “Googlebook takes a fundamentally different architectural path than previous platforms” and they “aren’t attempting to patch together legacy PC software layers or rely on Windows emulation to make a laptop functional”:

Instead, Googlebook OS is built directly on the Android tech stack with the desktop foundations of ChromeOS, pairing the world’s largest native app ecosystem with an uncompromised, full desktop Chrome browser.

This makes it easier than ever for developers to build a true desktop-class app experience.

That’s all noble enough in theory — but as a prospective Googlebook owner right now, what good does any of that do when most developers haven’t yet built those “true desktop-class app experiences” for this environment? Or when you’re a business user whose company has the very same sort of “legacy” software requirements that led Google to work so hard on Windows app support for Chromebooks and maintain that option in that arena?

Pros, cons, and more Googlebook confusion

Let’s break from the strange stuff for a minute to focus on some positives — because, again, there is something undeniably cool about experiencing Android in a laptop form and seeing all the ways a Googlebook works hand in hand with an Android phone to make life easier.

First and foremost, Googlebooks stray from the longstanding minimalist Chromebook standard to give you a fully customizable desktop — with the ability to create any arrangement of shortcuts and widgets, just like you can on an Android home screen. That is absolutely a welcome progression from the more limiting ChromeOS approach and something I’d long hoped to see in that domain, and having those familiar forms of interactive info right in front of you while working is an incredibly helpful addition.

Being able to easily access the files on your phone without any extra hoop-jumping is also a nifty touch, for the moments when such a need arises. Once your Googlebook is paired with your Android phone, you simply open the Files app on the laptop, and you can see and interact with any files on your phone right then and there. (That said, the Files app is otherwise much more barebones and limited than its ChromeOS equivalent, unfortunately — so you can’t, for instance, drag and drop directly from the phone to any specific folder on your local or Google Drive storage.)

As far as hardware is concerned, Lenovo did a bang-up job with its inaugural Googlebook device. This is one seriously nice laptop — a pleasure to hold, with an almost silky-feeling smooth texture on the top and a thoughtfully ridged bottom for extra grippiness when you carry it. The system has a beautiful (and big!) 15.3″ display, an excellent keyboard and trackpad, and surprisingly great speakers. Those boxes are all checked off.

But it’s the experience inside the hardware that means the most, here in particular — so, back to that:

Native app installation aside, one key selling point of the Googlebook is how it’s able to stream apps from a connected Android phone — letting you run an app from your phone on the computer, in other words, without having the app installed locally on the Googlebook itself.

It’s a slightly confusing concept to wrap your head around, especially since you can also install most of the same apps from your phone directly onto the Googlebook if you want (and, given that this is a native Android device, installing and running Android apps on it is absolutely smoother and snappier than what you typically experience on a Chromebook). Because of that — just like with the equivalent streaming option that had been available on ChromeOS in recent years — it seems like something that’s bound to be more befuddling than beneficial for most people, most of the time.

That being said, I have had a couple of situations come up where it seemed like the feature might be handy. First, I needed to get a two-factor authentication code out of Authy, which is available only as a mobile app. A perfect use-case, right?

Well, not exactly: The Googlebook wouldn’t let me stream the Authy app from my phone and instead gave me an error: “Can’t cast content. This content is restricted.” So then I thought maybe I’d just install Authy directly onto the Googlebook instead, but alas: The app “isn’t available on Google Play on this device.” Bah.

Another time, I tried to open Google Wallet from my phone to get some info off my insurance card, which I have stored in that service. That worked, at first — but then the app kept hanging on a loading screen anytime I tried to open anything.

The one scenario where the app streaming has been helpful is with notifications: Anytime you get a new notification on your connected Android phone, it shows up as a pop-up in the upper-right corner of the Googlebook display. The same actions that’d be present on the notification on your phone, such as marking something as read or replying in-line, are also present on the computer, and you can click on the notification to open the associated app in full on your laptop — just like you would on your phone, only everything happens within a window on the Googlebook.

That’s a clever little sleeper feature and arguably the best part of the app streaming capability, even if you don’t necessarily think about the fact that you’re using app streaming when it happens.

Another key selling point is the addition of AI-oriented features into the Googlebook operating system. This includes a Magic Pointer feature that lets you wiggle your cursor to summon Gemini and ask it about any specific area of text or visual on your screen — which is fine but not something I find myself actually using often. Its most useful-seeming promise is being able to act on information, like creating a calendar event based on a specific area of an email or text message on your screen, but its accuracy in getting the details right in such scenarios has been pretty hit and miss in my experience.

Then there’s the integrated Rambler system for conversational voice-to-text conversion (as seen on Google’s recent Pixel phones). It works well, but by design it isn’t a direct dictation tool; instead, it adjusts and rewrites your rambling speech (hence the name) to make it better, in its view. That makes a lot of sense when you’re spouting off a quick text message while walking or driving, but unless you don’t mind losing your own specific style, intentions, and voice with longer computer-crafted communications, it doesn’t seem like something you’d be using much in a business capacity — though it can certainly be handy to have available on occasion.

As is often the case with Google products and AI features in particular, some of the smaller, less headline-making touches on the Googlebook are much more interesting than the flashy marquee features.

All in all, it’s a perplexing picture.

The Googlebook productivity puzzle

More than anything, the question that keeps coming to my mind — again, as someone who fully embraces Android and frequently works on a Chromebook — is simply: Who is this meant to serve? And, in its current state, for whom will it be a meaningful upgrade and enticement over other existing options?

I keep thinking how this exact setup would make for an absolutely brilliant souped-up Android tablet interface, with the right kind of hardware around it. You’d have the familiar Android-like environment, optimized for a larger screen, and the ability to pair that with a more desktop-like experience in the core Google apps — including Chrome, for a less limiting active web experience when you connect a keyboard (or flip around a convertible device to have one present).

As the Googlebook stands now, though, I just don’t know that it’s a great replacement yet for a Chromebook — or any other laptop — particularly when it comes to getting actual work done. At best, it feels like a fairly linear progression with some awkward adjustments and asterisks. At worst, it’s gonna be a real challenge for some people to use in the way they need a laptop to work. And I’m just not sure what’s being added, from a practical perspective, that makes it all worthwhile.

What we can say is that Google has a history of launching products that are still rough around with the edges, and sometimes, those products evolve over time — sometimes quite quickly! — and end up becoming incredible. Heck, think how much ChromeOS changed from its earliest form to the way it is today.

At the same time, Google also has a pesky habit of pivoting, giving up, and failing to follow through on once-heavily-hyped products. A fair amount of the Googlebook’s early shortcomings come down to convincing third-party developers to buy into the platform and invest the resources in making their apps work well on it, too — which is the exact same chicken-and-egg challenge that’s kept promising Google concepts from blossoming before.

For now, the Googlebook is an awkward start with plenty of potential. Where it goes next is anyone’s guess — and something that, to some degree, may depend on how many people are willing to take the leap with it early and wait for it to evolve.

Microsoft’s October 2026 Patch Tuesday is the year’s largest release, with 1,408 CVEs requiring customer action, 72 of them rated critical. September, the previous high, carried 963. One CVE is already exploited: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web. Two were publicly disclosed before release, in the .NET Framework and the MessagePack-CSharp library. Separately, on 25 September Microsoft reported attacks against CVE-2026-65660, a SharePoint Server flaw fixed in August. Readiness recommends a Patch Now scheduling for Windows, Office, Exchange and the developer tooling, and a standard release schedule for SQL Server. The Readiness team has published an infographic summarising deployment risk by product family.

Known issues

On 14 October, Microsoft added a known issue to this month’s Windows 11 updates, KB5127648 for versions 24H2, 25H2 and 26H2, and KB5127646 for 26H1. Non-admin users might be unable to open Remote Desktop connections to devices that have Administrator protection enabled, with error 0xC000000D. The issue started with September’s non-security preview update. The Windows 11 security baselines enable Administrator protection by default, so test remote access to managed hosts before broad deployment. Microsoft’s mitigation is to turn off Administrator protection temporarily through your policy management tool, and a fix will follow in a future update.

Two issues remain open:

• Some USB Audio Class 1.0 devices might fail to start or produce no sound. The 14 September out-of-band update resolved part of this, and for the remaining symptoms Microsoft directs IT administrators to Microsoft Support for Business.
• Windows Server Update Services still does not display synchronisation error details on Server 2025 and Server 2022. Microsoft removed the function to address CVE-2025-59287 and offers no workaround.

And three are now closed:

• The incorrect “Microsoft Defender Antivirus is turned off” notifications, still open when we published in September, were fixed by Defender Antivirus update 4.18.26080.4, released on 17 September.
• On Windows 11, the October update fixes Explorer failing to start after sign-in on multi-user systems such as Azure Virtual Desktop with FSLogix, which left users at a black screen.
• On Windows 10, Windows 11 23H2 and Server 2016 and 2019, it fixes File History failing to back up or restore and showing a false “Reconnect your drive” message.

Major revisions and mitigations

Between the September and October releases, from 9 September to 12 October, Microsoft’s Security Update Guide notifications covered 111 entries for Microsoft’s own products, not counting Chromium republications for Edge. Of those 111, 90 are true revisions rather than new entries. September’s window had one.

• On 17 September, 84 of September’s CVEs gained Office for Mac updates. Each revision note tells customers running affected Mac software to “install the update for their product to be protected”.
• On 16 September, Microsoft corrected the scoring of three critical SQL Server remote code execution flaws from September, CVE-2026-67378, CVE-2026-67631 and CVE-2026-67643. The scores now record that “an attacker does not require any privileges”. Microsoft calls this an informational change.
• On 25 September, Microsoft revised CVE-2026-65660, a SharePoint Server remote code execution flaw fixed in August, to state that it “had reliable evidence of observed attacks against exploitation of this vulnerability”. CISA added it to its list of known exploited vulnerabilities the same day. The Security Update Guide still shows “Exploited: No” for this CVE, so a report filtered on that flag will miss it. If any SharePoint server lacks the August update, install it now.
• Of the 21 new entries, 18 are critical cloud-side flaws in Azure, Microsoft 365 Copilot, Dataverse and Fabric, all marked “Customer action required: No”. Two are Edge flaws, and one is CVE-2026-96940 in Exchange Server, published on 2 October and covered below.

Microsoft has published no mitigations and no workarounds in the October release.

Windows lifecycle and enforcement updates

These support milestones passed with this release on 13 October, as scheduled:

• Office 2021 retail and Office LTSC 2021, including Skype for Business LTSC 2021, reached the end of support.
• Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016 reached the end of extended support.
• Extended Security Updates for Windows Server 2012 and 2012 R2 ended. Year three was the last, so the October update is the final one for both.
• Windows 11 Home and Pro version 24H2 reached the end of updates.
• Windows Server 2022 moved to extended support, which runs to 14 October 2031.

The next milestones fall on 10 November 2026, the date of November’s Patch Tuesday. .NET 8 and .NET 9 reach the end of support, as do PowerShell 7.4 and 7.5. Windows 11 Enterprise and Education 23H2, and IoT Enterprise 23H2, reach the end of updates, and Microsoft says November’s update “will be the last update available for these editions”.

Microsoft also starts or tightens several enforcement changes with this release:

• Windows 11 24H2, 25H2 and 26H2, and Windows Server 2025, now restrict NTLMv1-derived credentials for single sign-on by default. Where Credential Guard is off, Microsoft warns this “might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2-based authentication” (KB5066470).
• AD FS Distributed Key Manager container permissions move into enforcement mode. Supported servers remediate automatically, but Server 2012 and 2012 R2 need manual remediation (KB5121391).
• ReFS volumes on removable media enter an audit phase, and blocking is enabled by default from the January 2027 update (KB5130741).
• The Windows Production PCA 2011 Secure Boot certificate, used to sign the Windows boot loader, expires on 19 October. Devices without its replacement, Windows UEFI CA 2023, keep starting and updating normally, but they stop receiving new early-boot protections (KB5062710).

Microsoft’s test guidance for this release runs to 496 Windows entries, 41 of them flagged as high risk, against 466 and 55 in September. Printing, scanning and font rendering account for 31 of the 41. The Readiness team recommends these testing priorities:

• Printing. Print documents with mixed fonts from 32-bit and 64-bit applications to physical and virtual printers. Add network printers by discovery and by IP address, and print through a shared print server, a USB printer and a PostScript driver.
• Downloaded files. The exploited Shell flaw bypasses Mark of the Web, so open files and shortcuts downloaded from the internet and confirm the SmartScreen and security warnings still appear.
• Remote access. Test Remote Desktop with a non-admin account against hosts that have Administrator protection enabled, and test Wi-Fi and VPN connections that use MS-CHAPv2.
• Application installs. Install, repair and uninstall a representative set of MSI packages, including packages with script custom actions. Windows Installer takes 38 fixes this month.
• Network servers. Run DNS servers (52 fixes) and DHCP servers (18) under load, and confirm leases, zone transfers and conditional forwarders behave as before.

Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.

Browsers

For the third month in a row, Microsoft’s Patch Tuesday release lists no browser CVEs. Edge security fixes arrived between releases instead. Between 9 September and 12 October, Microsoft published 414 CVEs for Microsoft Edge in the Security Update Guide: 409 republished from Chromium and five specific to Edge. None carries an exploited flag, and no Edge release in that period reported an exploit in the wild.

Microsoft Windows

Windows takes 1,122 CVEs this month, 42 of them critical. Elevation of privilege accounts for 617 entries, information disclosure for 200 and remote code execution for 179. Of the 42 critical entries, 31 are remote code execution, nine are elevation of privilege and two are spoofing.

• The exploited flaw is CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web defences. An attacker must convince a user to open a crafted file or follow a link. CISA added it to its list of known exploited vulnerabilities on 13 October, with a remediation date of 16 October.
• DHCP takes 18 fixes, six of them critical remote code execution: five in DHCP Server and one in the DHCP client. DNS Server takes 52, 10 of them remote code execution, though none is critical. Critical remote code execution also affects Hyper-V, Message Queuing, Microsoft QUIC, the Remote Desktop Gateway, Windows Deployment Services, Active Directory Domain Services, NDES and the multicast transport driver.
• In file and image handling, the Raw Image Extension has three critical fixes, one of them a CVE assigned by Cisco Talos, and the PostScript printer driver takes three more. Text shaping takes two, and Media Foundation, the codecs library, the video decoder, GDI+, the graphics component and the Windows PDF component take one each.
• The virtualisation-based security enclave takes eight fixes, five of them critical elevation of privilege.
• The most-patched areas are DNS Server at 52, Win32k at 48, the Windows Kernel at 46 and Windows Installer at 38.

Add this Windows update to your Patch Now schedule. Every client needs the fix for the exploited Shell flaw, and DHCP servers and Hyper-V hosts need the critical server-side fixes.

Microsoft Office

Microsoft released 180 Office CVEs this month, 26 of them critical, and remote code execution accounts for 107.

• Client updates on Windows are Click-to-Run only, for Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024. Office for Mac updates ship in the same release this month, rather than nine days later as they did in September. Excel takes 69 fixes, 11 of them critical. Word takes 22, Access 13, Outlook 10 with five critical, PowerPoint nine with four critical, and Visio three, all critical.
• SharePoint Server Subscription Edition takes 34 CVEs in KB5002927, two of them critical. SharePoint Server 2016 and 2019 left extended support on 14 July 2026, and two of this month’s flaws list them as affected with no update: CVE-2026-69943 for both versions and CVE-2026-97783 for 2019.
• Office Online Server takes 43 CVEs in KB5002928. Skype for Business Server takes three, in KB5132779 for 2015 CU13, KB5131693 for 2019 CU8 and KB5131692 for Subscription Edition CU1.

Add these updates to your Patch Now schedule, because 25 of the 26 critical entries affect Excel, Outlook, PowerPoint, Visio and Word.

Microsoft Exchange and SQL Server

Exchange has one critical entry this month and SQL Server has none.

• Exchange Server has seven CVEs across 2016 CU23, 2019 CU14 and CU15, and Subscription Edition: one critical remote code execution, CVE-2026-70571, five elevations of privilege and one spoofing flaw. Six are fixed by the 13 October updates: KB5128895 for Subscription Edition, KB5128896 for 2019 CU15, KB5128897 for 2019 CU14 and KB5128898 for 2016 CU23.
• The seventh, CVE-2026-96940, was published on 2 October. Microsoft lists it against a separate set of updates released that day, KB5129955 to KB5129958, not against the 13 October updates, so confirm both sets are installed. Microsoft rates both CVE-2026-96940 and the critical entry as “Exploitation More Likely”..
• SQL Server has 22 CVEs, none of them critical: eight remote code execution, seven elevation of privilege, four information disclosure and three denials of service. Each supported branch gets a cumulative update and a GDR: 2025 (KB5126967, KB5128492), 2022 (KB5126934, KB5128493), 2019 (KB5128494, KB5128495) and 2017 (KB5128496, KB5128497).

Exchange goes on the Patch Now list. SQL Server goes on the Schedule list because none of its 22 entries is critical. If September’s SQL Server update is still outstanding, install it first.

Microsoft Developer Tools

Microsoft released 66 CVEs across its developer tooling this month: two critical, 63 important and one moderate. Remote code execution accounts for 18 entries and elevation of privilege for 13.

• Both critical entries also affect Windows. CVE-2026-105016 is a remote code execution flaw in Microsoft QUIC that needs no authentication or user interaction, and it affects .NET 8, 9, 10 and 11 on Windows and Visual Studio 2022 and 2026. CVE-2026-96222 is an AD FS certificate validation flaw that Microsoft lists against both the .NET Framework and Windows Server.
• Two entries were publicly disclosed before release. CVE-2026-108398 in the .NET Framework lets an authenticated attacker bypass Windows Defender Application Control. CVE-2026-92707, a denial-of-service vulnerability in the MessagePack-CSharp library assigned by GitHub, affects Visual Studio and the ASP.NET Core SignalR MessagePack protocol.
• Visual Studio Code has 10 fixes, five of them security feature bypasses, and PowerShell 7.4, 7.5 and 7.6 take two.

Add these updates to your Patch Now schedule, starting with the .NET updates that carry the QUIC fix.

Adobe (and third-party updates)

Adobe published 11 security bulletins on 13 October, covering 175 CVEs across ColdFusion, Experience Manager, Commerce, Photoshop, Bridge, FrameMaker, Dimension, the Substance 3D tools and the Content Credentials SDK. None is rated priority 1, and Adobe is not aware of exploits for any of them. No Acrobat or Reader security update for this month. I mentioned last month that we are in for a few months of extraordinary patch releases. Harking back to 2003 (when I started work on the nascent field of Microsoft patch management), with Microsoft releasing just  51 updates, anything over a 1000, much less 1400 CVE entries would have been unimaginable. I don’t think that we are at a “patch maximum” yet — but I hope that things calm down soon.

Long before Taco Tuesday became part of the pop-culture vernacular, Tuesdays were synonymous with security — and for anyone in the tech world, they still are.  Patch Tuesday, as you most likely know, refers to the day each month when Microsoft releases security updates and patches for its software products — everything from Windows to Office to SQL Server, developer tools to browsers.

The practice, which happens on the second Tuesday of the month, was initiated to streamline the patch distribution process and make it easier for users and IT system administrators to manage updates. Like tacos, Patch Tuesday is here to stay.

Patch Tuesday coverage has long been a staple of Computerworld’s commitment to provide critical information to the IT industry. That’s why we’ve gathered together this collection of recent patches, a rolling list we’ll keep updated each month.

In case you missed a recent Patch Tuesday announcement, here are the latest six months of updates.

October Patch Tuesday: 1,408 CVEs, 1 exploited flaw and a SharePoint surprise

Microsoft just shipped 1,408 vulnerabilities in one month, and a SharePoint flaw it marked “not exploited” is actually under attack right now. Our expert recommends a Patch Now scheduling for Windows, Office, Exchange and the developer tooling, and a standard release schedule for SQL Server.

Get more info on the October 2026 Microsoft security updates.

September Patch Tuesday: 963 CVEs, 2 exploited flaws, 1 message

September’s Patch Tuesday is Microsoft’s biggest of 2026, with 963 CVEs, two exploited flaws and a clear message: prioritize Windows, Office and SQL Server.

Two vulnerabilities are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange.

Get more info on the September 2026 Microsoft security updates.

August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw

Microsoft’s August 2026 Patch Tuesday closes at 751 CVE entries (across all product families), with 108 rated as critical. One flaw is already exploited, CVE-2026-68820, an elevation of privilege in the Windows WinSock driver (afd.sys). Two more were disclosed but not exploited.

This security-only release earns Patch Now for Windows, Office and Exchange; no SQL Server updates this month. Unfortunately, several critical issues affect server roles: Windows DNS Server carries a cluster of critical RCEs; Windows DHCP Server is the most-populated Microsoft product family at 14 entries. Testing should lead with printing and fonts and the Remote Desktop client, then a WinSock smoke test given the exploited afd.sys flaw.

Get more info on the August 2026 Microsoft security updates.

July’s Patch Tuesday sees an end-of-support collision amidst a massive, record-setting patch wave

Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.

The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today.

More info is available here on Microsoft Security updates for July 2026.

For June, Patch Tuesday means an IT scramble

Microsoft this month released 206 updates affecting Windows, Office, Exchange Server, and its developer tools — including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.” 

Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.”

More info is available here on Microsoft Security updates for June 2026.

For May, Patch Tuesday means 139 updates — but no zero-days

Microsoft this month released 139 updates affecting Windows, Office, .NET, and SQL Server (though there were no updates for Microsoft Exchange Server). Despite the absence of zero-days, the May Patch Tuesday update still requires Patch Now recommendations for Windows and Office. 

The combination of three unauthenticated network RCEs (Netlogon, DNS Client, and SSO Plugin for Jira and Confluence), four Word Preview Pane RCEs, the large TCP/IP vulnerability cluster, and the carry-over BitLocker recovery condition (still active on Windows 10 and Windows Server) warrants an accelerated deployment release schedule. 

More info is available here on Microsoft Security updates for May 2026.

While we wait to see if Apple really is experiencing huge demand for its newly introduced iPhones, today’s the day every iPhone user gets a completely new device experience, with iOS 27 rolling out internationally, along with the other members of Apple’s 27 series OS family. If you’re on the fence about installing the new release, here are 12 reasons you should upgrade today.

Speed and performance

Apple seems to have worked hard to improve speed and performance in this release. Everything feels much zippier, but where it seems most noticeable is when launching apps. Apple says these now open up to 30% faster, while AirDrop transfers are almost twice as fast as before.

Liquid Glass looks nicer

With the 20^th anniversary glass iPhone waiting in the wings, Apple isn’t going to get rid of Liquid Glass. But the company is prepared to iterate the look, and iterate it has, with sharper icons, improved contrast, and a new slider control that lets you set the UI’s transparency.

Use two iPhones

iPhone Handoff lets you use one eSIM across two devices on supporting carriers. Once set up it’s remarkably easy to use — your SIM activates the moment you unlock one of your iPhones. Better still, if you use two lines on one device, you’ll find these both transfer across too.

Siri AI

We’ve been talking so much about Apple’s improved Siri that I demoted it to fourth place; that’s not a reflection on what it does, but on how often you’ll have seen how it has become so much better at understanding context. It now has a Chat GPT-like interface, a standalone app, and powerful on-screen awareness to help get things done. Sadly, many of these features aren’t available in the EU.

Notes, Calendar, Reminders

AI is everywhere, including in Reminders Smart Suggestions, which can read your Messages chats and prompt you to set reminders for agreed tasks. Notes also gains Markdown copying.

Shortcuts to imagination

You can now create a shortcut just by describing what actions you want it to take. Apple Intelligence will string a shortcut together for you, which you can then use across all your systems.

Notify Me

Safari can watch a web page and automatically let you know when it changes. That’s not the only improvement; Apple Intelligence automatically groups your open tabs into topics so related pages are easier to find.

DIY: Safari extensions

I feel like this feature hasn’t had the attention it deserved, but you can now get Apple Intelligence to build you extensions in Safari. Just tap the three-line menu on the left of the address bar, choose Describe Extension, and let the fun begin.

Smarter Photos tools

Spatial Reframing is amazing; it lets you extend backgrounds and reframe subjects using AI. The upgraded Clean Up tool removes distractions even more easily than before. 

Passwords auto-fix

Apple’s Passwords app now does an even better job of keeping your online world safe, as it can now automatically visit a website to sign in and swap a weak or compromised password for a stronger one. 

Parental control improvements

Apple has really thought about child protection. Parental controls have had a huge overhaul, including the introduction of new Ask to Browse, Ask to Buy, contact calling approval and settings to protect minors against nudity, gore, and violence. These arrive alongside new scheduling function which manages which apps kids can use during school hours, meals, or bedtime.

Maps is amazing

Maps now uses aerial imagery and vision intelligence models when you use Flyover. It makes for much more detail, and a real sense of immersion.

Mail is better

While you’ll have to wait for search indexing to complete, Mail has become faster to load with better search results and more accurate unread counts. (Though that’s a little moot for this writer, who currently has 4,719 unread emails.) Spotlight has also been improved with smarter, more relevant suggestions. 

The new operating systems are expected to be made available at around 10am PDT. One more thing? They are bound to include security updates, which you likely need. 

Please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on Bluesky, LinkedIn, or Mastodon.

Microsoft’s September 2026 Patch Tuesday is the year’s largest release, with 963 CVEs requiring customer action, 106 rated critical. Two are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange. The Readiness team has published an infographic summarising deployment risk by product family.

Known issues

Three client issues are carried in from August close with this update, covering:

• Microsoft Teams and the new Outlook failing to launch on ARM devices, such as the Surface Pro 11 and Surface Laptop 7, is resolved by KB5124008. The issue originated in August’s KB5121003 and was most likely on freshly imaged machines that had not yet taken Microsoft Store updates.
• The same update resolved both desktop backgrounds reverting to solid black and mouse cursor customisation resetting on non-English installations. Both originated in the 27 August preview, KB5120998.

And Microsoft has left open a Microsoft Defender Antivirus notification defect, confirmed on 28 August, in which devices report that Defender is turned off while it is running correctly.

Major revisions and mitigations

The quietest revision window of recent months arrived alongside the largest release. Between the August and September Patch Tuesdays, from 12 August to 7 September, the MSRC Security Update Guide touched 324 CVEs. Of those, 307 were routine Microsoft Edge and Chromium republications requiring no customer action.

That leaves 17 entries affecting Microsoft’s own products, and only one of those is a genuine revision. CVE-2026-59133, an elevation of privilege in the High-Performance Computing Pack, moved to version 1.1, and its own revision note records the change as informational. For comparison, August’s window carried 76 revisions to Microsoft’s own products, 60 of them flagged as requiring customer action.

The Readiness team has reviewed all 963 published updates. Microsoft has published no mitigations and no workarounds anywhere in this release.

Windows lifecycle and enforcement updates

Microsoft has published no new service or enforcement deadlines for September. The lifecycle picture is different, with multiple end-of-support notices for this coming October:

• The retail Office 2021 family retires in full, including Access, Excel, Outlook, PowerPoint, Project, Publisher, Visio and Word.
• Office LTSC 2021 reaches end of support, and that includes Skype for Business LTSC 2021.
• Windows 10 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016 reach the end of extended support.
• Windows Server 2012 and 2012 R2 reach the end of Extended Security Update Year 3. This is the final ESU year for both, not a step to a fourth.
• Windows 11 Home and Pro version 24H2 reaches the end of updates.
• Windows Server 2022 moves from mainstream to extended support, where it stays until 14 October 2031.

A second wave follows on 10 November 2026, and it is the one most likely to catch development teams rather than infrastructure teams. .NET 8 reaches the end of its long-term support branch, PowerShell 7.4 does the same, and Windows 11 Enterprise and Education 23H2 ends servicing alongside Windows 11 IoT Enterprise 23H2.

Microsoft’s test guidance for this release runs to 466 Windows entries, 55 of them flagged as high risk, against 109 and four in August. Given the large number of updates this month (who would have thought that we would be here at 963 CVEs), the Readiness team recommends the following testing priorities:

• Printing. Print from 32-bit and 64-bit applications to physical and virtual printers, exercise XPS and PDF output, share a printer from a print server and print from a separate client, cancel a job mid-queue, and confirm the queue reflects every state change. This is 20 of the 55 high risk flags, and it is the single most likely source of a visible regression.
• Fonts, graphics and imaging. Render varied fonts, sizes and styles across browsers, Office, PDF viewers and Notepad, confirm Print Preview matches the printed page, and open JPEG, TIFF, HEIF and raw images across Explorer, Photos and Office. Watch for clipping, distortion and missing glyphs.
• USB Devices. Exercise device attachment and removal. Attach and remove USB audio, video and mass storage devices repeatedly, including through a hub, pair and unpair a wireless device, and confirm each enumerates and releases cleanly. Device Association carries seven high risk flags, and these drivers load whenever hardware is attached.
• Remote Desktop. Open several concurrent sessions, enable printer, clipboard, audio, drive and smart card redirection together, disconnect and reconnect, and confirm redirected devices reattach.
• Storage (ntfs.sys, spaceport.sys). This is a real hotspot for updates this month, but no high-risk changes. Test on hardware you can recover, because the storage changes reach the boot path, potentially resulting in a dead (test) machine.

Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.

Browsers

Microsoft has not released any updates for their browser products for the second month in a row. September’s Security Update Guide carries no Edge-specific CVEs at all, and the 307 Chromium republications in the revision window required no customer action. The nine Edge CVEs that did appear arrived mid-cycle on 28 August and were serviced through the browser’s own update channel rather than this release.

Estates on a managed Edge channel have nothing to do here beyond confirming the channel is current. It is the one quiet corner of an otherwise heavy month.

Microsoft Windows

Windows carries 726 CVEs, 77 of them critical, which is three-quarters of the entire release. Elevation of privilege dominates by volume at 406 entries, with remote code execution second at 156, information disclosure at 94 and denial of service at 47. The pattern is the reverse of the severity picture: the bulk is local elevation, while the critical-rated entries cluster in the network-facing roles.

• Biometrics is a real focus this month as the Windows Biometric Service takes 64 fixes, the largest single-component count of the year. Most of the security issues are heap overflows that give a local attacker SYSTEM. Windows Hello adds nine, all critical. Patch it promptly on any estate using fingerprint or facial sign-in.
• Windows DHCP Server leads at 36 entries and is topped by remote code execution at CVSS 9.8. Windows DNS Server takes 10 more, also reaching 9.8. Critical remote code execution also lands on Message Queuing, RRAS, Services for NFS, the HTTP Print Provider, Windows Shell, Netlogon, Internet Connection Sharing, SSTP and Failover Cluster, all at 9.8. Patch the resolvers, the DHCP servers and the domain controllers first.
• Storage is the heaviest it has been this year. NTFS takes 29 fixes, Spaceport.sys behind Storage Spaces takes 17, and the Overlay Filter takes seven, with the Volume Manager, VHD miniport, iSCSI and Storage Port drivers behind them. These reach the boot path, so stage them on recoverable hardware.
• The rest of the most-patched tally runs Win32k at 19, Microsoft Standard XPS at 18, Windows Error Reporting at 12, and the Windows Kernel, Windows Search, the Print Spooler and the Device Association Service at 11 each.

Add this Windows update to your Patch Now schedule, with DHCP and DNS servers first and the biometric stack close behind.

Microsoft Office

Microsoft released 137 Office CVEs this month, 24 of them critical, with remote code execution the through-line at 69 entries and information disclosure close behind at 52. September breaks the recent pattern in a way that matters for deployment: this wave is not MSI-only.

• Click-to-Run estates are squarely in scope. Roughly 105 of the Office CVEs reach Click-to-Run, so Microsoft 365 Apps, Office 2019, LTSC 2021 and LTSC 2024 all update, on Windows and on Mac. Word takes 35 fixes, Excel 32, PowerPoint 10 and Outlook seven. The heaviest client entries are CVE-2026-78510 in Word and CVE-2026-78509 in Outlook, both critical remote code execution at CVSS 9.8, in document-rendering paths that fire on preview or open.
• SharePoint Server Subscription Edition takes 16 entries and is the only SharePoint baseline with a package this month. Server updates cannot be uninstalled and always require a reboot, so validate in a maintenance window.
• Skype for Business Server takes 10 entries, led by CVE-2026-66302, a critical remote code execution at CVSS 9.8. Patch it and note that the LTSC 2021 edition leaves support on 13 October 2026.

Nothing in Office is exploited this month. With 24 critical-rated entries and the Click-to-Run channel carrying most of the exposure, the September Office updates belong on the Patch Now schedule regardless.

Microsoft Exchange and SQL Server

Exchange is quiet and SQL Server is not, which inverts the usual relationship between the two.

• Exchange Server takes nine CVEs across 2016 CU23, 2019 CU14 and CU15, and Subscription Edition. None is critical and none is exploited, though the highest reaches CVSS 9.3. The mix runs to two remote code execution entries, two elevations of privilege, two spoofing, and one each of tampering, denial of service and information disclosure. Apply the update from an elevated command prompt, because an un-elevated run leaves Exchange services partially patched and broken, then confirm mail flow, Autodiscover and any hybrid connection before returning the server to service.
• SQL Server takes 62 CVEs, four of them critical, across the 2017, 2019, 2022 and 2025 branches. There is no 2016 package this month. Remote code execution leads at 24 entries, with information disclosure at 22. The critical entries are CVE-2026-67631 and CVE-2026-67643 at CVSS 8.8, and CVE-2026-67378 and CVE-2026-67636 at 8.5.
• Eight SQL packages ship, a CU+GDR and an RTM+GDR for each branch: 2025 (KB5122769, KB5122770), 2022 (KB5122768, KB5122771), 2019 (KB5122772, KB5122773) and 2017 (KB5122774, KB5122775). Microsoft’s guidance is explicit that the baseline or RTM version must be installed first and the GDR patch applied on top; test the install and the removal on every servicing branch you run, then restart the service and confirm Always On availability groups stay healthy.

Exchange goes on the Schedule list, and SQL Server goes on the Patch Now list. That is an unusual split, and it is driven by the four critical remote code execution entries on the database estate.

Microsoft Developer Tools

Microsoft released 24 CVEs across its developer tooling this month, 23 rated important and one critical. Security feature bypasses are the main focus with eight CVE entries, with remote code execution and information disclosure at four each.

• The single critical entry is CVE-2026-34182 at CVSS 9.1, a flaw in CMS AuthEnvelopedData processing that allows forged messages to be accepted. It reaches Visual Studio 2017 through 2022.
• The highest-scoring entry in this family is not the critical one. CVE-2026-81376, a Visual Studio Code security feature bypass, reaches CVSS 9.6 while carrying an important rating. It is a useful reminder that severity labels and CVSS scores answer different questions.
• Visual Studio Code and its Copilot extensions take 10 entries, mostly security feature bypasses. Update the editor and confirm workspace trust prompts, extension installation and remote sessions behave as configured.
• .NET ships SDK updates on all three supported lines, x64 and x86: 8.0.131 and 8.0.425, 9.0.121 and 9.0.318, and 10.0.112 and 10.0.401. Install them, then build and run a representative project to check for regressions. Keep the 10 November date for .NET 8 in view while you are in there.
• The .NET Framework ships monthly rollups per operating system: Windows Server 2012 (KB5126147), Server 2012 R2 (KB5126148), Windows 10 1809 (KB5126144), 21H2 (KB5126145), 22H2 (KB5126146) and Server 2022 (KB5126149). One gap worth noting: the 4.7.2 package for Windows 10 1607 is listed as pending and will follow, so estates still on 1607 will not complete their Framework patching this cycle.

Add these to your standard release schedule, behind this month’s Windows, Office and SQL Server priorities. Keep the 10 November date for .NET 8 and PowerShell 7.4 in view while you are in the developer estate, because a patch this month does not extend either branch.

Adobe (and third-party updates)

September is the largest release of the year, and this (crazy, super high) volume is the least interesting thing about it. The 963 CVEs matter less than the 55 entries Microsoft flags as high risk, and those sit in printing and fonts. Adobe shipped two Acrobat builds one digit apart and only the second is a security update (nothing to worry about here). Of the CVEs Microsoft republished, 25 are not Microsoft’s. A version number tells you very little about the work in front of you. So, given my (super-secret knowledge) of how Microsoft operates over the summer, here is my prediction for next month (October). It won’t be as big as this month – but just you wait – November is going to be big. Let’s up those numbers (or not).

Long before Taco Tuesday became part of the pop-culture vernacular, Tuesdays were synonymous with security — and for anyone in the tech world, they still are.  Patch Tuesday, as you most likely know, refers to the day each month when Microsoft releases security updates and patches for its software products — everything from Windows to Office to SQL Server, developer tools to browsers.

The practice, which happens on the second Tuesday of the month, was initiated to streamline the patch distribution process and make it easier for users and IT system administrators to manage updates. Like tacos, Patch Tuesday is here to stay.

Patch Tuesday coverage has long been a staple of Computerworld’s commitment to provide critical information to the IT industry. That’s why we’ve gathered together this collection of recent patches, a rolling list we’ll keep updated each month.

In case you missed a recent Patch Tuesday announcement, here are the latest six months of updates.

September Patch Tuesday: 963 CVEs, 2 exploited flaws, 1 message

September’s Patch Tuesday is Microsoft’s biggest of 2026, with 963 CVEs, two exploited flaws and a clear message: prioritize Windows, Office and SQL Server.

Two vulnerabilities are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange.

Get more info on the September 2026 Microsoft security updates.

August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw

Microsoft’s August 2026 Patch Tuesday closes at 751 CVE entries (across all product families), with 108 rated as critical. One flaw is already exploited, CVE-2026-68820, an elevation of privilege in the Windows WinSock driver (afd.sys). Two more were disclosed but not exploited.

This security-only release earns Patch Now for Windows, Office and Exchange; no SQL Server updates this month. Unfortunately, several critical issues affect server roles: Windows DNS Server carries a cluster of critical RCEs; Windows DHCP Server is the most-populated Microsoft product family at 14 entries. Testing should lead with printing and fonts and the Remote Desktop client, then a WinSock smoke test given the exploited afd.sys flaw.

Get more info on the August 2026 Microsoft security updates.

July’s Patch Tuesday sees an end-of-support collision amidst a massive, record-setting patch wave

Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.

The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today.

More info is available here on Microsoft Security updates for July 2026.

For June, Patch Tuesday means an IT scramble

Microsoft this month released 206 updates affecting Windows, Office, Exchange Server, and its developer tools — including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.” 

Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.”

More info is available here on Microsoft Security updates for June 2026.

For May, Patch Tuesday means 139 updates — but no zero-days

Microsoft this month released 139 updates affecting Windows, Office, .NET, and SQL Server (though there were no updates for Microsoft Exchange Server). Despite the absence of zero-days, the May Patch Tuesday update still requires Patch Now recommendations for Windows and Office. 

The combination of three unauthenticated network RCEs (Netlogon, DNS Client, and SSO Plugin for Jira and Confluence), four Word Preview Pane RCEs, the large TCP/IP vulnerability cluster, and the carry-over BitLocker recovery condition (still active on Windows 10 and Windows Server) warrants an accelerated deployment release schedule. 

More info is available here on Microsoft Security updates for May 2026.

Microsoft’s Patch Tuesday release for April is a whopper

Windows admins are going to be busy this month, dealing with the largest Patch Tuesday cycle in memory. The April release involves 165 updates and roughly 340 unique CVEs from Microsoft — including two zero-days, one of which is already being actively exploited in the wild. 

The Readiness team recommends “Patch Now” schedules for nearly every major product family: Windows, Office (with a zero-day), Microsoft Edge (Chromium), SQL Server, and Microsoft Developer Tools (.NET). April also brings Phase 2 of Microsoft’s Kerberos RC4 hardening with full enforcement set for July. There is a lot to cover, so here’s a useful infographic mapping the deployment risk for each platform.

More info is available here on Microsoft Security updates for April 2026.

Qualcomm is taking an unusual approach to the launch of its next-generation premium Snapdragon mobile platform this year. Instead of holding everything for its annual Snapdragon Summit in Maui happening later this month, the company has been methodically disclosing the architecture that will power the next wave of flagship Android phones over the past couple of weeks.

First, the company disclosed its new Oryon CPU architecture, followed by a major overhaul of its Adreno GPU. Today, Qualcomm is detailing the next-generation Hexagon NPU that will serve as the platform’s primary AI engine.

Taken together, the disclosures give us a pretty good picture of where Qualcomm is going before we even know the chip’s official name.

There is obviously a strong performance story here, anchored by a 5GHz CPU, but the more interesting theme running through the architecture is memory locality and specialized AI acceleration. Qualcomm is trying to keep more data close to the compute resources that need it, while distributing AI workloads across the CPU, GPU and NPU.

These architectural changes are important as the company continues to drive on-device AI beyond relatively simple generative features toward more persistent, agentic workloads.

Oryon hits 5GHz, bolstered by FlexCache

Qualcomm disclosed in August that its next Oryon CPU will be the first mobile CPU to reach 5GHz. The eight-core design includes two 5GHz Prime cores and six Performance cores, with Qualcomm attributing the frequency gains to its fully custom Oryon microarchitecture, an in-house Arm-based CPU design that gives the company full control over the cores, cache and memory hierarchy, branch prediction and CPU subsystem.

The 5GHz headline is certainly going to get attention. However, Qualcomm’s new FlexCache architecture may ultimately have a larger impact on sustained performance. FlexCache allows Oryon’s Prime and Performance cores to tap into the same shared cache pool, with capacity dynamically allocated based on the workload. So rather than a demanding core being limited to a fixed slice of cache, it can draw on more of the available pool when needed. This keeps larger working data sets close to the CPU cores and reduces high-latency trips out to system memory.

This approach should benefit everything from gaming and multitasking to content creation, but it also aligns well with agentic AI workloads, where tasks may move through several stages of processing and across different CPU cores. The basic goal is straightforward: keep the CPU fed and avoid expensive trips to external memory.

Qualcomm’s next-gen Adreno GPU adds dedicated AI engines

Qualcomm’s next disclosure focused on graphics, where the company is making one of the more significant changes to its Adreno GPU engine in recent years. The new GPU adds dedicated Adreno Matrix Cores for running AI models directly inside the graphics pipeline. They’re paired with 18MB of Adreno High-Performance Memory, or HPM, which provides low-latency local storage for tile-based rendering, frame buffers and GPU compute.

Qualcomm claims HPM provides a 12% power improvement compared to its previous-gen Snapdragon 8 Elite Gen 5.

The more visible feature for users, however, may be Adreno Neural Fusion, which combines AI super resolution, neural processing and frame generation in a unified graphics pipeline. There are obvious parallels here to what NVIDIA, AMD and others are doing with neural rendering on the PC, though Qualcomm’s next-gen Snapdragon SoC has to operate within a much tighter mobile power envelope.

Qualcomm claims enabling Neural Fusion reduces power consumption by up to 40% in its internal testing using the company’s Dragon Alley graphics demo. That’s an impressive number, though as always, we’ll want to see how the technology behaves across actual shipping games and devices before drawing any definitive conclusions.

Qualcomm has also helped integrate Neural Fusion technology into Unity and Unreal Engine, which may ultimately be just as important as the underlying hardware. Developer adoption determines whether features like this become meaningful platform advantages or just another tick box on a spec sheet.

Qualcomm’s Hexagon NPU is being reworked for agentic AI

The most recent disclosure centers on Qualcomm’s Hexagon NPU, where the broader architecture starts to come together. The company’s next-generation Hexagon introduces a new Element Accelerator designed for transformer workloads, alongside its existing vector and scalar processing resources. Qualcomm says the new block is optimized for fast action loops, key-value (KV) cache acceleration and context lengths of up to 32K.

Hexagon is also getting 50% more shared memory, and again, that memory complement is important. Model state, context and KV-cache data can generate substantial memory traffic, particularly with larger language models. Keeping more of that data close to the NPU can reduce latency and power consumption. Qualcomm says the architecture is designed for long-context reasoning, multimodal models, concurrent agents and low-latency action loops.

For INT4 quantized models, the company claims up to a 50% improvement in pre-fill performance versus its previous-generation Snapdragon 8 Elite Gen 5. Qualcomm is also targeting Mixture-of-Experts, or MoE, models as large as 30 billion parameters. In its example, the company points to a 30B model that activates only about 3 billion parameters during a given token-generation step. That selective approach is a natural fit for the tight power and memory constraints of a handset.

Qualcomm isn’t suggesting that a smartphone will simply run a 30B dense model entirely from DRAM, however. By activating only the experts needed for a particular task, MoE architectures can dramatically reduce active compute and memory bandwidth requirements, potentially making much larger classes of AI models practical on mobile hardware.

Qualcomm’s next-gen Snapdragon mobile impact

There is a larger competitive story here as well. For years, flagship smartphone competition largely came down to CPU, GPU, modem performance and power efficiency. AI is now another major area of differentiation, and Qualcomm is clearly designing its next-gen Snapdragon mobile platform around this need.

Apple has the advantage of controlling its silicon, operating system and software stack end-to-end. MediaTek continues to push aggressively into premium Android devices as well. Qualcomm’s response is to make its custom Oryon CPU, Adreno GPU and Hexagon NPU work more like a fully integrated compute platform, tuned for modern AI and agentic workloads.

This is a solid advantage for Android handset OEMs because many don’t have the resources to engineer this level of silicon integration themselves. Qualcomm can effectively provide its Android OEM partners, including Samsung, Xiaomi, Honor and others, with a common hardware foundation for on-device AI, advanced graphics and agentic computing. It also gives Qualcomm another way to defend its premium Snapdragon position.

The company’s custom Oryon architecture now spans smartphones and Windows PCs, and soon servers, while AI acceleration is distributed across its CPU, GPU and NPU. For business users, that could mean more AI processing happens locally, reducing cloud and network dependence, improving response times and keeping more potentially sensitive data on-device. And for IT organizations, Qualcomm now has an opportunity to provide a more consistent AI compute foundation across Windows PCs with Snapdragon X and premium Android handsets.

There is still plenty we don’t know, however. Qualcomm hasn’t disclosed the complete SoC specifications, final performance or power characteristics, or which devices will ship with it initially. Many of these AI experiences will also depend heavily on Android, app developers and the models themselves.

The new 5GHz mobile CPU may generate the biggest headline at Snapdragon Summit, but the more important developments may be what sit around it: more local memory, specialized AI acceleration and tighter integration between the CPU, GPU and NPU.

If Qualcomm can translate this architecture into better sustained performance, enhanced power efficiency and useful on-device AI experiences, it could strengthen its position in premium Android phones while putting more competitive pressure on Apple. For business users, the payoff could be more capable local AI without sacrificing the performance and battery life expected of a flagship device.

That is the part I’ll be watching most closely when the complete silicon picture is unveiled at Snapdragon Summit later this month. And I may even get some hands-on time with it in some benchmarks, as we have in years past, so we shall see.

Traditional operating systems (OS) were built to manage hardware, files, apps, and users on a device, but Cloudflare says the agentic AI era requires a whole new format.

The company this week announced Cloudflare OS, which connects AI agents, enterprise data and context, internal systems, and workflows together in one secure workspace. It is open source and browser-based, sparing companies the need to build all-new infrastructure.

The OS is launching alongside several other new security, identity, spending, and user insight tools that Cloudflare has built for the AI-based workplace.

“Cloudflare OS isn’t a traditional desktop OS,” said Rita Kozlov, VP of product at Cloudflare. “It reimagines the workplace computing environment for AI.”

Open source OS runs in a browser

Cloudflare OS serves as a secure, AI-equipped workspace that is plugged into internal company systems. Available now through Cloudflare’s open source repository, it is accessible directly in a browser, and runs inside an enterprise’s Cloudflare account.

“It is a browser-based workspace that begins with a conversation,” Kozlov explained. Users can ask an agent to research, create slides, spreadsheets, and documents, build full-stack apps, or automate workflows without the need for a terminal. Those outputs are then shareable, but kept in isolated databases with access controls.

Enterprises will soon be able to access the OS directly through Cloudflare or via a “select group” of partners that will build tailored offerings on Cloudflare’s architecture, the company says. Because it is open source, organizational processes, internal system connections, and context aren’t locked into a vendor product or AI model provider. Customers can use whatever models they choose.

Cloudflare OS is built on Cloudflare Workers, Dynamic Workers, Durable Objects, and Access, the company’s zero trust network access (ZTNA) tool that verifies every user and request. Agents start with zero permissions by default and are only granted access to tools required for a specific task. Organizations configure their own Access policies, models, branding, skills, and integrations, Kozlov explained.

Governed connectors known as gatekeepers give admins control over what AI can see, what it can change, and when the system needs human sign-off. They can also control budgets, set rate limits, and delegate tasks to different models.

“Because agents act on people’s behalf and produce work others can access and modify, they require a new security model,” Kozlov said. Thus, Cloudflare OS tracks the resources an agent requires so the right access controls follow its work when it is shared.

Cloudflare initially built the OS for internal use, and employees “across every team” use it daily. Kozlov estimated that, over the last 30 days, internal users have used it to create more than 4,000 apps, automations, and tools. Over that same period, she claimed, the company’s sales team saved an estimated 10,000 hours by automating previously manual tasks like territory planning and proposal creation.

“We open sourced Cloudflare OS so any organization can build ‘Your Company OS,’” Kozlov said. Open source is critical because “you cannot put your company into software you do not own. Organizations need to be able to inspect the platform, customize it, connect their own systems, and make it their own,” she explained.

A more cohesive bundle

Cloudflare deserves credit for packaging Cloudflare OS as an operating system, noted tech analyst Carmi Levy.

“This very much is not Windows, macOS, or Linux, and it isn’t an operating system by its common definition,” he said. “But Cloudflare’s use of this terminology implies familiarity to enterprise IT buyers.”

This makes for an easier discussion as enterprises struggle to understand how to best incorporate AI-related platforms and workflows into infrastructure that wasn’t initially designed for it.

Microsoft has marketed the combination of its Azure, Entra, Fabric, Windows, and Microsoft 365 offerings as an operating system of sorts, but hasn’t pulled all the pieces into a common brand, Levy said. And Google’s Gemini, Workspace, Vertex AI, and Cloud Run are “circling similar territory.”

But, he noted, Cloudflare OS is “more cohesively bundled” and infrastructure-focused, offering a single pane of glass platform for buyers worried about stitching together otherwise disparate AI-aware networking pieces. The company recognizes that AI introduces new architectural realities such as inference and model routing “over and above” traditional OS core competencies.

“While competing offerings generally leave the infrastructure heavy lifting to enterprise decision-makers, Cloudflare is marketing itself as a single-source vendor, which potentially frees IT planners from having to integrate all the AI pieces on their own,” Levy said.

An infrastructure-first, application-agnostic approach means Cloudflare OS can coexist with whatever AI applications already exist in an enterprise, he said. It will “play nice” with OpenAI, Anthropic, Google, Microsoft, Meta, or open source layers, allowing employees to begin working in familiar workflows after sign-in.

“Its open-source architecture also minimizes the potential for vendor lock-in as enterprises gradually figure out how to evolve their stacks to align with new AI-era realities,” Levy said.

Managing identities and budgets for both humans and AI

As AI agents emerge across the enterprise, tracking their use can be challenging, causing problems from both a security and a spend standpoint. Along with Cloudflare OS, the company has launched a way to address this issue with its new Identity-Aware AI Gateway, now in beta.

Also integrated with Access, the offering gives admins visibility into what users (both human and AI) are requesting from AI models. It allows security teams to set up custom domains in front of their gateways and replace shared API keys by integrating with their identity provider, like Okta or Entra, and ZTNA infrastructure, Cloudflare explained.

Every request is tied to Access-verified identities, and enterprises can filter each user’s logs, analytics, and spend. IT teams can track redundancies, limit usage rates, and apply filters that strip out employee names, passwords, and other sensitive data before requests go to outside model providers.

A companion feature, AI Spend, tracks every user’s behavior over time to create a baseline of normal AI usage. When spending deviates from that pattern, the system alerts the IT team.

A new tab, User Insights, tracks cost and identifies over-spend caused by activities such as low cache-hit rates or oversized context windows. The capability scores sessions and compares them against account history using a 95th percentile session cost over the previous 30 days, Cloudflare product managers Ming Lu, Kenny Johnson, and Ayush Kumar explain in a blog post. Anything above 2x an account’s 95th percentile is a “strong candidate for anomalous behavior.”

For instance, one Cloudflare customer had an employee who left a rogue AI session running, generating a $30K bill. “User Insights helped them identify the problem and shut off access before the problem was further exacerbated,” Kozlov said.

Cloudflare is also building prompt classification functionality that sorts requests into categories such as coding or writing. This can help enterprises understand what AI is being used for.

“Once business traffic is separated from everything else, personal use becomes visible,” the project managers explained. “From the outside, someone running a side hustle on company time and someone quietly moving data out through a model look the same. Telling them apart is central to catching insider risk.”

Looking at the bigger picture

Identity-Aware AI Gateway and AI Spend address the visibility problem that has dogged so many recent AI deployments where enterprises failed to monitor usage, Levy noted. Projects “crashed and burned” as users unwittingly blew through token allocations.

These platforms provide single-point visibility into what is being used, how it’s being used, and where the potential lies for raising the productivity bar, he said. They overlay with existing models; in doing so, they enhance security with more precise control over resource allocations, and via automated anonymization protocols that prevent inadvertent sharing of sensitive data.

Ultimately, he said, vendors who free IT from having to independently assemble the pieces of their own AI implementations, and who assist them with answers to AI-specific questions, “will gain advantage over vendors that aren’t looking at the bigger picture.

This article originally appeared on CIO.com.

This fall, with watchOS 27, Apple Watch will finally get access to Siri AI with a software update that turns your wrist into the most widely-used wearable AI platform on Earth.

That’s not hyperbole. Siri AI on Apple Watch is arguably the most important feature to this year’s watchOS update. Though it didn’t get much attention at WWDC, the update also offers a preview into how Apple will wrap AI into its future smart glasses.

What to expect

One important caveat is to observe that Siri AI on Apple Watch still requires your Apple Intelligence-enabled iPhone to do the heavy lifting. The interaction is easy: tap the Digital Crown and Apple’s new glowing icon appears on screen (you’ll also find this in the App viewer). The experience looks identical across every Apple device — iPhone, iPad, Mac, Apple Watch, and Vision Pro — making the assistant feel like one consistent product rather than a different experience per device.

The Siri app lets you access all your past Siri conversations (unless you turn that feature off) and pick up an old conversation right where you left off. Conversation history syncs privately through iCloud, so you can start an exchange on your iPhone and continue it later from your wrist. You can also pin a conversation you expect to revisit.

You can also use Siri on the Apple Watch to ask questions, launch apps, or even get more complex responses, such as step counts on a specific day. It can also answer difficult and specific queries with detailed answers and can summon real-time information from the web.

Personal context is the real story

That’s key, of course, as it means the smartwatch on your wrist can help you access specific details from all your contextual information; it can get details from messages, emails, and notes, for instance. Or you might use it to find a number and call it, access your door code, or look up customer information for business — all without touching your phone.

One of Apple’s own examples demonstrates this well: Saying, “Show me photos from when I went to Spain,” results in precisely that. You can also ask follow-up questions and keep the conversational going naturally, rather than being confined to single, isolated commands.

Beyond personal data, the watch can also act in apps — get directions home, send an email, play a playlist, or even more specifically, “Play the song that Brandon sent me.”

Context runs deep. A new Call Context tool can proactively surface relevant information from across your apps when phoning a business or help locate a confirmation code from Mail while calling an airline. This arguably challenges a real pain point when speaking with providers and is a good illustration of Apple’s broader AI strategy: to use on-device intelligence to remove everyday friction without asking you to track down the information yourself.

Where we are, where it’s going

It’s frustrating that you still can’t use the Watch to remotely run applications on your Mac, iPhone, or iPad. What you can do is trigger Shortcuts that run on your iPhone: enable this first on your phone by selecting the Shortcut you want and switching on “Show on Apple Watch.” Once that’s done, you can run the Shortcut from your wrist, even by voice.

That’s useful now, but as more complex apps add Shortcuts support and App Intents become more widely adopted by developers, it should be easy to trigger genuinely complex, multi-stage tasks on your iPhone from your wrist.

It’s worth noting: early hands-on testing of the watchOS 27 beta has found Siri AI genuinely impressive on personal-context queries, but still buggy in places. This is very much a first-generation feature — promising, but not yet fully reliable.

Watch the developers

Developers are already beginning to experiment with the potential for wearable AI. One of the best current examples is Granola, which just launched a Watch app built specifically to take notes during in-person meetings away from a laptop. The idea is that you tap your wrist, the screen turns green and makes a sound to alert your companion(s) that it is recording and then you carry on as normal. Once the meeting stops, switch the app off and you’ll get polished notes with meeting summaries and action items provided to you.

The only reservation I have with Granola is the lack of documentation on privacy and data retention on the developer site. Tools like these will almost certainly become more private, more secure, and more prevalent once Apple’s on-device dictation APIs extend fully to watchOS.

That last thing is perhaps the most important as wearable AI emerges: the decisions Apple makes around watchOS and SiriAI will be foundational to its future wearable AI glasses products.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and subscribe to The Core.

Long before Taco Tuesday became part of the pop-culture vernacular, Tuesdays were synonymous with security — and for anyone in the tech world, they still are.  Patch Tuesday, as you most likely know, refers to the day each month when Microsoft releases security updates and patches for its software products — everything from Windows to Office to SQL Server, developer tools to browsers.

The practice, which happens on the second Tuesday of the month, was initiated to streamline the patch distribution process and make it easier for users and IT system administrators to manage updates.  Like tacos, Patch Tuesday is here to stay.

In a blog post celebrating the 20th anniversary of Patch Tuesday, the Microsoft Security Response Center wrote: “The concept of Patch Tuesday was conceived and implemented in 2003. Before this unified approach, our security updates were sporadic, posing significant challenges for IT professionals and organizations in deploying critical patches in a timely manner.”

Patch Tuesday will continue to be an “important part of our strategy to keep users secure,” Microsoft said, adding that it’s now an important part of the cybersecurity industry.  As a case in point, Adobe, among others, follows a similar patch cadence.

Patch Tuesday coverage has also long been a staple of Computerworld’s commitment to provide critical information to the IT industry. That’s why we’ve gathered together this collection of recent patches, a rolling list we’ll keep updated each month.

In case you missed a recent Patch Tuesday announcement, here are the latest six months of updates.

July’s Patch Tuesday sees an end-of-support collision amidst a massive, record-setting patch wave

Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.

The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today. The Readiness team has provided a handy infographic of the expected risk profile of this month’s Patch Tuesday updates.

More info is available here on Microsoft Security updates for July 2026.

For June, Patch Tuesday means an IT scramble

Microsoft this month released 206 updates affecting Windows, Office, Exchange Server, and its developer tools — including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.” 

Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.”

More info is available here on Microsoft Security updates for June 2026.

For May, Patch Tuesday means 139 updates — but no zero-days

Microsoft this month released 139 updates affecting Windows, Office, .NET, and SQL Server (though there were no updates for Microsoft Exchange Server). Despite the absence of zero-days, the May Patch Tuesday update still requires Patch Now recommendations for Windows and Office. 

The combination of three unauthenticated network RCEs (Netlogon, DNS Client, and SSO Plugin for Jira and Confluence), four Word Preview Pane RCEs, the large TCP/IP vulnerability cluster, and the carry-over BitLocker recovery condition (still active on Windows 10 and Windows Server) warrants an accelerated deployment release schedule. 

More info is available here on Microsoft Security updates for May 2026.

Microsoft’s Patch Tuesday release for April is a whopper

Windows admins are going to be busy this month, dealing with the largest Patch Tuesday cycle in memory. The April release involves 165 updates and roughly 340 unique CVEs from Microsoft — including two zero-days, one of which is already being actively exploited in the wild. 

The Readiness team recommends “Patch Now” schedules for nearly every major product family: Windows, Office (with a zero-day), Microsoft Edge (Chromium), SQL Server, and Microsoft Developer Tools (.NET). April also brings Phase 2 of Microsoft’s Kerberos RC4 hardening with full enforcement set for July. There is a lot to cover, so here’s a useful infographic mapping the deployment risk for each platform.

More info is available here on Microsoft Security updates for April 2026.

For March, Patch Tuesday delivers fixes for 83 vulnerabilities

Microsoft’s March Patch Tuesday release addresses 83 vulnerabilities across Windows, Office, SQL Server, Azure, and .NET — with two publicly disclosed zero-days affecting SQL Server and .NET (though neither is being actively exploited in the wild.) Six additional vulnerabilities spanning the Windows Kernel, Graphics Component, SMB Server, Accessibility Infrastructure, and Winlogon are flagged as “Exploitation More Likely.”

The most significant change this month is the introduction of Common Log File System (CLFS) hardening with signature verification, which will affect how Windows handles log files across the operating system. More info on Microsoft Security updates for March 2026.

February’s Patch Tuesday release fixes 59 flaws, including 6 being exploited

The company’s Patch Tuesday release for February addresses 59 CVEs across the company’s product family — roughly half the volume of January’s 159 patches. Six vulnerabilities, affecting Windows Shell, MSHTML, Desktop Window Manager, Remote Desktop, Remote Access, and Microsoft Word, are already being actively exploited. (All five Critical-rated CVEs target Azureservices rather than Windows, however.) 

Both Windows and Office get a “Patch Now” recommendation, with CISA setting a March 3 enforcement deadline for all six exploited vulnerabilities. Two new enforcement timelines also take effect in April: Kerberos RC4 deprecation (CVE-2026-20833) and Windows Deployment Services hardening (CVE-2026-0386). More info on Microsoft Security updates for February 2026.

Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.

The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today. The Readiness team has provided a handy infographic of the expected risk profile of this month’s Patch Tuesday updates.

(More information about recent Patch Tuesday releases is available here.)

Known issues

The July release note flags known issues against the following updates:

• BitLocker recovery prompt on first restart – the PCR7 recovery condition tracked since April remains live on the platforms that did not receive the Boot Manager servicing fix (Windows Server 2022 and Windows 10 22H2). Devices with BitLocker on the OS drive, the Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” set with PCR7 included, and Secure Boot State PCR7 Binding reported as “Not Possible” may be prompted for the recovery key on the first restart after installing this update. This month’s publicly disclosed BitLocker security feature bypass (CVE-2026-50661) keeps the component in focus.

• WSUS synchronization error details suppressed (Windows Server 2025 and 2022) – WSUS no longer displays synchronization error details in its error reporting, a deliberate change made to address the Remote Code Execution Vulnerability CVE-2025-59287. Sync still works, but administrators triaging a failed synchronization lose the detail pane and must fall back to the SoftwareDistribution logs.

Windows Update can still replace manually installed graphics drivers with older OEM versions from the catalogue (the four-part Hardware ID ranking issue acknowledged on the Hardware Dev Center). The two-part HWID pilot runs to September 2026.

Major revisions and mitigations

Between the June and July Patch Tuesdays, MSRC Security Update Guide notices updated 651 reported CVEs across six notification dates (15, 19, 26 June and 3, 8, 11 July), 532 of them routine Chromium upstream re-publications. Of the roughly 30 Microsoft revisions, almost all were cross-platform Office catch-up with no bearing on a Windows enterprise estate. No further action required for IT administrators for this Windows update cycle.

Windows lifecycle and enforcement updates

This is the deadline cycle June pointed at. The July end-of-support wave lands today, and it collides with the month’s heaviest patching. SharePoint and SQL Server take some of their most active security updates ever on platforms receiving their last.

• SharePoint Server 2016 and 2019, Project Server 2016 and 2019, SQL Server 2016 and InfoPath 2013 have all reached end of support. SQL Server 2014 ESU Year 2 reaches end of support today. SharePoint 2016/2019 take an actively exploited zero-day and two RCEs this cycle, and SQL Server 2016 takes a critical RCE, all as their final security update. Now is the time to get moving on updating these platforms.

The 2011 Secure Boot certificate expiries have now passed; devices that never took the Windows UEFI CA 2023 key updates under CVE-2023-24932 can no longer receive updated boot components, with the Windows Production PCA for the boot manager still ahead on 19 October 2026. Kerberos RC4 hardening (CVE-2026-20833) has been in enforcement since April 2026; the July 2026 update removes the RC4DefaultDisablementPhase rollback control that let administrators defer it, making enforcement final.

Microsoft’s July 2026 Patch Tuesday is a security-only release: 180 test-guidance entries, 14 of them high risk (June had one). Printing and graphics are the centre of gravity: win32kfull.sys, the kernel-mode window manager, is the most-patched binary (14 entries), and seven high-risk flags sit alongside it – the Print Spooler, four win32k entries, and two GDI+ metafile entries. NTFS is the second theme, with 10 entries, two high risk. Every entry reports no functional changes – it’s pure regression validation. The packages span Windows 11 26H1 back to Server 2012 ESU.

Printing and graphics (high risk)

The Print Spooler flag centres on shared printers, whose queue status must track jobs accurately; the win32k flags cover 32-bit application printing, font rendering in printed and exported output, on-screen rendering, and window management; the GDI+ flags cover metafiles.

• Share a printer from a print server, print from a separate client in varied sizes and formats, and cancel a job, confirming the queue reflects every state change
• Print from your 32-bit applications, and print text-heavy, graphics-heavy, and multi-page documents to physical and virtual (PDF or XPS) printers, repeating after orientation, scaling, and resolution changes
• Export documents with varied fonts to PDF and confirm fonts and layout survive; render EMF+ files that apply effects to very large images, and convert EMF files to WMF
• Open and close windows rapidly, drive common dialogs by mouse and keyboard, and close parents with children open – no orphaned windows

Storage and file systems (high risk)

Both NTFS high-risk flags target integrity – extended attributes, and volume recovery after an unexpected shutdown. File History carries its own high-risk flag on clients. A Windows Server 2025-only bundle across boot, BitLocker, and ReFS demands the full Secure Boot/BitLocker matrix. Eight entries hit Server 2025 alone, including WSL, GPU partitioning, and a scripted Windows Server Backup pass repeating recovery after rolling the date 90 days forward.

• Exercise NTFS extended attributes – older-system EAs, backup workflows that preserve them, concurrent same-file operations where supported – with antivirus, encryption, or storage filters active
• Simulate an unexpected shutdown during file activity, verify the volume mounts intact, run chkdsk, and confirm indexing, shadow copies, and backup still work
• Run a full File History pass: back up, modify and back up again, exclude folders, change frequency, move the destination
• On Server 2025, boot all four Secure Boot/BitLocker combinations, in standard and confidential VMs where supported

Devices, input and networking (high risk)

Three further high-risk flags land here: HID input (hidparse.sys with win32k) – touch, keyboard, mouse, touchpad, through disconnects and restarts; the WinSock bundle (afd.sys plus Bluetooth and multicast drivers); and IrDA. The heaviest ask is not high risk at all: the NetAdapterCx driver (24H2/25H2, Server 2025) wants 500-plus adapter enable-disable cycles under Driver Verifier.

• Run the connectivity suite: browsing, large downloads, mapped drives, an RDP session idle 30+ minutes, a Teams call, an hour of streaming, and localhost apps such as Docker or WSL
• Stress Bluetooth: pairing, 10+ minutes of audio, input after idle, and reconnection after sleep
• Where infrared hardware exists, transfer a file and run at least 100 connect-disconnect cycles
• Sweep the rest: DNS Server (zone data must stay under its configured database directory), the client resolver (five entries), DHCP Server (five entries), SMB, NFS, Message Queuing (five entries), RRAS administration, client VPN, and WinHTTP/WinINet consumers

Other windows components

Windows Installer itself is patched: testing should include application install, uninstall, repair, and force a rollback. Hyper-V wants virtual-switch traffic as part of its testing exercises with Virtual Filtering Platform policies enforced. Sixteen media-related security entries cover playback, HEVC and MPEG-TS, USB audio, and MIDI 2.0.

Shell hardening and LSA isolation

These two entries are a little different from the rest of the cycle: they ask you to confirm a security behaviour actively works, not just that nothing regressed. A pass here means the protection fired, so treat them as functional checks rather than box-ticking.

• Shortcut handling (windows.storage.dll; Windows 11 23H2 and earlier, plus Server 2022): drop a shortcut file carrying the Mark of the Web into a folder and confirm the system refuses to extract its icon and leaks no NTLM credential hash – include the zero-click paths, where the icon would otherwise render without you opening anything
• LSA isolation and KeyGuard (24H2/25H2, Server 2025): run the supplied PowerShell validation script, which turns on Virtualization-based Security if it isn’t already, exercises KeyGuard key operations in both required and best-effort isolation modes, and reports pass or fail – it needs TPM 2.0, UEFI with Secure Boot disabled, and PowerShell 7
• Run that script on a dedicated test machine, never a shared one: it enables test signing, disables automatic updates, and reboots without asking

Office & SharePoint

July’s Office wave is security-only; everything landed on 14 July, and nothing critical or non-security shipped in the 7 July preview. It’s an MSI-only cycle, so Click-to-Run estates can sit this one out.

• On MSI Office 2016, apply the client updates – Excel (KB5002886), Word (KB5002890), PowerPoint (KB5002867), and five further Office 2016 security updates (KB5002273, KB5002887, KB5002748, KB5002857, KB5002830) – then exercise macros, external data, embedded objects, and any line-of-business add-ins
• On SharePoint Server, patch 2016 (KB5002891, plus the KB5002892 language pack) and Subscription Edition (KB5002882), then check browser-based editing; the guidance lists SharePoint 2019 with a baseline but ships no 2019 package, so there is nothing to install there

Mind the rollback rules before you schedule the window: most client updates can be uninstalled, but the server updates cannot and always require a reboot.

Developer tools & databases

The developer estate gets a broad but low-drama sweep this month. Both .NET and SQL Server patch widely, but the ask is representative-application validation rather than anything exotic – install on the matching branch and confirm normal behaviour.

• .NET: install the SDK updates (8.0.423, 9.0.316, 10.0.302, x64 and x86) and the Framework rollups spanning 3.5 through 4.8.1 – which reach from Windows Server 2012 up to Windows 11 26H1 and Server 2025 – then run a representative set of applications and confirm they function normally
• SQL Server: the GDR updates span 2016 SP3 through 2025 – install each on its matching branch and test that each removes cleanly
• Check an encrypted client connection through the separately patched Windows SQL client (dbnetlib.dll), which ships outside the server branches

The Readiness team recommends the following priorities for your larger enterprise deployments:

• Start with printing and graphics: half the high-risk flags sit in the Print Spooler, win32k, and GDI+, so regress shared printers, 32-bit printing, PDF export, metafiles, and window management before anything else
• Take NTFS next – extended attributes and crash recovery both touch data integrity – and add a client File History backup-and-restore pass
• Give Server 2025 its wider matrix – the Secure Boot/BitLocker combinations, WSL, GPU partitioning, and the scripted backup pass – and work through the stress suites
• Run the scripted KeyGuard validation on any VBS estate, preferably on a dedicated machine.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

• Browsers (Microsoft IE and Edge)
• Microsoft Windows (both desktop and server)
• Microsoft Office
• Microsoft Exchange and SQL Server
• Microsoft Developer Tools (Visual Studio and .NET)
• Adobe (if you get this far)

Browsers

Edge has had a busier month than usual. Microsoft addressed 46 Microsoft Edge (Chromium-based) CVEs this cycle. None critical, but heavily weighted to remote code execution (21 entries) and spoofing (13), led by CVE-2026-58289, a remote code execution flaw. A run of further RCEs (CVE-2026-57981, CVE-2026-56645, CVE-2026-57974) follows.

• Microsoft Edge – the Edge-specific fixes ship in the Edge stable channel (version 150.0.4078.65, released 9 July). The concentration of RCE and spoofing this month is worth a look for managed Edge estates rather than a routine wave-through.
• Chromium upstream – 427 CVEs relayed through MSRC this cycle, spanning the weekly Chrome release cadence since the June report: use-after-free, out-of-bounds read/write, type confusion, and inappropriate-implementation flaws across V8, Dawn, ANGLE, Skia, and Tint. The same fixes ship in the Chrome Stable channel; see the Chrome releases blog for the upstream notes.

The Chromium volume looks (quite) alarming but is routine plumbing: it flows to Edge through its own auto-update channel. Add these browser (Edge) updates to your standard release schedule for your managed environments.

Microsoft Windows

Windows carries the bulk of this month’s updates: 406 CVEs, 31 rated critical and 374 important. Elevation of privilege dominates by volume (226 entries), followed by remote code execution (70), information disclosure (70), denial of service (23), and a scatter of security-feature-bypass, tampering, and spoofing entries across the following feature groupings:

• DHCP – the standout network cluster: DHCP Server remote code execution (CVE-2026-50518, “Exploitation More Likely,” and CVE-2026-56159), with further critical DHCP Server and DHCP Client RCEs behind them (CVE-2026-48564, CVE-2026-50370, CVE-2026-54128). DHCP servers are the deployment priority.
• VMSwitch and Hyper-V – the Windows VMSwitch elevation of privilege (CVE-2026-57092) is one of the month’s highest-severity flaws, joined by two critical Hyper-V elevation-of-privilege entries (CVE-2026-50680, CVE-2026-54127), guest-to-host risk on virtualisation hosts.
• Network stack RCE – a Windows Server Network driver RCE (CVE-2026-56188, “Exploitation More Likely”), plus TCP/IP (CVE-2026-54999), the Reliable Multicast Transport Driver (CVE-2026-54982), and SSTP (CVE-2026-50694).
• Graphics – Windows GDI+ remote code execution (CVE-2026-50380) and a DirectX Graphics Kernel RCE (CVE-2026-50382), both reachable through document-rendering paths.
• Windows Media – a large cluster: three critical Media Foundation RCEs (CVE-2026-57090, CVE-2026-57094, CVE-2026-57087) lead 14 Windows Media and seven Media Foundation entries overall.
• Identity infrastructure – beyond the exploited ADFS flaw, Active Directory Domain Services takes a critical RCE (CVE-2026-49164) and Active Directory Certificate Services a critical elevation of privilege (CVE-2026-54121). Domain controllers take priority again.
• Print Spooler, WSUS, and MSMQ – critical RCE/EoP in the Print Spooler (CVE-2026-58608), Windows Server Update Services (CVE-2026-50444), and Message Queuing (CVE-2026-54992, “Exploitation More Likely”), all server-role attack surface.

The Windows Kernel is the most-patched component (28 CVEs, seven “More Likely”), followed by NTFS (21), Windows Runtime (17), Windows Media (14), ReFS (12), and Win32k (15 across its two entries). Add this Windows update to your Patch Now deployment schedule.

Microsoft Office

Microsoft released 96 Office CVEs this month: 19 critical, 76 important. Remote code execution leads (53 entries), ahead of information disclosure (27) and spoofing (10). SharePoint is the centre of gravity: it touches 39 of the 96 CVEs and supplies the family’s one actively exploited flaw.

• SharePoint Server: has been exploited (who would have guessed) and reaches end of support today. CVE-2026-56164, an elevation of privilege, is under active exploitation. Above it sit two critical remote code execution flaws, both “Exploitation More Likely” (CVE-2026-50522, CVE-2026-58644) and a critical security feature bypass (CVE-2026-55040). SharePoint Server 2016 and 2019 reach end of support on 14 July, so this exploited, critical-heavy set is the final security update those on-premises farms will receive.
• Office has experienced a long run of critical remote code execution entries across Office, Word, and PowerPoint (among them CVE-2026-55033 and CVE-2026-55127 in Word, CVE-2026-55043 in PowerPoint, and CVE-2026-55018 in Office), topped by CVE-2026-55045.

With an exploited zero-day, two RCEs, and an end-of-support deadline all landing on SharePoint in the same cycle, SharePoint environments are the priority. Add the July Office and SharePoint updates to your Patch Now schedule.

Microsoft Exchange and SQL Server

Both Exchange and SQL Server carry critical-rated security vulnerabilities this month. Exchange Server returns with an on-premises security update for Exchange Server Subscription Edition, the only on-premises release still supported after Exchange Server 2016 and 2019 reached end of support in October 2025; SQL Server takes two critical remote code execution flaws, one of them against SQL Server 2016, which reaches end of support on the same day.

• Exchange Server (on-premises) – CVE-2026-55008, a spoofing vulnerability rated critical and “Exploitation More Likely,” is the headline. Behind it, a remote code execution entry (CVE-2026-55005) and two elevation-of-privilege flaws (CVE-2026-55006, CVE-2026-55009) round out the on-premises set. A separate Exchange Online elevation of privilege (CVE-2026-54998, critical) is fixed service-side with no customer action.
• SQL Server – two critical remote code execution flaws: CVE-2026-54117 (SQL Server 2025) and CVE-2026-54118 (which reaches back to SQL Server 2016 SP3), with five further important elevation-of-privilege and information-disclosure entries behind them. The 2016 exposure matters because SQL Server 2016 reaches end of support on 14 July: a critical RCE on a platform taking its final update.

Both belong on the Patch Now schedule this month: the Exchange on-premises update for its critical spoofing flaw, and the SQL Server update for the two critical RCEs.

Microsoft developer tools

Microsoft released 24 CVEs across its developer tooling this month, all rated important. The weighting shifts from last month’s Visual Studio Code concentration toward .NET and ASP.NET Core, where a run of denial-of-service entries dominates the volume:

• ASP.NET Core and .NET – the two highest-severity entries are ASP.NET Core elevation-of-privilege entries (CVE-2026-47300, CVE-2026-47303), ahead of a .NET security feature bypass (CVE-2026-50528) and two .NET / .NET Framework remote code execution flaws (CVE-2026-50646, CVE-2026-50649).
• Visual Studio and VS Code – a GitHub Copilot / Visual Studio Code security feature bypass (CVE-2026-41109) and a second VS Code security feature bypass (CVE-2026-57102) lead here, with a VS Code remote code execution entry behind them (CVE-2026-50520) and a Visual Studio RCE (CVE-2026-47305).

Add these Microsoft updates to your standard developer update release schedule.

Adobe (and third-party updates)

Outside Microsoft’s own catalogue, July is quiet. Adobe issued no Acrobat or Reader security updates. So, the month belongs to Microsoft, and it is a heavy one: 722 CVEs, roughly three times a normal cycle and one of the largest on record. Worth noting that this lands in the same season Microsoft has been talking up AI-assisted vulnerability management, and the AI stack it is selling as the answer, Copilot and Azure OpenAI among them, sits in the centre of this patch cycle’s own critical-rated updates. The (AI) tooling may be getting smarter, but the patch pile is (definitely) not getting smaller. This may be the beginning of an accelerating curve of ever larger patch cycles. My feeling is that we are in the middle of the beginning of this coming patch surge.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?