Microsoft has resolved an Always On VPN bug that caused connection failures after the September 2026 Windows 11 security update, confirming the fix is included in this month's KB5127936 preview update. The company had earlier mistakenly claimed the issue was resolved in October's cumulative update. Affected users saw VPN connections stuck in a 'Connecting' state or fail with a 'port already in use' error when automatic protocol selection or fallback was configured.
bleepingcomputer.com
· 2026-10-30
Microsoft has repeated its call for Entra ID administrators to move workforce tenant users off SMS and voice-based authentication before it discontinues Microsoft-provided versions of these methods on February 1, 2027. The change affects only Entra ID workforce tenants, not Azure AD B2C or Entra External ID customer scenarios, and admins can shift users to passkeys, QR code sign-in, FIDO2 keys or other supported options, or keep phone-based login by configuring a third-party telecom provider.
bleepingcomputer.com
· 2026-10-28
ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers gained access to application identities used to connect to Microsoft 365 tenants. Microsoft confirmed unauthorized authentication attempts from an IP address on October 15, while security firm Huntress identified at least 162 compromised tenants in its own environment. ConnectWise says it has found no evidence that customer backup data itself was accessed, and existing backups remain intact.
bleepingcomputer.com
· 2026-10-17
Canonical has released Ubuntu 26.10, codenamed Stonking Stingray, built on the Ubuntu 26.04 LTS base. The update adds Rust-based coreutils, post-quantum-ready package signing, TPM-backed full-disk encryption, Linux kernel 7.3, GNOME 51, RISC-V desktop images, and a new opt-in local speech-to-text feature called Myna. Companion flavors including Kubuntu, Lubuntu, and Xubuntu are also launching today, each with nine months of maintenance support.
lists.ubuntu.com
· 2026-10-15
Microsoft released cumulative updates KB5127648 and KB5127646 fixing a bug that broke Always On VPN connections on Windows 11 24H2 and later systems after installing September 2026 security updates. The issue affected devices using automatic protocol selection between IKEv2 and SSTP, causing connections to hang or fail with a port-in-use error when an initial attempt didn't succeed.
bleepingcomputer.com
· 2026-10-14
Microsoft has made Microsoft Execution Containers (MXC) generally available, a Windows platform feature that lets developers and IT admins restrict which files, applications and network destinations an AI agent can access at runtime. The company says MXC is the first piece of a broader security framework that will also include Entra-based identity separation for agent versus user activity, and Agent 365 controls for managing on-device agents.
blogs.windows.com
· 2026-10-09
Microsoft has turned on its Windows settings backup and restore tool by default for Microsoft Entra-joined and Entra hybrid-joined enterprise devices upgraded to Windows 11 26H2, released September 29. The feature, previously opt-in since its 2024 unveiling and general availability in August 2025, now backs up settings and app lists automatically unless an admin has already configured the policy. Restore still requires explicit admin setup, and the default-on change excludes devices in DMA-regulated regions or sovereign/restricted cloud environments.
bleepingcomputer.com
· 2026-10-01
Microsoft has shut down EvilTokens, a subscription-based cybercrime service sold via Telegram that used AI tools to break into Microsoft accounts and mine stolen inboxes for payment details and business contacts. The company said the service compromised roughly 12,000 accounts across 10,000 organizations by abusing Microsoft's device-code sign-in process, and it seized 50 websites and 150 domains via legal action. UK police separately arrested two men suspected of running the operation.
techspot.com
· 2026-09-23
Varonis Threat Labs disclosed a technique called TrustSink in which an attacker with a highly privileged Entra account registers a rogue external MFA provider that inserts a fake password prompt into legitimate login flows, capturing users' plaintext passwords. The rogue provider still returns a valid signed token to Entra, so the sign-in completes normally with no visible error, and resetting a stolen password does not remove the malicious provider from the authentication flow. Varonis says the method could work with any authentication system using this external MFA model but demonstrated it specifically against Microsoft Entra.
bleepingcomputer.com
· 2026-09-22
GoKawiil