IT News

Latest updates on cloud, security, Microsoft and the tools that keep your infrastructure running.

Breaking news & security alerts
Microsoft 365, Azure, Windows
Insights for sysadmins & MSPs
Independent and practical

All topics

All News

Stay informed with the latest IT news, security updates and product changes.

Windows 11 Settings showing Windows Update history with KB5094126 installed

Microsoft Ships KB5094126 June 2026 Security Update for Windows 11 24H2 and 25H2

Microsoft released KB5094126 on June 9, 2026, a security update for Windows 11 versions 24H2 and 25H2 and Windows Server 2025. According to the update documentation, it fixes six vulnerabilities (CVE-2026-26001 through CVE-2026-26006) spanning the Windows Kernel, Edge WebView2, Graphics component, authentication, and Windows Shell, and raises builds to 26100.8655 (24H2) and 26200.8655 (25H2).

Jun 10, 20264 min read

Microsoft update KB5094140, which delivers Extended Security Updates for Exchange Server 2019.

AdvisorySecurity Updates

KB5094140 Delivers ESU Security Patches for Exchange Server 2019

KB5094140 is the June 2026 ESU security update for Exchange 2019 CU14/CU15 patching 8 CVEs including actively exploited OWA spoofing. Same CVEs as Exchange SE SU7 (KB5094139). Requires ESU Period 2 eligibility.

Jun 10, 20262 min read

AdvisorySecurity Updates

KB5094144 Patches Exchange Server 2016 CU23 via ESU

KB5094144 is the June 2026 ESU update for Exchange 2016 CU23 patching 8 CVEs including actively exploited OWA spoofing. Exchange 2016 is deep in extended support. Requires ESU Period 2.

Jun 10, 20262 min read

Microsoft update KB5097149, which patches a SignalR denial-of-service flaw and a .NET SDK elevation-of-privilege.

Resolved.NET 8.0 Runtime

KB5097149 Patches SignalR DoS and SDK EoP in .NET 8.0.28

KB5097149 patches three CVEs in .NET 8.0: serialization RCE, ASP.NET Core DoS, and cryptographic info disclosure. Updates to version 8.0.28 on Windows, Linux, and macOS. No known issues.

Jun 10, 20262 min read

Windows Server 2025 update screen showing security patch installation

ResolvedWindows Server 2025 Standard

Microsoft Ships KB5094125 to Patch Five Windows Server 2025 Flaws

Microsoft's June 2026 security update KB5094125 patches five vulnerabilities in Windows Server 2025, including a critical unauthenticated Remote Desktop Services RCE (CVE-2026-0235) and a Hyper-V guest-to-host escape (CVE-2026-0237). The update raises the OS build to 26100.32995 and applies to all editions across full GUI and Server Core installations.

Jun 10, 20265 min read

Windows Update screen showing a cumulative security update for Windows Server 2016

ResolvedWindows 10 Version 1607

Microsoft Ships KB5094122 for Windows Server 2016 and Windows 10 1607, Patching Kernel and CLFS Flaws

Microsoft released KB5094122, the June 2026 cumulative security update for Windows 10 Version 1607 and Windows Server 2016, addressing critical remote code execution and privilege escalation vulnerabilities. The update moves the build to 14393.9234 and fixes flaws in the Windows Kernel, CLFS Driver, Graphics Component and Print Spooler.

Jun 10, 20264 min read

Windows Update screen showing a cumulative security update installing on a Windows Server 2019 system

ResolvedWindows 10 Version 1809

Microsoft Ships KB5094123 for Windows Server 2019, Patching Five CVEs

Microsoft's June 2026 Patch Tuesday update KB5094123 addresses five CVE-tracked vulnerabilities in Windows 10 Version 1809 and Windows Server 2019, including a critical Windows kernel remote code execution flaw (CVE-2026-26001, CVSS 8.8). The update raises the OS build to 17763.8880.

Jun 10, 20264 min read

Microsoft update KB5094041, the June 2026 security rollup for Windows Server 2012 R2 systems enrolled in Extended Security.

ResolvedWindows Server 2012 R2

Microsoft Ships KB5094041 June Rollup for Windows Server 2012 R2 ESU Systems

Microsoft released KB5094041 on June 9, 2026, the monthly rollup for Windows Server 2012 R2 ESU systems. It patches kernel security flaws, fixes TLS 1.3 compatibility, resolves WMI memory leaks, and improves AD replication stability.

Jun 10, 20264 min read

Windows Server 2022 update dialog showing security patch KB5094128

ResolvedWindows Server 2022 Standard

Microsoft Ships KB5094128 for Windows Server 2022, Patching Four Critical Flaws

Microsoft's June 2026 security update KB5094128 patches multiple critical vulnerabilities in Windows Server 2022, including an unauthenticated NFS remote code execution flaw (CVE-2026-26001, CVSS 9.8), a Task Scheduler privilege escalation bug, an AD CS authentication bypass, and a Windows kernel memory corruption issue. The update raises the OS build to 20348.5256 and requires a restart.

Jun 9, 20265 min read

ServiceNow platform login screen with a security advisory notification

MitigatedServiceNow hosted customer instances (API endpoint)

ServiceNow Patches Unauthenticated API Endpoint After Data-Exposure Incident

ServiceNow patched a misconfigured API endpoint that allowed unauthenticated queries of customer instance data, and observed successful table queries for a subset of customers - but says the activity appears attributable to security researchers, with no evidence data was retained or misused.

Jun 9, 20267 min read

ServiceNow patching an actively exploited API vulnerability that exposed sensitive customer data.

ResolvedServiceNow Platform (Australia release)

ServiceNow Patches Exploited API Flaw That Exposed Customer Data

ServiceNow patched an unauthenticated API flaw on June 5, 2026, after attackers queried customer instance tables. Affects Australia release. Third major vulnerability in eight months.

Jun 6, 20263 min read

The IronWorm supply-chain attack infecting 36 npm packages with a Rust infostealer and an eBPF rootkit.

Resolvednpm (Node Package Manager)

IronWorm Infects 36 npm Packages with Rust Infostealer and eBPF Rootkit

IronWorm is a Rust-based npm supply chain worm that infected 36 packages via the asteroiddao account. It steals credentials, deploys an eBPF rootkit, communicates over Tor, and self-propagates via stolen npm tokens.

Jun 5, 20263 min read

Microsoft update KB5094139, which patches eight vulnerabilities in Exchange Server Subscription Edition.

AdvisorySecurity Updates

KB5094139 Patches 8 CVEs in Exchange Server SE Including Exploited Flaw

KB5094139 patches 8 CVEs in Exchange Server SE including RCE, spoofing, info disclosure, and EoP. At least one actively exploited. Max CVSS 8.8. Also available for Exchange 2019 and 2016 via ESU.

Jun 3, 20261 min read

Update KB5089573 with shared audio, NPU monitoring in Task Manager, and faster Windows shell performance.

ResolvedWindows 11 24H2

KB5089573 Adds Shared Audio, NPU Task Manager, and Faster Shell to Windows 11

Microsoft released KB5089573 on May 26, 2026, an optional preview for Windows 11 24H2 and 25H2 (Builds 26100.8524/26200.8524) with Shared Audio, Task Manager NPU monitoring, Multi-App Camera, and shell performance gains under the K2 initiative.

May 26, 20263 min read

Windows 11 Update settings screen showing a .NET Framework cumulative update ready to install

Resolved.NET Framework 3.5

Microsoft Ships KB5087051 to Patch Four .NET Framework CVEs on Windows 11 25H2

Microsoft's KB5087051 cumulative update for .NET Framework 3.5 and 4.8.1 on Windows 11 Version 25H2 addresses four CVE-tracked vulnerabilities, including remote code execution, an ASP.NET Core authentication bypass, and a serialization denial-of-service flaw, alongside WCF stability and Entity Framework performance fixes.

May 14, 20264 min read

Windows Update screen showing a .NET Framework cumulative update ready to install

Resolved.NET Framework 3.5

Microsoft Ships KB5087054 .NET Framework Update for Windows 11 24H2, Patching Two CVEs

Microsoft released KB5087054, a cumulative security update for .NET Framework 3.5 and 4.8.1 on Windows 11 Version 24H2 (x64). The update patches an elevation-of-privilege flaw in the CLR (CVE-2026-0234) and an ASP.NET request-validation bypass (CVE-2026-0235), alongside garbage-collector and reliability fixes. It requires a restart and carries several known post-install issues admins should test for.

May 13, 20265 min read

The KB5002866 patch protecting Microsoft Office 2016 applications from two critical remote code execution vulnerabilities.

ResolvedMicrosoft Office 2016 (MSI)

KB5002866 Patches Two Critical Office 2016 Remote Code Execution Flaws

Microsoft's May 2026 Patch Tuesday delivers KB5002866 for Office 2016, fixing CVE-2026-40358 (use-after-free) and CVE-2026-40363 (heap buffer overflow), both rated critical with CVSS 8.4.

May 13, 20266 min read

Microsoft update KB5090408, which patches a CVSS 8.8 remote code execution vulnerability in SQL Server 2019 GDR.

AdvisorySQL Server

KB5090408 Patches CVSS 8.8 RCE in SQL Server 2019 GDR

KB5090408 patches CVE-2026-40370 (CVSS 8.8 RCE via path manipulation) in SQL Server 2019 GDR. Build 15.0.2170.1. For instances on the GDR servicing branch (no CUs). MSDASQL Msg 7416 breaking change. Superseded by KB5102336.

May 13, 20262 min read