Loading story…
Microsoft released the KB5066835 security update for Windows in October 2025, which introduced a critical issue affecting the Windows Recovery Environment (WinRE). After installing this update, users reported that USB-connected keyboards and mice stopped functioning within WinRE, rendering the recovery environment largely unusable for troubleshooting or repairing systems. The main Windows operating system remained unaffected, with USB input devices continuing to work as expected outside of recovery mode. This issue impacted both client versions, including Windows 11 24H2 and 25H2, as well as Windows Server 2025 platforms. Microsoft acknowledged the problem on its Windows release health dashboard, confirming that the bug was directly linked to the KB5066835 update. The inability to use USB input devices in WinRE prevented users from navigating recovery options, which could be particularly problematic for those needing to restore or repair their systems after critical failures. As a temporary workaround, Microsoft suggested using Bluetooth wireless input devices or legacy PS/2 connectors, which were not affected by the update. The company assured users that a fix was being developed and would be released in the coming days to address the issue. This incident followed previous problems with WinRE updates, such as the 0x80070643 installation errors that were resolved earlier in the year. The rapid response from Microsoft included an emergency patch to mitigate the disruption caused by the faulty update. Security news outlets highlighted the urgency of the situation, emphasizing the importance of WinRE for system recovery and the widespread impact of the bug. The incident underscored the risks associated with critical system updates and the need for thorough testing, especially for components essential to system recovery. Administrators and end-users were advised to monitor Microsoft's official channels for updates and to consider alternative input methods if immediate access to WinRE was required. The event demonstrated the cascading effects a single update can have on system usability, particularly in scenarios where recovery tools are vital. Microsoft's communication and swift action were crucial in managing the fallout and restoring confidence among its user base. The situation also served as a reminder for organizations to have contingency plans for recovery operations in the event of unexpected software issues.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft rushed out emergency update KB5070773 to restore USB keyboard and mouse functionality in Windows Recovery after the October update issue. Multiple outlets reported the fix as an out-of-band response to the botched update.
Microsoft's October 2025 Windows updates, including KB5066835, introduced a bug that disabled USB keyboard and mouse input in the Windows Recovery Environment, making WinRE difficult or impossible to use on affected systems. Reports indicate the issue affected Windows 11 versions 24H2 and 25H2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcesecurityonline.info
Open sourcesecurityonline.info
Open sourcecsoonline.com
Open sourcesecurityboulevard.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft issued a fix for a **Windows 10 Windows Recovery Environment (WinRE)** failure introduced by the October 14, 2025 update that left some systems unable to launch WinRE, a critical last-resort recovery tool when Windows fails to boot. The remediation is associated with **KB5068164** for Windows 10 **21H2/22H2**, which was intended to update WinRE via a Safe OS Dynamic Update but instead shipped with a defect that prevented WinRE from starting; Microsoft provided limited technical detail beyond stating the issue was “addressed.” Reporting indicates Microsoft formally logged the known issue on **Feb 20, 2026** and updated support documentation with a resolution on **Mar 3, 2026**, leaving affected endpoints without functional WinRE for months. The update’s applicability is conditional (e.g., sufficient free space in the recovery partition—commonly cited as **250 MB**—and presence/state of a WinRE partition), and administrators can validate WinRE status using `reagentc /info`; a subsequent fix is referenced as **KB5075039**. Separately, a Windows 11 in-place upgrade bug has been reported to delete `C:\Windows\dot3svc\Policies` (impacting **802.1X** wired authentication and causing loss of network connectivity), but that issue is distinct from the WinRE incident.
Jun 29, 2026
A bug in recent Windows security updates has caused some systems to unexpectedly boot into BitLocker recovery mode after installation and reboot. Microsoft confirmed that the issue primarily affects Intel devices with Connected Standby (Modern Standby) support, impacting platforms such as Windows 11 24H2, 25H2, and Windows 10 22H2. Users encountering this problem are required to enter their BitLocker recovery key to regain access, after which the system resumes normal operation without further prompts. Microsoft has acknowledged the problem and advised IT administrators to use a group policy delivered via Known Issue Rollback (KIR) as a mitigation, with further support available through Microsoft Support for business customers. This incident follows similar BitLocker recovery issues triggered by Windows updates in May 2025, August 2024, and August 2022, highlighting a recurring challenge with update compatibility and BitLocker functionality on certain hardware configurations.
Jun 29, 2026
Microsoft’s Windows 11 cumulative update `KB5094126` is causing serious post-installation failures on some systems after its release with roughly 200 security fixes, including 33 critical flaws and five zero-days. Users reported freezes shortly after boot, black screens, boot loops, BSODs, and repeated BitLocker recovery prompts, including on devices where BitLocker was believed to be disabled. Reports indicate the problems are hitting some HP models particularly hard, with Secure Boot certificate changes and interactions with BIOS/UEFI settings and undersized or crowded EFI partitions emerging as likely factors. The update is also disrupting enterprise and productivity workflows by breaking File Explorer integration for OneDrive and, in some cases, Dropbox and iCloud Drive, while some affected machines reportedly lose LAN access even though internet connectivity remains available. Administrators and users have resorted to Windows Recovery Environment to remove the patch, and some systems reportedly required full Windows reinstalls after recovery complications. A widely shared workaround has been to temporarily disable Secure Boot, complete boot and update recovery, then re-enable Secure Boot after updating BIOS/UEFI firmware, though Microsoft had not formally acknowledged the full scope of the issues in the update documentation at the time of reporting.
Jun 29, 2026