Loading story…
Microsoft disclosed that a flawed Defender for Endpoint on Linux update could leave antivirus protection disabled after an upgrade or reinstall followed by a reboot. The issue affected platform builds 101.26042.0000 through 101.26042.0009, creating a silent gap in active protection on impacted Linux systems until administrators verified agent health or applied a corrected release. Microsoft removed the affected builds from the production channel and said the disabled-service problem is remediated in version 101.26042.0011.
A second defect in the same update line caused installation failures on FIPS-enabled Red Hat Enterprise Linux 8 and 9 systems, preventing those hosts from moving off their previous version. Microsoft said environments using Defender for Servers with Defender for Cloud and MDE integration may have received the affected Linux extension automatically. The FIPS-related issue is fixed in 101.26052.0011 and later, and administrators were urged to upgrade directly to the corrected builds and confirm Linux endpoint protection is running after reboot.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft removed Defender for Endpoint on Linux builds 101.26042.0000 through 101.26042.0009 from the production channel after the disabled-service issue was identified. The affected builds had briefly left some Linux servers without active protection after reboot.
Microsoft remediated the disabled-service issue with build 101.26042.0011 and advised customers to upgrade directly to that version. It also fixed the FIPS-related installation problem in version 101.26052.0011 and later.
Microsoft disclosed that Linux platform builds 101.26042.0000 through 101.26042.0009 could leave the Defender service disabled after an upgrade or reinstall followed by a reboot. It also disclosed that the 101.26042.x update could fail on FIPS-enabled Red Hat Enterprise Linux 8 and 9 systems, leaving them on their previous version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetheregister.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed that the Windows 11 security update `KB5089549` can fail to install on systems running versions 24H2 and 25H2 when the EFI System Partition has 10 MB or less of free space. Affected devices typically stop during reboot at about 35–36% completion, return error `0x800f0922`, and roll back the update. Microsoft has issued a **Known Issue Rollback** for consumer and unmanaged business devices, while enterprise administrators must use a Group Policy workaround; for persistent cases, the company also published a registry-based mitigation to reduce reserved EFI servicing padding. The same update also addresses a separate problem that had pushed some Windows 11 devices into BitLocker recovery after earlier 2026 updates. The installation issue is significant because Microsoft’s May security advisories also included multiple **Microsoft Defender** vulnerabilities, with `CVE-2026-41091` and `CVE-2026-45498` added by CISA to the **Known Exploited Vulnerabilities** catalog, signaling active exploitation risk. Additional Defender flaws tracked as `CVE-2026-45584` and related advisories were also published by Microsoft and echoed by national cybersecurity agencies, including Canada’s Cyber Centre and HKCERT, which urged organizations to review the bulletins and apply updates. Microsoft said it is developing a permanent fix for the Windows 11 update failure in a future release.
Jun 29, 2026
Microsoft published a security advisory for an elevation of privilege vulnerability in the Microsoft Malware Protection Engine, tracked as **`CVE-2026-50656`** and described as a Microsoft Defender Elevation of Privilege Vulnerability. The issue affects a core Defender component used for malware scanning and protection, prompting immediate attention from defenders monitoring endpoint security exposure. The Canadian Centre for Cyber Security issued advisory **AV26-607**, urging organizations and administrators to review Microsoft’s guidance and apply the necessary updates as they become available. The notice reinforces that enterprises relying on Microsoft Defender should validate patch deployment and ensure affected systems receive the vendor’s remediation for **`CVE-2026-50656`**.
Jun 29, 2026
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 12, 2026