Loading story…
Microsoft's optional Windows 11 preview update KB5120998—build 26100.9278 for version 24H2 and 26200.9278 for 25H2—reportedly resets customized mouse cursors to an enlarged white default and can replace desktop wallpapers with a black background. Some users say the wallpaper issue returns after sign-out or restart, and that removing the update restores both settings. Microsoft had not listed the defects as known issues; a company engineer directed affected users to submit reports through Feedback Hub.
The preview introduces taskbar placement on every screen edge, a taskbar-size setting, a resizable Start menu and simplified Search experience. It also includes Administrator Protection for separating approved administrative actions into a derived account, Microsoft Execution Containers for agentic-AI sandboxing, and an ML-KEM post-quantum TLS key-exchange option. Organizations should defer deployment of the optional update where desktop configuration stability is important; its features are expected to enter the regular release cycle on the next Patch Tuesday.
See real exploitation activity before you spend the cycle.
12 events from the most recent confirmed update back to the earliest known activity.
Microsoft began propagating an automatic mitigation to unmanaged devices that blocks the inpoutx64 driver when ARC Raiders is installed, allowing the game to launch normally. The mitigation addressed gaming hangs, crashes, access-violation errors, and restarts associated with RGB-related inpoutx64 components after KB5121003 and later updates.
Microsoft confirmed that Teams and the new Outlook for Windows may fail to launch or may close unexpectedly on ARM-based devices after Windows security updates released on or after August 11, 2026, including KB5121003. Microsoft said it plans to address the issue in a subsequent update.
Microsoft began a Controlled Feature Rollout of redesigned Windows Search features in KB5120998, including separate toggles for web searches and Microsoft Store suggestions. Disabling both produces a local-only Search experience and is intended to speed local results by avoiding waits for web content.
Starting in August 2026, Windows 11 versions 24H2 and 25H2 no longer include the Windows Management Instrumentation Command-line utility (WMIC). WMIC had already been removed by default on new installations and is no longer available as a Feature on Demand.
The KB5120998 changes, including Administrator Protection, Microsoft Execution Containers, and standalone ML-KEM TLS key exchange, had been available in Windows Insider Preview Channel builds for approximately two weeks.
Microsoft began developing Administrator Protection, a security feature intended to provide privilege separation by running approved administrative applications in a separate derived account.
Microsoft confirmed that KB5120998 can reset desktop backgrounds to a black default and prevent customized personalization settings from loading, including settings for desktop icons, slideshows, and contrast themes. The company said the Controlled Feature Rollout-related issue can emerge after installation and that it is working on a fix.
Microsoft acknowledged receiving reports that KB5120998 and later Windows updates can alter or reset mouse-cursor personalization settings, including custom schemes. The company said it is investigating whether Windows Update is causing the issue.
Microsoft software engineer Jen Gentleman said KB5120998 is optional and asked affected users to submit detailed reports through Feedback Hub. Microsoft had not publicly listed the cursor or wallpaper problems as known issues at the time of reporting.
Affected users reported that removing KB5120998 restored customized cursor settings and desktop wallpapers, although uninstalling also removes the update's taskbar, Start menu, and Search improvements.
Multiple Windows 11 users reported that KB5120998 reset customized high-DPI mouse cursors to an enlarged white default and replaced desktop wallpapers with a black background, sometimes recurring after restart or logout. Some users also reported DISM error 0x800f0915, though the reported content states that error predates KB5120998.
Microsoft released preview update KB5120998 for Windows 11 24H2 and 25H2, advancing them to builds 26100.9278 and 26200.9278 respectively. The staged update restores taskbar placement on all monitor edges, adds taskbar sizing, and introduces interface changes including a movable taskbar, resizable Start menu, and simplified Search box.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
15 references tracked. Mallory keeps watching after this page renders.
windowslatest.com
Open sourcewindowslatest.com
Open sourcezdnet.fr
Open sourcezdnet.com
Open sourcesupport.microsoft.com
Open sourceaka.ms
Open sourcesupport.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported **over 1 billion monthly active Windows 11 users**, but user sentiment remains negative, with prominent complaints focused on **buggy updates**, perceived reliability regressions, and unwanted feature changes (including AI-related additions). Microsoft leadership publicly acknowledged the feedback and said the company will prioritize **performance, reliability, and overall user experience** improvements to rebuild trust. Microsoft also released the **KB5074105** optional *non-security* preview cumulative update for Windows 11 (24H2/25H2), positioned as an end-of-month quality update ahead of the next Patch Tuesday. KB5074105 includes dozens of changes and targets operational issues including **boot problems** (e.g., startup hangs when Windows Boot Manager debugging is enabled and iSCSI boot failures with `Inaccessible Boot Device`), **sign-in issues** (including `Explorer.exe` hanging on first login under certain startup-app configurations), and **activation/license migration failures** during upgrades when devices cannot register with the Windows Activation server; the update is available via Windows Update or manual download from the Microsoft Update Catalog.
Jun 29, 2026
Microsoft’s latest Windows 11 preview releases for Insiders and optional updaters introduce **native Sysmon** and ship fixes for disruptive **Windows Explorer/taskbar** regressions. Windows 11 Insider Dev Channel Build `26300.7733` (KB5074178) adds Sysmon as a built-in *Optional Feature*, bringing deeper endpoint telemetry (e.g., process creation with command lines, network connections, driver loads, and file timestamp manipulation) intended to improve forensic visibility and incident investigation; Microsoft notes the integrated Sysmon conflicts with legacy standalone Sysmon installs, requiring removal of the older version before enabling the new feature. Separately, the optional preview update **KB5074105** for Windows 11 `24H2`/`25H2` addresses a January cumulative-update regression where `Explorer.exe` could hang at startup—causing the taskbar to intermittently disappear and forcing users to restart Explorer via Task Manager—and also fixes reports of desktop icons being rearranged unexpectedly. ZDNET characterizes the upcoming February Windows 11 patch as feature-heavy and indicates KB5074105 is an early look at what will roll into the broader monthly release, while other referenced ZDNET pieces are general OS commentary/comparisons and not tied to the Sysmon integration or the KB5074105 Explorer fix; an Android 17 feature roundup is unrelated.
Jun 29, 2026
Microsoft released the Windows 11 optional preview cumulative update **KB5074105** (for **Windows 11 24H2 and 25H2**) with multiple fixes and changes, including resolving a known issue where the **password sign-in option/icon could disappear** from lock screen sign-in options after installing updates dating back to the August 2025 preview update line. Affected users could still authenticate by hovering over the blank area where the password option should appear to reveal the hidden button; Microsoft reports the issue is addressed in KB5074105. The same KB5074105 preview update also introduces a local hardening change to reduce unauthorized interaction with sensitive system information by adding a **mandatory User Account Control (UAC) prompt** when accessing **Settings > System > Storage**. This change is intended to prevent non-admin users (or threat actors with local/remote access to a non-admin session) from viewing or manipulating detailed storage and temporary-file/system-file information without administrative approval, and is being rolled out as an optional “C-release” preview ahead of broader deployment.
Jun 29, 2026