Loading story…
Microsoft confirmed that September Windows 11 security updates KB5124008 and KB5124012 can disable USB Audio Class 1.0 devices on Windows 11 24H2 and later systems. Affected devices may fail to start with Device Manager error Code 10, produce no sound, and leave volume controls or Sound settings unresponsive; microphones, 3D audio, and multichannel configurations are also affected. Organizations have reported that changing multichannel devices to 2-channel mode can restore service, but Microsoft has not released a permanent fix.
KB5124008, which advances Windows 11 25H2 and 24H2 systems to builds 26200.9445 and 26100.9445, respectively, has also been confirmed to disrupt applications using HCS-managed Linux VMs with Plan9 shared folders, including Anthropic Claude Cowork workspace access, and to cause Remote Desktop Services instability. Additional reports cite Explorer crashes or black screens in virtual-desktop and profile-container deployments, File History failures with external drives, and AMD Radeon driver timeouts. Microsoft is investigating the issues; enterprises should test the updates against USB audio, VDI, RDS, Linux VM, backup, and AMD-dependent workflows while weighing mitigations against the updates' security fixes.
See real exploitation activity before you spend the cycle.
11 events from the most recent confirmed update back to the earliest known activity.
Microsoft released the out-of-band Windows update KB5129195. It resolves the HCS-managed Linux VM Plan9 host-folder sharing issue and partially resolves USB Audio Class 1.0 failures affecting 8-channel and 3D-audio configurations; other USB-audio and Remote Desktop Services issues remain under investigation.
Microsoft released the mandatory September 2026 Windows 11 security update KB5124008, updating 25H2 systems to build 26200.9445 and 24H2 systems to build 26100.9445. The September security release also included KB5124012.
Microsoft previously addressed a USB-audio problem triggered by the KB5050094 optional preview cumulative update for Windows 11 24H2. The issue caused audio playback failures and Code 10 errors involving USB audio device drivers.
Users reported AMD Radeon driver timeouts, black screens, freezes, missing displays, and recurring driver failures after installing KB5124008. Affected reports included several RX 6000, 7000, and 9000-series GPUs, and some users said uninstalling the update resolved the issue.
Users reported that File History stopped detecting connected external backup drives after KB5124008 installation, and some said uninstalling the update restored functionality. Microsoft had not confirmed the regression at the time of reporting.
Microsoft said it was investigating reports that KB5124008 causes Explorer.exe to crash shortly after sign-in, leaving users with black screens and preventing normal desktop, taskbar, Start menu, and File Explorer operation. Reports particularly involved virtual desktop deployments using profile-container products such as Citrix UPM, FSLogix, Horizon, and ProfileUnity ProfileDisks.
Microsoft confirmed that KB5124008 can cause Remote Desktop Services instability, frequent connection failures, and sign-in problems, including systems stalled at the Remote Desktop Configuration dialog. Affected environments can also experience unresponsive File Explorer, a broken MMC, and a continuously loading Windows Update page.
Anthropic stated that the Plan9 regression prevents Claude Cowork's Linux guest from mounting its host shared filesystem and accessing local workspace files. Reinstalling Claude does not resolve the issue, while Claude Code is unaffected.
Microsoft confirmed that KB5124008 disrupts applications using HCS-managed Linux virtual machines with Plan9 shared folders, preventing affected guests from correctly sharing host folders. Standard Hyper-V VMs not using Plan9 are unaffected.
Microsoft associated some of the audio failures with multichannel configurations, including 3D audio and 8-channel modes. Switching an affected device to 2-channel mode restored audio for some users, while Microsoft also recommended alternate hardware where needed.
Microsoft confirmed that KB5124008 and KB5124012 can cause USB Audio Class 1.0 devices on Windows 11 24H2 or later to fail to start or produce audio. Affected systems may show a Device Manager Code 10 error and have unresponsive volume controls or Sound settings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcebleepingcomputer.com
Open sourcesupport.microsoft.com
Open sourcewindowslatest.com
Open sourcewindowslatest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft attributed **Windows 11 no-boot failures** seen after installing the January 2026 cumulative update `KB5074109` (Windows 11 **24H2/25H2**) to devices that had previously **failed to install the December 2025 security update** and were left in an “**improper state**” after rollback. Affected systems can crash on startup with a BSOD `UNMOUNTABLE_BOOT_VOLUME`; Microsoft said the issue appears limited to **physical devices** (no confirmed VM impact) and is working on a **partial mitigation** to prevent additional systems from entering a no-boot scenario, while continuing to investigate why some devices fail updates or end up unstable after rollback. Separately, Microsoft’s recent Windows 11 servicing and security work included **deliberately disabling legacy dial-up modem drivers** (e.g., `AGRSM64.SYS`/`AGRSM.SYS`, `SMSERL64.SYS`/`SMSERIAL.SYS`) due to reported vulnerabilities including **CVE-2023-31096** (EoP) and **CVE-2025-24052** (stack-based buffer overflow), which can present risk even if the modem hardware is unused—at the cost of breaking connectivity for niche systems relying on those drivers. Microsoft also patched **nine bypasses** reported by Google Project Zero that could undermine the new **Windows Administrator Protection** feature by enabling silent admin privilege gains via legacy Windows/UAC behaviors (including a token/Logon Sessions-related technique involving `NtQueryInformationToken` and DOS device object directory creation), ahead of broader availability beyond Insider builds.
Jun 29, 2026
Microsoft’s January 2026 Patch Tuesday release for Windows 11 (notably **KB5074109** for 24H2/25H2) delivered roughly 100+ security fixes (including reported **zero-days**) but also introduced significant reliability regressions. Reported impacts include **system lockups**, **black screens** on systems with Nvidia/AMD GPUs, graphics-related hangs in GPU/DirectX-intensive applications, and application failures such as **Outlook Classic** freezing or failing to launch; additional issues were reported with File Explorer behavior and cloud-backed storage workflows (e.g., OneDrive/Dropbox) causing apps to become unresponsive when saving or syncing data.
Jun 29, 2026
A recent series of Windows updates has caused significant disruptions to enterprise environments, impacting both messaging services and remote access capabilities. The Windows 10 update KB5071546 has been reported to break the Microsoft Message Queuing (MSMQ) service due to insufficient permissions, potentially affecting business-critical messaging workflows. This issue may hinder the ability of enterprise applications to communicate reliably, posing operational risks for organizations relying on MSMQ for distributed systems or alerting mechanisms. Separately, Microsoft’s October 2025 non-security update KB5067036 for Windows 11 has disrupted virtual private server (VPS) access for users of the Windows Subsystem for Linux (WSL), particularly those dependent on third-party VPNs such as Cisco Secure Client and OpenVPN. Users have experienced “No route to host” errors in WSL’s mirrored networking mode, blocking access to corporate resources and impeding remote work and security operations. Microsoft has acknowledged the VPN issue and is investigating, with temporary workarounds available but no permanent fix yet. These incidents highlight the need for rigorous testing of Windows updates in enterprise environments, especially where hybrid Linux-Windows workflows are critical for cybersecurity operations.
Jun 29, 2026