Loading story…
Microsoft confirmed that September 2026 Windows security updates can prevent the built-in File History feature from creating or updating backups. Affected devices can display a false “Reconnect your drive” warning, retain stale backup timestamps, lose access to prior file versions, or log FileHistory.exe and KERNELBASE.dll crashes—while a connected backup drive may appear healthy. The issue affects multiple Windows 10 and Windows 11 releases, including Windows 11 23H2 through 26H1 and Windows 10 21H2/22H2 and Enterprise LTSC editions; Windows Server is not affected.
Microsoft has documented the regression and is developing a fix for a future Windows update, but has not provided an official workaround. Organizations should immediately validate backup job completion, backup freshness, and restoration capability on affected endpoints, and maintain separate verified backups until a corrective update is available.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added a known issue confirming that the September security updates can break File History backups. Affected systems can show erroneous drive-reconnection alerts, stale backup timestamps, unavailable previous versions, and FileHistory.exe/KERNELBASE.dll crash events.
Microsoft rolled out its September 2026 Windows security updates. The updates later were found to prevent File History from creating or updating backups on affected Windows systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft's cumulative update **KB5063878** for **Windows 11 24H2** has been linked to reports of hard drive and SSD malfunctions, including disks disappearing from the file system and possible data corruption or loss. The issue was highlighted by CSIRT.SK, which said the failures were observed after installation of the August Patch Tuesday package associated with OS build `26100.4946`. According to the advisory, damage may occur during sustained write operations involving tens of gigabytes, raising concern for systems handling heavy disk activity. CSIRT.SK said the problem appears tied to a Microsoft Defender update bundled with the release, while Microsoft had not yet published a confirmed root cause or mitigation in the referenced support material; administrators and users were urged to back up data and watch official Microsoft channels for further guidance.
Jul 24, 2026
Microsoft confirmed that September Windows 11 security updates **KB5124008** and **KB5124012** can disable USB Audio Class 1.0 devices on Windows 11 24H2 and later systems. Affected devices may fail to start with Device Manager error `Code 10`, produce no sound, and leave volume controls or Sound settings unresponsive; microphones, 3D audio, and multichannel configurations are also affected. Organizations have reported that changing multichannel devices to 2-channel mode can restore service, but Microsoft has not released a permanent fix. KB5124008, which advances Windows 11 25H2 and 24H2 systems to builds 26200.9445 and 26100.9445, respectively, has also been confirmed to disrupt applications using HCS-managed Linux VMs with Plan9 shared folders, including Anthropic Claude Cowork workspace access, and to cause Remote Desktop Services instability. Additional reports cite Explorer crashes or black screens in virtual-desktop and profile-container deployments, File History failures with external drives, and AMD Radeon driver timeouts. Microsoft is investigating the issues; enterprises should test the updates against USB audio, VDI, RDS, Linux VM, backup, and AMD-dependent workflows while weighing mitigations against the updates' security fixes.
Sep 16, 2026
Microsoft’s Windows 11 cumulative update `KB5094126` is causing serious post-installation failures on some systems after its release with roughly 200 security fixes, including 33 critical flaws and five zero-days. Users reported freezes shortly after boot, black screens, boot loops, BSODs, and repeated BitLocker recovery prompts, including on devices where BitLocker was believed to be disabled. Reports indicate the problems are hitting some HP models particularly hard, with Secure Boot certificate changes and interactions with BIOS/UEFI settings and undersized or crowded EFI partitions emerging as likely factors. The update is also disrupting enterprise and productivity workflows by breaking File Explorer integration for OneDrive and, in some cases, Dropbox and iCloud Drive, while some affected machines reportedly lose LAN access even though internet connectivity remains available. Administrators and users have resorted to Windows Recovery Environment to remove the patch, and some systems reportedly required full Windows reinstalls after recovery complications. A widely shared workaround has been to temporarily disable Secure Boot, complete boot and update recovery, then re-enable Secure Boot after updating BIOS/UEFI firmware, though Microsoft had not formally acknowledged the full scope of the issues in the update documentation at the time of reporting.
Jun 29, 2026