Microsoft has pushed out KB5124010, the September 2026 optional preview update for Windows 11 24H2 and 25H2. It contains 46 changes, including Bluetooth fixes, a way to remap the Copilot key, and support for Emoji 17.0.
The release is a non-security update. Monthly preview updates like this one give administrators and users an early look at fixes and features that will reach all devices with next month's Patch Tuesday, the regular monthly release of Windows security and quality updates. Unlike the cumulative updates shipped on Patch Tuesday, previews such as KB5124010 contain only quality improvements. They do not patch security vulnerabilities.
Ardit Kutleshi, one of the men accused of running the Rydox cybercrime marketplace, has pleaded guilty in the United States to aggravated identity theft and money laundering.
The 28-year-old was extradited from his home country of Kosovo last year. US prosecutors say he and his older brother ran Rydox, an illicit platform where cybercriminals bought stolen personal information, unauthorized access to devices and other tools used to commit fraud.
Sentencing is set for February. The aggravated identity theft charge carries a mandatory minimum of two years in prison. The money laundering count carries a maximum of 20 years.
Microsoft has confirmed that recent Windows 11 updates are stopping the desktop from loading on some systems. Affected users see a black screen after signing in.
The problem started with the August 2026 preview updates and carried into later releases, including this month's Patch Tuesday rollout. According to Microsoft, it mainly hits Azure Virtual Desktop (AVD) hosts that use FSLogix. AVD is Microsoft's cloud-based desktop and app virtualization service. FSLogix is a tool that speeds up the loading of user profiles in virtual desktop environments.
Which updates are involved
Microsoft lists the following updates as linked to the issue:
US healthcare technology company Astrana has told the Securities and Exchange Commission (SEC) that attackers gained access to its servers and made off with private or confidential information. The company describes the incident as material to its financial position.
The filing, submitted on Tuesday evening, makes Astrana the latest in a string of healthcare tech firms to disclose a cyberattack to the US markets regulator in recent months.
Spoofed phone number opened the door
According to the report, the intrusion did not start with a software flaw. It started with a phone call. The attackers posed as Astrana staff and spoofed the company's main corporate telephone number, so calls to employees appeared to come from a trusted internal line.
Some developers are publishing private GitLab email addresses in READMEs, contributing guides and support pages to collect bug reports. According to researchers at application security company Aikido, these addresses carry a credential that attackers can use to act on GitLab as the developer who owns them.
The addresses come from a built-in GitLab feature called "Email work item to this project." GitLab generates them automatically. When someone sends a message to one of these addresses, GitLab turns the email into an issue or task in the project.
The problem is that each address contains a long-lived token tied to the developer's account. This string works as the credential for creating work items by email.
Guy Fawkes News is financed by advertising. You can choose how you want to use this website:
With advertising: we load an advertising script from a third-party ad network. The ad network may set cookies, use your IP address and device information, and may process data outside the EU. We also count your visits for our own visitor statistics (with a random ID stored in your browser).
Ad-free for €0.99 per month: no advertising and no advertising tracking. Cancel at any time.
You can change your decision at any time via "Cookie Settings" at the bottom of every page.
