Microsoft has confirmed that Windows Server 2016 will stop receiving security updates on 12 January 2027, when its extended support period comes to a close. As BleepingComputer reports, the company issued a message centre update spelling out exactly what Windows Server 2016 end of support means for admins who haven’t yet moved on.’The January 2027 Windows security update will be the last update available for this version. After this date, devices running Windows Server 2016 will no longer receive monthly security updates containing protections from the latest security threats,’ Microsoft said. The cutoff applies to all editions: Datacenter, Essentials, MultiPoint…
Author: Gary Behan
Gary Behan
Software engineer and video game uber-nerd.
Researchers at Eye Security have remotely neutralised a critical Time4Popcorn RCE flaw in the abandoned BitTorrent-based streaming app, after registering the expired update domain and finding up to 3 million Windows machines and 350,000 macOS systems still phoning home to it, as BleepingComputer reports. The vulnerability, tracked as CVE-2026-30612, allowed anyone who controlled that domain to push unsigned executables over plain HTTP and gain SYSTEM-level access on Windows or root on macOS, all without any user interaction.Connections came from residential ISPs alongside corporate, government, and military networks, though Eye Security noted that none of the users appeared to be actively…
Microsoft has published guidance for IT administrators on how to restore broken Exchange Online EWS applications following the platform’s decision to block the Exchange Web Services API by default on 1 October 2026. Apps that relied on EWS, including Outlook desktop add-ins, older versions of Outlook for Windows, and Apple Mail and Calendar on macOS, have been throwing errors ranging from protocol-unavailable alerts to repeated credential prompts since the block took effect.EWS is the API that allows applications to access Exchange mailbox data such as email, calendar entries and contacts, both from Exchange Online and on-premises Exchange Server installations. Microsoft…
Law enforcement agencies from 21 countries have arrested 1,462 people and disrupted 10,909 malicious networks in Operation Serengeti III, an Interpol-coordinated crackdown on business email compromise, ransomware and online scams. BleepingComputer reports that the operation ran from 29 June to 31 August and resulted in the recovery of more than US$105 million in illicit funds.Interpol announced the results in a press release, stating that investigators identified 65,929 victims and put estimated financial losses across the affected schemes at more than US$385 million. Private-sector partners including Team Cymru, Kaspersky, Group-IB and Fortinet supported the operation with intelligence and technical expertise, covering…
The PHP security team has released emergency patches for two critical unauthenticated remote code execution (RCE) vulnerabilities, tracked collectively as PHP2Shell, affecting all PHP installations that serve web requests. Reported by BleepingComputer, the flaws are CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS v4.0 score of 9.2, according to Tenable.Researchers at Calif, Wiz, and OpenAI discovered the flaws. Affected deployment types include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. ‘We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs,’ the PHP security team said.What the two…
The US Department of Homeland Security has issued an order requiring federal civilian agencies to remove all DeepSeek products from government IT systems, a BleepingComputer-reported DeepSeek ban that also extends to products from the Chinese AI company’s affiliates and any third-party services built on DeepSeek technology. The full legal name of the company in question is Hangzhou DeepSeek Artificial Intelligence Co., Ltd.The order, published in the Federal Register on 20 October 2026, covers large language models, the DeepSeek chatbot, API services, and models used for coding and reasoning tasks. Federal agencies are directed to immediately exclude covered products from procurement…
Microsoft has resolved a known Windows 11 audio crash bug that caused games and applications using AC-3 (Dolby Digital) audio decoding to fail after the September 2026 preview update KB5124010 was installed. The fix ships in the October 2026 Patch Tuesday update, KB5127648, as reported by BleepingComputer.KB5124010 is technically an optional update, requiring users to click a ‘Download and install’ prompt, which limits the pool of affected machines. That said, devices configured to receive updates as soon as they become available install it automatically, so the impact is broader than a typical optional release.What was going wrongWhen Microsoft acknowledged the…
Microsoft has confirmed that its October 2026 Windows Server security updates are disrupting Exchange Server sign-in and mail delivery on some on-premises deployments, a problem that stems from a new memory cap in the Endpoint Mapper, not from the Exchange-specific patches themselves. BleepingComputer reported the issue following a Windows release health dashboard update over the weekend. According to Microsoft, systems running Windows Server 2019 and later that have installed the October 2026 update may find that users cannot sign in to Outlook on the web (OWA), that outbound messages remain stuck in the Outbox, and that Exchange encounters problems accessing…
Attackers are actively exploiting a critical OS command-injection vulnerability, tracked as CVE-2026-106931, in the SiteGuard Server Edition web application firewall, executing arbitrary commands with root or SYSTEM privileges on compromised machines. BleepingComputer reports that the vulnerability is located in the product’s statistics feature, which is active by default on affected installations.The vendor, which claims to protect more than 1.5 million websites, confirmed exploitation in its own security alert: ‘An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed.’ WordPress.org statistics put the product’s active install count at 500,000…
When an employee uses a personal ChatGPT account on a corporate laptop (even at an organisation that pays for ChatGPT Enterprise) the security implications can range from trivial to serious. A sponsored guide published on BleepingComputer, written by Vakaris Noreika, VP of Product Research and Development at NordLayer, walks IT admins through the five steps that follow a personal ChatGPT at work alert, and illustrates what changes when prompt-level controls are in place. The piece opens with a reminder that the risk is real at every level. As background: reporting by Politico in January 2026, covered by CSO Online, revealed…