Microsoft Pauses Windows Security Update KB5101650 After It Triggers Shutdowns and Overheating on Dell Laptops with Intel Processors
Microsoft has temporarily halted distribution of its July cumulative security update KB5101650 after the patch, which was designed to address 570 vulnerabilities across Windows, began causing serious stability and performance problems on select Dell laptops featuring Intel processors.
The update, released on 14 July as part of the regular monthly Patch Tuesday cycle, was also intended to introduce system restore-point functionality. Instead, affected users reported spontaneous shutdowns, reduced performance, excessive heat generation, and accelerated battery discharge.
Engineers identified the culprit as the Intel Innovation Platform Framework Processor Participant driver, a component responsible for regulating processor power consumption and cooling. When this driver malfunctioned, laptops could no longer maintain proper thermal and power balance, leading to the observed symptoms.
Microsoft had first detected driver-related warnings in the Device Manager after some users voluntarily installed the optional June update KB5095093. Because changes from optional updates are routinely merged into the subsequent mandatory release, the incompatibility spread to a wider audience in July.
The conflict was ultimately linked to the newly introduced Windows USB-C Connection Manager interface, added in June to improve USB-port handling, which proved incompatible with the Intel driver on certain Dell configurations.
Neither Microsoft nor Dell has published a list of affected models, making it impossible to determine the precise scale of exposure. Microsoft has confirmed that the update was blocked before it could install on incompatible devices, preventing any confirmed cases of permanent hardware damage.
The company stated it is collaborating with Intel and Dell on a resolution expected within days. For users whose systems are not impacted, Microsoft continues to advise immediate installation of the security update to benefit from protection against hundreds of known vulnerabilities.
Related articles
Password Deleted from Git but Still Present: Major CI/CD Security Mistakes
Developers often leave secrets in configuration files, .env examples, or test scripts that end up in Git history. Removing a file in a new commit does not erase previous versions, and .gitignore offers no protection for already tracked content. Pre-commit hooks with tools like Gitleaks can scan staged changes before they reach the repository. Docker images can retain secrets in layers even after removal commands, requiring BuildKit secret mounts instead. Terraform plans and state files may still expose sensitive values marked only as sensitive. Kubernetes workloads need both non-root containers with dropped capabilities and narrowly scoped RBAC roles. Multiple scanning stages from pre-commit through post-deployment help catch issues before they reach production.
Critical SSRF Vulnerability in AWS SSM Agent Allows IAM Credential Theft via Port Forwarding Bypass
Amazon Web Services has disclosed a high-severity server-side request forgery vulnerability in the AWS Systems Manager Agent. The flaw, tracked as CVE-2026-89049, affects the port forwarding feature used by Session Manager and stems from insufficient validation that permits bypass of deny-list restrictions on link-local addresses. Successful exploitation requires port-forwarding permissions but can lead to unauthorized access to instance metadata and temporary IAM role credentials. The company rated the issue as Important with CVSSv4.0 base score 8.5 and CVSSv3.1 score 9.9. The vulnerability was addressed in version 3.3.4851.0 released on 13 July 2026, prior to the public advisory issued on 10 September 2026.
New Windows 11 Bypass Lets Users Skip Internet and Microsoft Account During Setup
A new method has been discovered that allows Windows 11 Home users to complete initial setup without an internet connection or Microsoft account. The technique requires no command-line tools or scripts and was found by enthusiast Bob Pony. During the OOBE process, users simply open the sign-in options and click the Learn more link, which redirects the wizard to local account creation. Previous bypasses such as OOBE\bypassnro and start ms-cxh:localonly have already been blocked by Microsoft. The new approach appears to be an overlooked interface element and works only on the Home edition. Microsoft is expected to close this loophole in a future update as it continues tightening account requirements.
CISA Adds Four Actively Exploited Vulnerabilities in GitLab, ConnectWise ScreenConnect and JFrog Artifactory to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaws affect GitLab Community Edition and Enterprise Edition, ConnectWise ScreenConnect, and JFrog Artifactory. CVE-2026-85706 allows unauthenticated path traversal in GitLab’s commit API, enabling arbitrary file reads. CVE-2026-84869 in ScreenConnect permits unauthorized file transfer and execution over active remote sessions. Two additional issues in Artifactory, CVE-2026-42018 and CVE-2026-42016, can lead to token leakage and privilege escalation. Federal agencies have been directed to apply mitigations and investigate potential compromises by specific deadlines.