securitylab_nJuly 16, 2026🇷🇺Translated from Russian

Microsoft Pauses Windows Security Update KB5101650 After It Triggers Shutdowns and Overheating on Dell Laptops with Intel Processors

Microsoft has temporarily halted distribution of its July cumulative security update KB5101650 after the patch, which was designed to address 570 vulnerabilities across Windows, began causing serious stability and performance problems on select Dell laptops featuring Intel processors.

The update, released on 14 July as part of the regular monthly Patch Tuesday cycle, was also intended to introduce system restore-point functionality. Instead, affected users reported spontaneous shutdowns, reduced performance, excessive heat generation, and accelerated battery discharge.

Engineers identified the culprit as the Intel Innovation Platform Framework Processor Participant driver, a component responsible for regulating processor power consumption and cooling. When this driver malfunctioned, laptops could no longer maintain proper thermal and power balance, leading to the observed symptoms.

Microsoft had first detected driver-related warnings in the Device Manager after some users voluntarily installed the optional June update KB5095093. Because changes from optional updates are routinely merged into the subsequent mandatory release, the incompatibility spread to a wider audience in July.

The conflict was ultimately linked to the newly introduced Windows USB-C Connection Manager interface, added in June to improve USB-port handling, which proved incompatible with the Intel driver on certain Dell configurations.

Neither Microsoft nor Dell has published a list of affected models, making it impossible to determine the precise scale of exposure. Microsoft has confirmed that the update was blocked before it could install on incompatible devices, preventing any confirmed cases of permanent hardware damage.

The company stated it is collaborating with Intel and Dell on a resolution expected within days. For users whose systems are not impacted, Microsoft continues to advise immediate installation of the security update to benefit from protection against hundreds of known vulnerabilities.

Related articles

Security NEXTVulnerabilities & Exploits

Sky Discloses Five Vulnerabilities in SKYSEA Client View and SKYMEC IT Manager

Sky has released a security advisory detailing five vulnerabilities affecting its IT asset management tools SKYSEA Client View and SKYMEC IT Manager. The flaws impact all Windows-based components including master servers, management machines, terminal machines, and standalone terminals. Two issues received CVSSv4 base scores of 8.5 while the remaining three scored 5.8, with CVSSv3 scores reversing the severity ranking for some entries. The vulnerabilities include missing authorization checks, improper file permissions during installation, multiple path traversal flaws, and a stack-based buffer overflow. Sky has made update and patch modules available to contracted customers and strongly recommends immediate deployment.

Security NEXTVulnerabilities & Exploits

CISA Adds Oracle WebLogic Proxy Plug-in Flaw CVE-2026-21962 to KEV Catalog After Confirmed Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the Oracle WebLogic Server Proxy Plug-in. The vulnerability affects the mod_wl_ohs module that proxies requests from web servers to Oracle WebLogic Server. It is bundled with Oracle HTTP Server and also impacts equivalent plug-ins for Apache HTTP Server and IIS. The flaw allows unauthenticated remote attackers to tamper with, delete, or create data and exfiltrate information. Exploitation can impact connected environments and backend systems. CISA issued the alert on August 24, 2026, highlighting the risk to organizations running affected proxy configurations.

安全客Vulnerabilities & Exploits

Critical Zoom Vulnerability Exposes All Platforms to Remote Takeover via Screen Sharing Annotations

A high-severity vulnerability in Zoom Workplace clients across Windows, Mac, iOS, Android, and Linux allows attackers to remotely seize full device control simply by having a victim enable screen sharing and the annotation tool. The flaw requires no user interaction such as clicking links or dismissing warnings, and the compromise occurs silently without visible alerts. Security researchers demonstrated that AI tools enabled complete exploit development within 24 hours, dramatically lowering the barrier for advanced attacks previously limited to nation-state actors. The issue affects hundreds of millions of remote workers who rely on Zoom’s daily screen-sharing features. Official patches have been released, and users are urged to update immediately while avoiding annotation tools in sensitive sessions. Apple simultaneously addressed related macOS flaws in multiple versions. The incident highlights how generative AI is accelerating the weaponization of vulnerabilities.

AntiMalwareVulnerabilities & Exploits

Windows 11 May Silently Remove Discrete GPU Drivers Due to Eco Mode on Gaming Laptops

Windows 11 has introduced an unexpected behavior that can delete drivers for discrete graphics cards on gaming laptops when the device remains powered off for an extended period in Eco Mode. The issue was first reported by the owner of an Asus ROG Zephyrus G14 equipped with a mobile GeForce RTX 5070 Ti, where the system treated the physically disconnected GPU as permanently removed after 15 days. Windows component pnpclean.dll then purged both the device entry and the associated Nvidia driver package, leaving the laptop with only a Microsoft Basic Display Adapter reporting error code 10. The default cleanup timer is normally 30 days, but it can be shorter for certain hardware configurations that fully disconnect discrete graphics for power saving. Similar incidents have been observed on older Asus ROG models with AMD Radeon GPUs, prompting the developer of G-Helper to add a warning to the utility. Users can mitigate the problem by periodically switching to Standard Mode or by disabling automatic driver package cleanup via a specific PowerShell command that sets the Autorun value to 0 under the Device Driver Packages registry key. Microsoft has not yet issued an official statement on the matter.