Microsoft Patches the RDS Flaw, Then Breaks RDS

The September 2026 Patch Tuesday had a genuinely useful thing to say: Windows closed out roughly 966 vulnerabilities, including a no-auth remote code execution flaw in Remote Desktop Services itself. Then, within a few hours of installing the cumulative updates, RDS started misbehaving on exactly the fleets that care about it. On Windows Server 2019, 2022, and 2025 (2012 and later, plus Windows 10 and 11 per Microsoft's release-health dashboard), RDP sessions would die after a few minutes, signs would hang at ‘Please wait for the Remote Desktop Configuration,’ and in the worse cases servers just stopped accepting connections until someone did a hard reset. Microsoft confirmed it Friday, and then spent the next day shipping emergency out-of-band updates to walk it back. The irony is hard to miss: the update that was supposed to make your remote desktop stack safer is the one that made your remote desktop stop working.

That's the uncomfortable part for anyone running production. This isn't an exploitable bug or a missed CVE — it's a patch regression, the kind where the thing you deploy on schedule actively degrades the thing you depend on for recovery. And you don't get a clean undo, because rolling the update back also pulls the month's security fixes with it, including two zero-days that were being actively exploited in the wild. So your decision tree collapses into a genuine bind: keep the fix and lose the ability to administer your fleet remotely, or roll back and sit in the open to exactly the class of RDS exploit the update was there to close. Security Arsenal frames it well — the worst outcome isn't the outage, it's the reflex response of disabling patching entirely or bolting on a flat, NLA-less remote-access workaround that lingers long after the real fix lands. That's how an availability incident quietly turns into a security gap.

The emergency out-of-band updates (KB5129195 for Windows 11 25H2, and companion KBs for 21H2/22H2 and 24H2/25H2) have landed as of this morning, and Microsoft has marked the issue mitigated — there's even a Known Issue Rollback via Group Policy if you need the escape hatch before the build ships. But the operational lesson outlives the specific KB: when your recovery path is the same channel your patching runs through, a bad patch is no longer just an incident, it's a lockout. The registry-flag workarounds folks tried first are proving unreliable anyway, so don't build your recovery plan on a one-off flag. If RDP is your lifeline, what does your out-of-band access actually look like when the thing you patch to stay safe is exactly the thing that takes it down? I'd like to hear how you've kept remote admin alive through a bad patch window — console serial, a jump host you don't patch on the same cadence, something else entirely?

Source article image
Source image 1

Sources

Comments

Post a Comment

Popular posts from this blog

AI Is Starting to Feel Less Like a Gadget and More Like Infrastructure

Image
Modern AI doesn't replace infrastructure — it runs on top of it. (Photo: Unsplash) For a while, AI coverage had the energy of a mall demo kiosk: very shiny, slightly chaotic, and usually one prompt away from embarrassment. Lately, though, the more interesting story is less about flashy demos and more about infrastructure. A useful CNBC piece argued that AI is not simply going to vaporize enterprise software overnight, and that sounds about right. In real companies, software does not disappear just because a model can summarize a meeting or write a decent SQL query. What actually happens is messier and more practical: AI starts sneaking into the plumbing. It shows up in search, support workflows, procurement tools, analytics dashboards, and data pipelines. The real winners may not be the loudest chatbot wrappers, but the vendors that make enterprise systems easier to operate, easier to query, and slightly less soul-crushing for the humans trapped inside them. That is less cinematic ...
Read more

When Two AI Bots Finally Learned to Talk in Discord

I spent part of the day doing something that sounds like the setup for a bad joke: getting two local AI assistants to talk to each other in the same Discord channel. Not through a web UI. Not by bouncing prompts manually between windows like a human message queue. In the actual shared channel, where both could see the conversation and react to each other. The funny part is that the problem was not intelligence. It was manners. Both bots were defensive by default around bot-authored messages, which is the sensible setting if you do not want your infrastructure turning into a recursive support group. The downside is obvious: if both assistants treat other bots as suspicious background noise, they will never coordinate on anything more useful than silence. The fix was to make both sides accept bot-authored messages only when they were explicitly mentioned. That detail matters more than it sounds. Blanket bot acceptance is how you end up with two enthusiastic systems discovering each oth...
Read more

A CISA Contractor's GitHub Repo Held 844 MB of Secrets — and No One Closed the Door

Image
There is something almost poetic about the US government's premier cybersecurity agency — the one whose job is literally to plug holes in critical infrastructure — getting outsmarted by a contractor who treated a public GitHub repository like a digital junk drawer. The "Private-CISA" repo, created November 13, 2025, sat publicly for six months containing 844 megabytes of plaintext passwords, AWS GovCloud administrative credentials, Kubernetes manifests, ArgoCD application files, Terraform infrastructure code, CI/CD build logs, and internal deployment documentation. Guillaume Valadon at GitGuardian flagged it on May 14 after his automated scanning picked up the exposure. The commit history told the whole story in plain sight: the account owner had explicitly disabled GitHub's default secret-scanning protections, pushed plaintext credentials stored in CSV files, committed full backup archives into git history, and used easily guessed passwords like "platform-name-2...
Read more