Microsoft Confirms November 2026 Windows Security Updates Fail to Install on Affected Windows 11 Systems

Microsoft Confirms Windows Updates Since October 2026 Patch Tuesday Cause SQL Server Performance and Stability Issues

Microsoft has officially acknowledged that multiple Windows updates released after the October 2026 Patch Tuesday are triggering significant performance degradation and stability problems in SQL Server environments. The issues affect query execution times, transaction throughput, and overall system responsiveness, leading to increased latency for database-dependent applications. Engineers have traced the root cause to changes introduced in core Windows kernel components that interact with SQL Server's memory management and I/O subsystems. Affected customers report intermittent crashes and resource contention that were not present prior to the updates. Microsoft is actively investigating the regression and has advised organizations to apply targeted workarounds while a permanent fix is developed. The company emphasizes that the problem stems from the cumulative update packages rather than any third-party software or configuration errors.

Critical Pre-Auth MongoDB Flaw CVE-2026-118383 Can Crash Lagging Servers on Failover

A critical use-after-free vulnerability in MongoDB Server, tracked as CVE-2026-118383, allows an unauthenticated attacker to send two specially crafted ping requests that plant persistent waiters on a replica set member. The flaw only triggers when that lagging member later wins an election and completes its catch-up phase, causing the server to reuse freed memory and crash with a segmentation fault. MongoDB rated the issue 9.5 on CVSS 4.0 and released fixes across affected branches earlier this week, while confirming it discovered the bug internally and has seen no exploitation in the wild. The vulnerability affects replica set members, including shard and config servers in sharded clusters, but does not impact standalone mongod instances or the 8.2 branch. Researchers at Datadog Security Labs reproduced the crash in a lab environment and published a proof-of-concept that demonstrates reliable reproduction only under test-only settings. MongoDB Atlas clusters receive automatic patches during maintenance windows, while self-managed deployments must apply the fixed releases to every replica set member. The company also noted that the flaw could theoretically lead to arbitrary code execution under certain conditions, although the researchers did not achieve code execution in testing.

Critical Red Hat Quay Vulnerability Allows Attackers to Hijack Token Signing and Access Private Container Images

A critical vulnerability tracked as CVE-2026-123710 with a CVSS score of 9.8 has been identified in Red Hat Quay, an enterprise container registry used to store, manage, and distribute container images. The flaw resides in the service responsible for managing signing keys and allows an unauthenticated attacker to take over registry token signing when the key server is accessible to untrusted clients. Attackers can exploit weaknesses in the key rotation mechanism to install their own trusted signing key, generate tokens with read and write access to any repository, and expose private images along with any stored credentials or secrets. The malicious key can be set without an expiration date and persists across registry restarts, while also interfering with legitimate operations by deleting instance keys. Red Hat warns that disabling anonymous access does not mitigate the risk, as any valid account can still exploit the issue, and recommends restricting access to the key-management service, reviewing logs, and removing unauthorized keys until a fix is deployed.