Windows 11 24H2 Support Ends Tuesday, Plus 3 Stories
Windows 11 24H2 stops getting Home and Pro updates Tuesday
If your PC is still running Windows 11 24H2 Home or Pro, Tuesday is the point where “I’ll deal with that update later” turns into a security-maintenance problem.
Microsoft says Windows 11 24H2 Home and Pro reach end of updates on October 13. After that, those editions stop receiving monthly security updates, quality fixes, time-zone updates, and normal technical support. Enterprise and Education editions are on a different lifecycle and remain supported through October 12, 2027, so this is not a blanket “every 24H2 machine dies Tuesday” story.
The practical part is easy to check. Press Windows + R, type winver, and look at the version line. If it says 24H2 and the PC is running Home or Pro, make sure the machine has a current backup and then go to Settings → Windows Update. Microsoft’s current guidance points those systems to Windows 11 25H2, and unmanaged Home and Pro computers may receive that update automatically.
I would not turn “support ends tomorrow” into “force-install whatever build you can find on the internet tonight.” Windows Update can hold an upgrade when Microsoft knows a particular driver or application has a compatibility problem. The goal is to get onto a supported release, not to trade one maintenance problem for another because a third-party download site promised to make the warning go away.
So the order matters: check the version, check the backup, use Windows Update, and deal with any compatibility hold instead of bypassing it blindly. If a business has a handful of PCs and nobody knows which version any of them are running, that is the useful job for Monday morning.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
A fake Claude installer can look trusted before it reaches the fake site
Security researchers at Push Security found a malicious Google ad targeting people searching for “claude mac.” The clever part was not the fake Claude page at the end. Fake download pages are old news. The clever part was everything the attacker put in front of it.
Push Security says the sponsored Google result displayed a legitimate Bing domain. Clicking it passed the browser through Google’s advertising system, a real Bing click-tracking redirect, and a compromised legitimate retail website before reaching the attacker’s fake Claude installer. The compromised site and fake installer also checked referrers and browser details so people arriving outside the expected path often saw nothing useful.
Then the page used a ClickFix-style trick. It showed Anthropic’s legitimate-looking installation command, but clicking the copy button placed a different command on the clipboard. That substituted command downloaded attacker-controlled code and asked macOS to run it in the shell. BleepingComputer reports that the final payload has not been identified, so we do not know exactly what malware, if any, a victim ultimately received.
This is why “the ad said Bing” and “the command on the page looked right” are not security controls. The browser can be redirected, and the clipboard does not have to contain what the page visually showed you.
If software wants you to paste a Terminal or PowerShell command, start from the vendor’s official site rather than a sponsored search result. Then compare the command you are about to run with the vendor’s current documentation. If you already ran an unverified installer command from a search ad, treat the computer as potentially compromised until it has been checked. Do not use that same machine to change important passwords while you are still trying to determine what it ran.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
SonicWall’s newly patched SMA1000 flaw is already drawing attacks
SonicWall published fixes last week for four SMA1000 vulnerabilities. At the time, the company said it had no evidence they were being exploited. That changed quickly enough to matter.
The most serious flaw, CVE-2026-102255, is a pre-authentication server-side request forgery in the SMA1000 WorkPlace interface. In plain English, an attacker can make the internet-facing appliance send requests on the attacker’s behalf into functionality that should not be directly reachable from outside. No login is required to reach the vulnerable path.
SonicWall’s advisory covers SMA1000 6210, 7210, and 8200v appliances running 12.4.3-03526 or older, or 12.5.0-02952 or older. Fixed builds are 12.4.3-03670 and 12.5.0-03082 or newer.
SecurityWeek reports that Defused and Previdian began seeing exploitation attempts on October 8, two days after public disclosure. That does not prove every probe succeeded, but it removes the comfortable argument for waiting to see whether attackers care.
If your organization operates an affected SMA1000, patch it now. Because exploitation attempts have already been observed, also review the exposed appliance and its logs for suspicious activity rather than assuming the update proves nobody visited before you installed it. Patching closes the door. It does not tell you whether someone walked through it yesterday.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
Satellite-to-phone service is starting to look like a mobile-network business
The satellite-phone story moved another step beyond emergency texting this week. SpaceX agreed to buy a nationwide portfolio of low-band 800 MHz spectrum from Grain Management for roughly $8 billion, subject to FCC approval. Low-band radio travels farther and penetrates buildings better than higher-frequency spectrum, although the tradeoff is less raw capacity.
Reuters reports that the spectrum is compatible with most existing handsets, which is a big reason this matters. The long-term idea is not “buy a special satellite phone.” It is a normal phone that can use terrestrial towers where they exist and reach a satellite when they do not.
The FCC is also scheduled to vote October 29 on advancing a new spectrum auction intended to support direct-to-device service. The proposal includes 25 MHz for auction and hundreds of additional megahertz that could support satellite coverage. The agency has already been expanding its rules around direct-to-device systems this year.
We touched this on Thursday when the FCC’s satellite-phone work was still mostly a regulatory story. The new spectrum purchase makes the competitive ambition harder to miss.
I still would not choose a phone plan based on this today. Owning spectrum is not the same thing as having enough satellites, terrestrial infrastructure, roaming agreements, capacity, and customer support to replace a conventional carrier. But if you work somewhere with chronic dead zones, the thing to watch is no longer whether ordinary phones will connect to satellites. They already can. Watch how quickly the service moves from emergency and basic messaging into useful voice and data, what it costs, and who actually supports it on the phones people already own.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- Microsoft: Windows 11 24H2 release health
- Microsoft: Supported versions of Windows client
- Push Security: Adception malvertising analysis
- BleepingComputer: Fake Claude ClickFix campaign
- SonicWall: SMA1000 security notice
- SecurityWeek: SMA1000 exploitation observed
- Reuters: SpaceX acquires low-band spectrum for Starlink Mobile
- Reuters: FCC plans direct-to-device spectrum vote
- FCC: Direct-to-device connectivity framework
Photo by Jakub Zerdzicki on Pexels.
