October 16, 2026

Windows Updates Can Stall Exchange, Plus 4 Stories

Mike York Daily Briefs Android, Bankruptcy Courts, BeyondTrust, CVE-2026-102764, Google Messages, Microsoft Exchange, UK Competition and Markets Authority, Windows Server

A Windows security update can install successfully and still leave the application sitting on top of it in trouble. That is exactly what some on-premises Exchange administrators are reporting this week. Today’s other stories involve an exploited remote-support appliance, a nationwide interruption to bankruptcy notices, Microsoft’s switching costs, and new Android scam defenses.

Windows Server Updates Can Stall Exchange Mail Flow

Microsoft is investigating reports that October’s Windows Server updates can break parts of on-premises Exchange. The affected updates are KB5126646 for Windows Server 2025, KB5126655 for Server 2022, KB5126651 for Server 2019, and KB5126868 for Server 2016.

The symptoms are not subtle once somebody looks in the right place. Outlook on the web can fail with a MapiExceptionMdbOffline error, Windows can log Event ID 1006, and outgoing mail can collect in Exchange queues instead of reaching its destination. The October Exchange security update does not have to be installed for the problem to appear. Microsoft says the Windows Server updates alone may trigger it.

This is a Windows Server Exchange issue, not a general Microsoft 365 outage. It matters because installing patches is normally treated as the end of a maintenance job. It isn’t. A patch can close a security hole while disturbing the service that depends on the operating system, and a growing mail queue does not care that the update screen ended with a reassuring green checkmark.

If you administer Exchange, check OWA, message queues, and the relevant Application log after deploying these KBs. Stage the rollout where your environment allows it, make sure the recovery plan is real, and follow Microsoft’s Exchange Team post for the investigation. Microsoft specifically says it does not recommend uninstalling Exchange security updates. I would not turn a confirmed security fix into the first troubleshooting lever for an operating-system problem.

Reliable automation

Automation is wonderful until it quietly stops working three Tuesdays ago. Raymond Tec builds integrations with logging, monitoring, and failure handling in mind so the boring work stays automated without becoming mysterious.

BeyondTrust’s Remote-Support Door Was Opened From Outside

BeyondTrust disclosed CVE-2026-102764, a critical vulnerability affecting supported Remote Support releases through 26.2.3. Remote Support is designed to give trusted technicians controlled access to other computers. That makes the appliance valuable even before an attacker touches a downstream endpoint: it can broker credentials, launch remote sessions, and reach systems ordinary internet traffic cannot.

BeyondTrust and Google-owned Mandiant say a suspected China-linked espionage group exploited the flaw as a zero-day on August 29. Mandiant observed the attackers upload a web shell, gain root-level control, alter administrator permissions, erase local logs, and use the appliance’s own remote-support functions to move farther into the victim’s environment. The attribution is the researchers’ assessment. The exploitation and post-compromise behavior are based on incident-response evidence.

BeyondTrust patched its hosted customers on October 8. Self-hosted customers need to confirm that BT26-05 is installed, and the company also released a precautionary patch for Privileged Remote Access because it shares the affected code. An internet-exposed appliance that was vulnerable during the exploitation window deserves an investigation, not a victory lap after patching. Patch first, preserve and review off-box logs, hunt for unexplained privileged sessions or permission changes, and rotate brokered credentials if evidence of compromise appears. This is the same lesson behind yesterday’s warning about security tools becoming attack targets: closing the hole does not remove somebody who already walked through it.

Bankruptcy Notices Are Offline, but the Courts Are Not

A cybersecurity incident at BAE Systems has knocked the federal Bankruptcy Noticing Center offline. BAE operates the center for the judiciary, producing and distributing bankruptcy notices nationwide. The judiciary says the affected websites, notice production, notice distribution, and National Creditor Registration Service are unavailable while BAE investigates and restores service.

The distinction matters: the notice contractor is down, not every federal court system. Still, a missing notice can carry real consequences for creditors, debtors, attorneys, and businesses watching a case. Anyone with an active matter should follow the relevant court’s guidance and case record rather than assuming an empty inbox or mailbox means nothing happened. The public statement does not identify the attacker, entry point, or stolen data, so anything beyond the confirmed service disruption is speculation.

Technical discovery & auditing

The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.

The Real Microsoft Price Includes the Cost of Leaving

Britain’s Competition and Markets Authority has proposed giving Microsoft “strategic market status” in business software. That is not a fine or an order to break up the company. It is a legal designation that could let the regulator impose targeted rules after a consultation and final decision, expected by February.

The regulator is looking at familiar products such as Excel, Teams, and Copilot, but the important issue is the bundle around them. The CMA is examining whether customers can choose competing AI tools, whether Microsoft’s security bundles reduce choice, and whether licensing rules constrain where businesses run software in the cloud. In a related cloud review, the regulator said Microsoft and Amazon Web Services can do more to make switching providers and using multiple clouds practical.

That gets closer to the problem than a simple subscription-price comparison. The real cost of a platform includes data export, identity systems, integrations, staff habits, contract commitments, cloud egress, and licenses that may become more expensive somewhere else. There is no reason to flee Microsoft today. There is a reason to document those dependencies before renewal day, when “we could switch” often turns out to mean “we could switch after six expensive months.”

Business IT goes well beyond the website

Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.

Android’s Strongest Scam Filter Comes With a Choice

Google is rolling out an optional Enhanced protection mode for Google Messages. It uses cloud-based Gemini models to examine the context of conversations with unknown senders, looking for the slow-burn scams that begin as harmless chat and reveal the demand later. Google says the analysis happens inside Private AI Compute, where the data is encrypted and inaccessible to Google. On-device Gemini Nano also checks unfamiliar links against current web signals before a user opens them.

Other protections require less of a privacy tradeoff. Android will hide login and payment fields during Chrome and WebView screen sharing. It can block apps from quietly enabling call forwarding and warn when somebody tries to talk the user into entering a forwarding code. Scam alerts in chat notifications are also expanding beyond Pixel phones to devices from Motorola, Samsung, OnePlus, Xiaomi, and other manufacturers.

The enhanced message analysis is opt-in, which is the right choice. Some people will reasonably prefer stronger cloud-assisted detection; others will prefer to keep more analysis on the phone. Neither setting turns a phone into a truth machine. A warning creates friction at the moment a scammer wants speed and obedience. That is useful. The final control is still the person who stops, calls the bank or family member using a known number, and verifies the story.

Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.

Sources and Further Reading

Photo by Samuel Peter on Pexels.