Kategorie

SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances. [...]

Are you a Windows fan? Do you like getting sneak peeks at features before they’re released to the public? Microsoft created its Windows Insider Program for you.

The program made its debut in October 2014 with the release of the Windows 10 technical preview. It provided a way for enthusiastic users, developers, and IT admins to test out — and, notably, give feedback on — the upcoming OS. After Windows 10 shipped, Microsoft kept the program going, and Insiders have had early access to new features being developed for all subsequent Windows 10 and Windows 11 versions, via releases known as Insider Preview Builds.

The Insider program has gone through numerous changes since those early days, with an increasingly complex array of options (“channels”) to designate what types of preview builds you want to get your hands on. But the purpose has remained the same: to give you a way to see upcoming features (or ones that Microsoft is experimenting with, anyway), and to report bugs, share your thoughts, and make suggestions for how to improve those features while they’re still being developed.

Earlier this year, the company gave the Insider program its biggest overhaul ever, with the stated goal of making it less confusing for participants. (Did they succeed? We’re not so sure.) So even if you think you know about Insider channels and how to handle them, if you haven’t checked recently, you’re out of date.

We’re here to help. In this article, we’ll explain how to handle Windows 11 previews and how to choose the right Insider channel(s) for you. (Note that you must be running Windows 11 to participate in the Insider program; there is no longer an Insider program for Windows 10.)

We’ve divided the piece into two sections, one for individuals and one for IT admins. So hunker down and get ready to master the ins and outs of Windows previews.

Individuals: From joining the program to testing new features

A word of warning: Before you join Insider, think long and hard about it — and about where you can safely install preview software. Preview builds can be buggy and can harm your system. The features they introduce may not work properly, or may not work at all. The overall operating system itself could become unstable, as could any applications running under it. Windows may freeze or crash.

So it’s best not to install Insider preview builds on your primary PC. You’d be safer using a second or third PC, or even running Windows 11 as a virtual machine and updating it there.

That being said, here’s how to enroll if you want to go ahead.

Join the Windows Insider Program

First, go to the Windows Insider Program page and sign up by clicking the Join Windows Insider button, then clicking Register now on the page that appears. It’s free to participate. (To join, you must have a Microsoft account.) Once you do that and follow the instructions, you’re part of the Windows Insider Program.

Configure your PC and choose a channel

But signing up is only the first step in the process. That just registers you. Next you’ll need to individually configure each PC on which you want to get Insider builds. That way, you can get the builds on some of your PCs but not others. You can even configure different PCs to get updates on different “channels” than others. (More on channels in a moment.)

To configure a PC to receive Insider updates, open its Settings app, choose Windows Insider Program > Get started, and follow the instructions. (When you click the button, you may get a message saying you need to link your Microsoft account to the Windows Insider program. Follow the simple instructions to do it.)

Getting ready to receive Insider updates.

Preston Gralla / Foundry

Note: Microsoft requires that you allow your PC to send specific diagnostic data to Microsoft if you want to test Insider builds. To do it, go to Settings > Privacy & security > Diagnostics & feedback. Then in the “Send optional diagnostic data” section, move the slider from Off to On.

When you’ve done that, go back to Settings > Windows Update > Windows Insider Program and you’ll have several choices to make. First, choose which Insider channel you want to use. There are three of them:

• Experimental channel: Here’s where Microsoft first releases new features and ideas, which frequently have long lead times and won’t soon end up in Windows. Many features it tries out here never make their way into Windows. Microsoft says this channel is best for “tech enthusiasts.” The company warns: “You should expect some rough edges and variable stability in this channel.”
• Beta channel: If you don’t like the risks of living in the fast lane but still want to see updates before the general public, choose the Beta channel. This channel gives you a preview of fixes and new features that have been tested are not quite ready for prime time. Microsoft describes the channel this way: “The Beta channel is for early adopters and IT professionals who want to see what we plan to ship in the coming weeks and validate the latest Windows updates and features, but still need reliable updates.”
• Release Preview channel: This channel gives you (and IT admins) a chance to preview an upcoming Windows update before it’s released to the general public. It’s basically the final version of the update that will go out to the public in a few days. Note that by default, the Release Preview channel doesn’t appear as an option when you’re choosing a channel. To make it appear, click the down arrow next to “Advanced options,” and in the “Show Release Preview” section, move the slider to On.

Choosing a channel and version for receiving Insider updates.

Preston Gralla / Foundry

Once you’ve chosen a channel, make sure you’re choosing updates for the right version of Windows 11. To do it, click the down arrow next to “Advanced options” and choose a version. These are the options available as I’m writing this, which will change as new versions of Windows roll out:

• Windows 11, version 25H2/26H2: This option covers Windows 11 25H2, the standard version of Windows 11 that most people have now, and its successor, Windows 11 26H2, which is beginning to roll out now. This is the selection that most people will likely make.
• Windows 11, version 26H1: This is a separate branch of Windows 11 from the mainstream 25H2/26H2. It’s only for people who have PCs with Qualcomm Snapdragon X2 Series processors purchased in 2026. People with 25H2 or 26H2 can’t switch to version 26H1, because their hardware won’t support it. Those with 26H1 can’t switch to 25H2 or 26H2.
• Future Platforms: This option is available for Windows 11 25H2/26H2 and 26H1, but only if you’re in the Experimental channel. Aimed solely at developers and extremely sophisticated technical users, it’s the bleeding edge of Windows and can be highly unstable. Microsoft notes, “This build core version is aimed at highly technical users who want to preview platform changes that require a longer lead time before release. Examples include major changes to the Windows kernel and new APIs. The builds released to Future Platforms represent platform changes early in the development cycle and should not be seen as connected to any specific retail release of Windows.”

If you choose one of the latter two options, you’ll be placed in a specialized channel. For example, choosing Experimental and the standard Windows 11 version (currently 25H2/26H2) puts you in the main Experimental channel, but choosing Experimental and Future Platforms puts you in a channel called Experimental (Future Platforms).

What was that about making the channel system less confusing, Microsoft?

Test builds, provide feedback

Whichever channel you choose, you’ll begin receiving updates for that channel in Windows Update. Each build is documented with release notes in the Insider Flight Hub. Microsoft’s Windows Insider Blog typically announces each batch of new builds as they roll out, with direct links to the release notes for each channel’s latest build.

You’ll be invited to provide feedback on the preview builds you test via Microsoft’s Feedback Hub. For details, see Microsoft’s “Deeper look at feedback” info page.

A word about features in the Experimental channel

Perhaps the biggest source of confusion about Insider builds has been that you might not see all the features discussed in the documentation for a given build. That’s because Microsoft rolls some features out to different users gradually — a process it calls controlled feature rollouts (CFRs).

The idea is to test the features on a subset of devices that the system deems best able to handle them, monitor them to see how they perform, tweak them if needed, and eventually deliver them to everyone in the channel. This technique makes sense from Microsoft’s perspective, but it’s confusing and frustrating for Insiders who don’t know when they’ll get a feature that’s been announced.

The good news is that Microsoft no longer uses CFRs in the Beta channel. If you’re in the Beta channel, you’ll have access to all the features mentioned in the release notes for a build.

The Experimental channel, though, still uses CFRs. There is one possible workaround: you may be able to turn these delayed features on manually using a setting called feature flags. Feature flags also provide a way to turn off some experimental features that you don’t want to test. Here’s how it works.

Before installing a new Experimental channel update, go to Settings > Windows Update > Windows Insider Program > Feature flags. You’ll see a list of features that you can turn on or off. (By default, new features are turned on in the Experimental channel, except if they’re under controlled feature rollout.) You can use the available flags to manually turn the features on and off, “even if CFR is being used to gradually roll out that feature,” Microsoft says.

width="1024" height="719" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Turning new features off in the Experimental channel.

Microsoft

Note that feature flags are not available for all of a build’s features — only those that Microsoft allows. Bug fixes and overall system improvements, for instance, often don’t have feature flags that you can turn off or on.

If you turn a feature on or off, you can later change it back from the same page.

Switching between Insider channels

To a limited extent, you can switch from one Insider channel to another. You can only switch between channels for your specific Windows version — as I write this, either Windows 11 25H2/26H2 or 26H1. You also can’t switch in and out of the Experimental (Future Platforms) channel.

So you can go directly from the Release Preview channel to the Beta or Experimental channel, for instance, or from the Beta (26H1) channel to Experimental (26H1) or Release Preview (26H1). To do it:

1. Go to Settings > Windows Update > Windows Insider Program.
2. Select Choose your Insider settings.
3. Choose the button next to the channel to which you’d like to switch. You’ll get the update for your new channel the next time one is ready.

You can’t move directly out of the Experimental channel to another channel. If you want to switch to another channel if you’re in Experimental, you’ll first have to wipe your PC, then re-install Windows, and then enroll in another channel.

IT administrators: Joining Insider and choosing the right channel

IT administrators need to know what changes are being made to Windows before they happen so they can prepare to support them. To help them, Microsoft offers a separate Windows Insider Program for Business, which has additional features and tools geared toward enterprise needs. Admins can choose to install Insider preview builds on individual PCs or virtual machines for testing, or they can centrally manage Insider builds on multiple devices across an organization using a variety of management tools.

To get started, head to the Windows Insider Program for Business page, click Register, and follow the instructions. Microsoft’s “Start running Windows Insider Preview Builds as a business” documentation page walks you through how to set up individual PCs or virtual machines to test Insider builds, and “Manage Insider Preview builds across your organization” provides in-depth information on registering your Entra ID domain and managing test devices through Group Policy, Intune, and other management tools.

When it comes to choosing Insider channels for test devices, IT has the same options as individuals. For more details about each, see the channel descriptions in the previous section of this article. However, there are a few additional things IT admins need to know about each channel:

• Experimental channel: This may not be the best channel for IT administrators to use, and not just because it’s the buggiest. Microsoft introduces features and settings in this channel that it eventually discards, which means that IT admins will be wasting their time checking out and preparing for features they’ll never use.
• Beta channel: This channel may be the best choice for IT admins. Not only does it tend to be fairly stable, but by the time a feature reaches the Beta channel, it is intended for the next Windows release, not some nebulous future date. Choosing this channel, admins can get a heads up about what’s coming in Windows in the near future without wasting their time testing capabilities that may never make it into the operating system. And they will also have the most influence over the direction of Windows, because they’ll be commenting on features or bugs at a time when they can be changed or fixed.
• Release Preview channel: This is the most conservative choice for IT. It’s the most stable version, and what’s here ends up in the next Windows update. IT professionals can use the Release Preview channel to make sure their applications and infrastructure will be ready for new Windows updates when they ship. Go to Microsoft’s “Validate upcoming releases in the Release Preview Channel” documentation for details.

One last resource admins should know about is the Windows Insider Program Tech Community forum, where IT pros from around the world post feedback, share tips, and discuss problems and workarounds for the Insider builds they’re testing.

This story was originally published in September 2017 and most recently updated in October 2026.

See more Microsoft tips and tutorials

A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme. [...]

Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data. [...]

Anthropic on Tuesday said it's expanding a program that allows vetted cybersecurity professionals to test its advanced artificial intelligence (AI) models with reduced safeguards and blocking classifiers, as the company claimed its Project Glasswing initiative uncovered at least 129,000 verified software vulnerabilities between April and July 2026. The company said it also found an additional Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer). The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A newly-disclosed critical flaw in Atlassian’s data center software has a remarkably wide reach, affecting eight core products across the company’s enterprise portfolio.

CVE-2026-21589, rated 9.3 (critical) in severity, is an arbitrary file access vulnerability that could allow an attacker with no login access to read files in web app root directories that they should not otherwise see, and potentially use them for nefarious purposes.

The impacted products require “immediate attention,” Atlassian said in a security advisory. Customers should patch to the latest fixed versions. The company said it has not yet found evidence of exploitation in its cloud offerings, which are already patched.

What is particularly concerning about this vulnerability is that it doesn’t require authentication or user interaction, and it impacts a broad set of Atlassian products that many organizations rely on for development, collaboration, and IT operations.

“On the surface, arbitrary file access might not sound as serious as remote code execution, but the real issue is what an attacker could potentially get access to,” said Erik Avakian, technical counselor at Info-Tech Research Group. “The business risk isn’t simply someone reading a file; it’s what that information could potentially allow them to do next.”

Patch now or isolate exposed instances.

The arbitrary file access vulnerability is present in all versions of Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible, Fisheye, Jira Service Management Data Center, and Jira Software Data Center.

It allows unauthenticated attackers to access the web application root directory, the base folder on a web server that contains its core structure and required files. In some configurations, there may be sensitive files present that increase risk.

“If sensitive files are present in that location, the information exposed could potentially help enable a much broader attack,” Info-Tech’s Avakian explained.

Using path traversal techniques, attackers could potentially access restricted files and directories outside the web root folder, Atlassian said. One mitigating circumstance: The attacker must already know a file’s exact name and path, and cannot do a directory listing.

For those who can’t patch right away, the company advised removing affected instances from the internet and restricting internet-accessible instances from external network access. This includes instances that require authentication. This is because “a login page does nothing against an unauthenticated flaw,” Dickson noted.

Atlassian outlined three temporary mitigations to block attackers:

Customers using any of the eight listed products could apply a rule on a Web Application Firewall (WAF) or proxy layer.

Another option is blocking requests using a Tomcat RewriteValve rule on each node in their data center cluster for Bamboo, Confluence, Crowd, Jira Software, and Jira Service Management. Each node should then be shut down and restarted. And Bitbucket users could back up their instances, write a rule in urlrewrite.xml, apply it to every node, mirror, and mirror farm node, and then restart.

But Atlassian called the mitigations “limited and not a replacement for patching your instance,” adding that it cannot confirm whether a particular enterprise’s instances have been affected by this vulnerability. “Engage your local security team to check all affected instances for evidence of compromise,” the company advised.

“The vendor cannot tell you whether you were visited. Only your logs can,” Dickson observed.

Files that could unlock sensitive secrets

The list of impacted products is particularly notable, Dickson pointed out: Bamboo builds and ships software. Bitbucket holds source code. Crowd manages identity and single sign-on. Jira and Confluence hold the company’s plans, service desk tickets, and documentation.

“These are the keys to the kingdom,” he said. “Attackers know it.” And to access them, they need no login, no user click, and no special conditions.

The patch path explains why some customer updating lags; Atlassian no longer ships binary patches, so fixing this means moving to a new maintenance release, he pointed out. That is an upgrade project rather than a quick fix, and every “we cannot update yet” is a risk acceptance.

But the most telling detail may be the flaw’s scoring vector, Dickson noted. It is rated as having no impact on the vulnerable server’s own integrity and availability, but assesses high impact on subsequent systems across confidentiality, integrity, and availability. In other words, the Jira or Confluence server survives untouched, but the systems its files unlock may not.

Essentially, “it is a burglar who takes nothing but the key ring by the front door,” Dickson said.

Exploitation requires a target file’s exact name and path, is limited to the web application root, and cannot do directory listings. “That sounds like a high bar,” he said. But “it is lower than it looks.”

Anyone can download these products and learn exactly where files live, he pointed out, and attackers also have the installation guide.

Additionally, configurations containing sensitive files increase an enterprise’s risk. “After years in production, a web root may collect configuration files, backups, and credentials nobody remembers putting there,” Dickson noted. “One readable secret becomes the first step in a much larger attack.”

Bottom line: The flaw “only” reads files, but the files it reads may open everything else, he said. “Patch, and if you cannot patch today, unplug it from the internet today.” Then, he advised, filter, search access logs for the published traversal pattern, and decode each line. If you find hits, assume the file was read. From there, rotate every credential, token, and key that could have lived in the web root.

Going forward, enterprises should focus on reducing their external exposure as much as possible and restrict access using VPNs, trusted networks, segmentation, or other controls, Info-Tech’s Avakian advised. Rotate sensitive credentials or secrets if exposure is suspected.

However, he noted: “These are compensating controls and they can certainly buy you time, but they shouldn’t be viewed as a replacement for getting to a tested and validated fixed version.”

This article originally appeared on CSOonline.

“Which settings are we supposed to use?” is a reasonable question from an administrator building a server.

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]

Apache published four Struts security notices on October 5, 2026. The fixes are in the new 6.12.0 and 7.4.0 releases.

An npm package used throughout the SubQuery project was poisoned.

On an affected host, a second mount of the same NFSv4 share could alter SELinux label handling on the first.

On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]

Attackers hijacked three top-level domains and used their control to mint counterfeit TLS certificates for Google and other large organizations, Google said Tuesday.

The attackers launched a series of attacks on the .gh, .sl, and .as country code top-level domains (ccTLDs) and then modified authoritative DNS records for selected domains within those namespaces. By controlling those DNS records, the attackers were able to pass automated domain control validation checks and obtain unauthorized certificates for “several Google domains” and “several leading global brands and widely used online services.” Google said it updated Chrome to block all certificates it identified as unauthorized, and worked with the issuing certification authorities to ensure the unauthorized certificates for Google properties were revoked.

Certificate issuance: The weak link in the chain

TLS certificates are the cryptographic credentials that underpin authentication and encryption protections for websites, mail servers, and other Internet infrastructure. These x.509 certificates use a digital signature to bind a domain name such as google.com to a public key. The public key is publicly available, while the private key is held only by the website operator. When a connection shows that the keys match, the visiting party knows it’s connected to the authentic site rather than an impostor. Possession of unauthorized certificates allows attackers to cryptographically impersonate the affected infrastructure.

Read full article

Comments

Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The products, which claim to offer campaign optimization, spend audits, and business-account connections, are designed with one goal in Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the name of a real binary, it may Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]

UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. [...]

A number of studies reported a decline in tech jobs in September as the US continues to get squeezed by geopolitical and economic instability.

Tech consortium CompTIA said 10,350 positions in the technology sector were lost in September, lower than the 14,700 positions cut in August.

But economy-wide, tech jobs — which include IT roles not associated with tech sector — took a bigger hit. Tech jobs across all industries fell by about 6,000, a sharp reversal from the 86,000 added in August.

CompTIA’s report is based on an analysis of the US Bureau of Labor Statistics’ September jobs report, which found that only 29,000 nonfarm jobs were added in the US in September, lower than expectations. The US added 133,000 jobs in August.

Tech worker unemployment ticked up to 3.3%, but that was below the 4.2% national rate, according to CompTIA. The strong August numbers raised hopes that tech jobs were stabilizing, but September’s numbers dashed that hope.

Separately, tech companies announced 10,799 job cuts in September, a 77% rise from the 6,103 announced in August, according to numbers from Challenger, Gray & Christmas.

The tech sector has cut 165,925 jobs this year, up 54% compared to the same period in 2025. US employers cut 43,281 jobs across all sectors in September, compared to 52,881 in August.

Employers are taking a wait-and-see approach in hiring due to rising costs and political uncertainty, despite fewer jobs getting cut compared to August, said Andy Challenger, chief revenue officer at Challenger, Gray & Christmas.

“Employers are facing high energy costs, an uncertain war in Iran, a rate hike that could make hiring more expensive, plus the likelihood of surging healthcare costs,” Challenger said.

Amid the uncertain environment, employers are hiring cautiously, as jobs are tied directly to strategic business priorities, said Ger Doyle, ManpowerGroup’s regional president in North America.

“The market is no longer defined simply by how many people employers hire, but by how precisely they hire,” Doyle said.

Earlier this year, AI was often cited as a main reason for job losses. But that wasn’t the case in September. AI was cited for only 3,961 of the 43,281 job cuts, or about 9% of the month’s total, Challenger, Gray & Christmas said.

Overall, AI was cited for 120,136 job cuts so far in 2026, which is 21% of all cuts.

Even as tech jobs decreased overall, CompTIA noted, Lightcast job posting data showed that US employers posted 272,040 new IT job openings in September, an increase of 16% from September 2025. That mismatch indicates a search for specific skills.

ManpowerGroup said AI skills are the most in demand. “The roles that matter most also take the longest to fill,” Doyle said.

Job postings typically stay open for 61 days, while filling engineer roles typically takes 77 days, Doyle said.

Active job postings requiring AI-related skills totaled 349,821 in September, an increase of 32,327 postings from August, CompTIA said.

A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. [...]