Skip to main content

Industry News

Let's talk shop!

332 Topics
S
SophiaAXCommunity Manager
asked in Patch Tuesday
September 2025 Patch Tuesday: Hyper-V, Phone Link, and NTFS Vulnerabilities

Here are some of the more interesting Patch Tuesday vulns we found this month, and what to monitor for!Vulnerabilities in Windows UI XAML CVE-2025-54111 and CVE-2025-54913 (CVSS 7.8) Use-after-free in DatePickerFlyout & MapControlSettings → local priv-esc. Affects Microsoft Phone Link.What to monitor for: XAML-related crashes (Windows.UI.Xaml.dll, ShellExperienceHost.exe) and rapid UWP flyout abuse.Windows Hyper-V Elevation of Privilege Vulnerability  CVE-2025-54098 (CVSS 7.8/10) Improper access control → SYSTEM on Hyper-V hosts/workstations. Patch or disable Hyper-V if not needed.What to monitor: Service creation, token manipulation, new virtual switches, or new Hyper-V enablement.Windows NTFS Remote Code Execution VulnerabilityCVE-2025-54916 (CVSS 7.8/10) Stack overflow in NTFS request handling → potential RCE via crafted file ops/SMB.What to monitor for: NTFS-related crashes, SMB traffic spikes, unusual file activity or lateral movement after file ops.Listen to Automox’s Patch T

100
S
S
SophiaAXCommunity Manager
posted in Industry Discussion
The State of Endpoint Management: A Fireside Chat with Jason Kikta and Dmitri Alperovitch

Tired of endpoint tools that work against you instead of with you?It’s frustrating, right? You’re juggling multiple vendors, your remote workforce creates security gaps, and you spend more time maintaining infrastructure than actually managing endpoints. Time for some real solutions. Join the State of Cybersecurity with Automox CISO/SVP, Product Jason Kikta and Crowdstrike co-founder and former CTOd, Dmitri Alperovitch, on July 9 at 12 pm ET. No corporate fluff, just straight answers for:➡️Eliminating costly tool juggling➡️Getting actual visibility into remote teams➡️Handling the 442% surge in identity tasks (we wish we were kidding)➡️Making autonomous endpoint management work for youCLICK HERE TO REGISTER TODAY.

210
S
AX-YazMoreno
AX-YazMorenoAutomox Employee
posted in Vulnerabilities
🛠️ How to Remediate Vulnerabilities, Test Worklets, and Survive CrowdStrike Reports

Hey IT heroes—We see you. You’ve got 20 tabs open, a half-deployed worklet, and a CrowdStrike report whispering, “You’re not going home on time.” But what if we told you there’s a better way? Join us next week for a no-fluff, expert-led webinar where we’ll walk through real-world vulnerability remediation with testing confidence and just the right amount of “oops-proofing.” 🎓 What We’ll Cover: How to make sense of a CrowdStrike exposure report AKA “translating cyber-paranoia into action.” Worklet walkthroughs with before/after testing Because clicking “Deploy” without testing is the IT version of bungee jumping blindfolded. Sweet32 as your next favorite nightmare We’ll use this infamous KB as our real-world example. You’ll laugh, you’ll cry, you’ll patch. What to do after deployment Enforce, verify, and yes—back out gracefully if things go sideways.  🧑‍💻 Who It’s ForIf you’ve ever yelled “WHY DIDN’T THAT APPLY?” at your screen—this webinar is for you.🔗 The Link Between You an

960
AX-YazMoreno
A
abeidsonRookie
asked in Patch Tuesday
Removing April patches from the Update Patch Only process?

Without setting up an Advanced Policy, is there a way to exclude a patch from being auto pushed in a Patch Policy? It appears the April 2025 patch is causing all sorts of issues with all our older endpoints that aren’t on Win 11 24H2 and want to remove that from trying to update on systems until we can test May’s patches or upgrade them all to 24H2 before the April/May Patch gets applied. 

211
M
S
SophiaAXCommunity Manager
posted in Patch Tuesday
57 Vulnerabilities in March 2025 Patch Tuesday

March already and our third Patch Tuesday of the year with 57 new vulnerabilities!We think you should pay special attention to: Chromium Vulnerabilities March’s release includes several vulnerabilities in Chromium-based browsers like Microsoft Edge. These issues, including use-after-free vulnerabilities in browser profiles, allow attackers to bypass browser sandboxing, exfiltrate data, or spoof identities. Microsoft Management Console Remote Code Execution Vulnerability CVE 2024-26633 is an RCE vulnerability in the MMC. An attacker can exploit this weakness by tricking a user into opening a malicious MMC file, typically distributed through phishing emails or compromised USB drives. Windows NTFS Remote Code Execution Vulnerability CVE 2024-24993 targets an information disclosure vulnerability within Windows NTFS. An attacker can potentially exploit this issue by prompting users to mount a specially crafted VHD.You can read a more in depth analysis here or listen to our Patch Tuesday pod

220
S
S
SophiaAXCommunity Manager
posted in Patch Tuesday
89 vulnerabilities released, and 1 Zero-Day for November 2024 Patch Tuesday

89 vulnerabilities released, and 1 Zero-Day for this Patch Tuesday! You can tune into our Patch Tuesday podcast or read our analysis here. We recommend you pay special attention to: NTLM Hash Disclosure Spoofing Vulnerability This vulnerability is confirmed and exploitation has been detected. The only current remediation is an official fix. Prioritize patching this vulnerability to prevent unauthorized access. Microsoft Defender for Endpoint Remote Code Execution Vulnerability An attacker could exploit this by sending a malicious link via email or instant messaging. Once clicked, the attack unfolds without requiring further interaction from you. In addition to immediate patching, it is recommended to enhance your email filters and educate users about the dangers of unsolicited links. Windows Task Scheduler Elevation of Privilege Vulnerability To mitigate this vulnerability, patching is your most effective strategy. Microsoft has acknowledged the existence of functional exploit code for

200
S
R
richel.valdezRookie
asked in Industry Discussion
Cumulative Update for Windows not showing as available

Hello, We have quiet a few devices that does not have monthly “Cumulative Update for Windows...” available.I don’t see a special pattern. All of them are OS supported and have agent version up-to-date.  I could do an OOB patch to push install the missed CU that is not showing in the available software. But would like to know what others have been practising. What do you do guys do? 

11137
R
T
thetech207Rookie
asked in Patch Tuesday
Windows 11 and WSUS

Patching related, but not Automox specific.Still testing Windows 11 in our environment before starting to upgrade Windows 10 endpoints and we are running out of time. The only issue we have been having is Windows 11 machines don’t seem to want to play nice with WSUS. At best I can get maybe one monthly CU to apply via WSUS, but then, never again. Any other type of update will apply, just never the monthly CU. I even replaced the WSUS server...same problem.These same machines will patch with Ivanti SC and Automox, just not WSUS. I’ve tried everything I can think of...anyone having the same issue? Anyone have a potential solution?

780
T
S
SophiaAXCommunity Manager
posted in Industry Discussion
Proposing the Autonomous Endpoint Management (AEM) Manifesto

Hey Automox Community! As IT pros, we know you're always fighting against the evolving complexities of information systems and traditional endpoint management strategies just aren't cutting it anymore.That's where we propose the Autonomous Endpoint Management (AEM) Manifesto can step in to help. The AEM Manifesto prioritizes user-defined automation, proactive security, and collaborative knowledge to elevate endpoint management as a strategic imperative.We believe endpoint management shouldn't be a hurdle but a strategic imperative that propels your business forward. Discover the 10 principles we think are changing the game of endpoint management.

190
S
A
Anonymous
posted in Industry Discussion
Windows 11 updates API was secretly changed, Here’s what it broke & how to fix it!

Huge shoutout to our own Darrin DiNapoli! Who dug deep into this problem & found the solution! ScopeAutomox customers need not worry! As your devices are scanned, the agent will update and upon next reboot will restore functionally. No action needed beyond your regular maintenance windows. For our non Automox readers, we are unsure the total scope of impacted Windows 11 versions. Whether or not this is dependent on external settings or preferences, or if this issue will arise simply by deploying the KB5037771 update. We of course recommend the update as it includes improvements to critical service in Windows 11 and preps your machine for future security and feature updates. But - let's not get ahead of ourselves, here’s what happened. Unbeknownst to many, a Preview build of the Windows Update API was activated on a subset of Windows 11 devices. This was not part of the well-known Windows Insider Preview program but an obscure and undocumented feature. Users had no control over opti

17431
K
S
SophiaAXCommunity Manager
posted in Industry Discussion
Do you think that most software companies use their own software? | Automox Insiders Podcast

The latest episode of the Automox Insiders podcast has just dropped. Maddie Regis interviews Colby Hall, the team lead for IT operations at Automox, about how we use our own product.Take a listen on your favorite platform or watch on YouTube! Then, come back and answer this discussion question: Do you think that most software companies use their own software?

110
S
S
SophiaAXCommunity Manager
posted in Industry Discussion
Listen Now: CISO IT Podcast with Dmitri Alperovitch and Jason Kikta

Bestselling author, Crowdstrike Cofounder, and Automox Board Chairman Dmitri Alperovitch joins the CISO IT podcast to discuss how cloud tech improves ITOps and cybersecurity. Take a listen now! 

130
S
S
SophiaAXCommunity Manager
posted in Industry Discussion
Cythera's Approach to Cyber Defense | Heroes of IT, Episode 5

Don’t miss this Heroes of IT podcast episode with Cythera! Craig from Cythera, an Australian MSP provider, discusses the Australian Essential Eight and the adoption of cybersecurity strategies in the Australian business community.Take a listen, then come back here and answer this discussion question: Do you wish that your federal government, wherever you're located, had a similar directive to the Australian Essential Eight? Why or why not?

390
S
S
SophiaAXCommunity Manager
posted in Industry Discussion
Listen Now: Worklet's the Word with Kyle Gregg | Automox Insiders, Ep. 6

Check out this latest episode of Automox Insiders to meet Kyle, Senior Solutions Consultant at Automox and Worklet Wiz! Kyle shares his IT background and describes Worklets as powerful tools that go beyond simple scripts.After you have listened to the episode, come back and answer this discussion quetsion: How have Worklets made it easier to control your endpoints and double down on the security of your environment?

130
S
F
Funsho SalawuRookie
asked in Industry Discussion
Does Automox Use Copycat?

Hi All,We had a strange pop-up on devices during/after a recent deployment using Automox. The message came from a application of executable called CopyCat (followed by a image of a white cat holding silver keys). For our piece of mind, can anyone confirm if this is a standard component of Automox, or do I need to be worried?

931
JasonK-Automox
F
Funsho SalawuRookie
asked in Vulnerabilities
What is the Link between Automox and Copycat?

Hi All,We had a strange pop-up on devices during/after a recent deployment using Automox. The message came from an application or executable called CopyCat (followed by a image of a white cat holding silver keys).For our piece of mind, can anyone confirm if this is a standard component of Automox, or do I need to be worried?Advise would be appreciated.

1013
JasonK-Automox
E
eturner22Rookie
asked in Patch Tuesday
Windows Server 2022 patching issues

We are running into issues within our environment with inconsistencies in Automox detecting patches for Windows Server 2022.  We use WSUS and have not had issues approving the updates through WSUS and having servers recognize updates on the servers themselves, but within Automox there is no evidence of any patches available to install. We have had issues with it showing patches available when the Groups are pointed to WSUS as well as directly out to Windows Update. Curious if anyone else has had issues with Server 2022 Patches through Automox. 

1521
K
A
AOkanovicNovice
asked in Patch Tuesday
Has anyone else run into the -2145124318 error message during Windows Cumulative Updates?

I’ve noticed some hosts, especially most of our Windows 11 Enterprise endpoints, will run into an error when trying to apply the monthly Microsoft Cumulative update. The error is a bit unusual, and I haven’t been able to find much on it while researching. The error doesn’t seem to be tied to any Windows Update service/connectivity issues. What is also weirder, is that these Windows 11 hosts report successfully installing this update the first night they try to update, but then the days after get this error. I’ve seen this error on some Windows 10 hosts, but mainly on Windows 11. It seems to point to the update not being compatible with something on the operating system in some weird way. Anyone else seen this before? InstallMSUpdates : Download failed with ResultCode 4 and HResult -2145124318At C:\Program Files (x86)\Automox\execDir135760191\execcmd584584594.ps1:1826 char:21At C:\Program Files (x86)\Automox\execDir135760191\execcmd584584594.ps1:1826 char:21+                     Install

7362
A
L
Landon-AutomoxAutomox Employee
posted in Patch Tuesday
61 Vulnerabilities, and a Chrome Zero Day | May 2024 Patch Tuesday

This month's Patch Tuesday brings 61 vulnerabilities with 1 critical! (89 less CVE’s than last month!)Two particularly alarming CVEs to watch out for: CVE 2024-30033 Windows Search Service Elevation of Privilege Vulnerability [Important] Allows attackers to gain elevated privileges due to a flaw in Windows Search Service. This flaw exists due to improper handling of permissions by the service, which could be exploited to perform unauthorized actions on the system. CVE 2024-30018 Windows Kernel Elevation of Privilege Vulnerability [Important] This issue arises from specific flaws in how the kernel operates, which can be exploited to gain higher levels of access than originally allowed And make sure you've patched the Chrome use-after-free Zero-Day (CVE 2024-4671) that was released on Friday! Listen to the Automox Patch Tuesday podcast or read the blog for more on Patch Tuesday.

600
L
J
jhoyleRookie
asked in Vulnerabilities
Dashboard not refreshing or not synching

The dashboard was working great however over the last couple of days it is showing that I have more patches to apply than I really need. For example it shows I have 23 new patches that are critical but when I click on the 23 then go to open up devices needing any of these patches the lists are empty. It’s been this way for a couple of days now. Is there something that updates the dashboard that is separate from the device scans? With the devices showing they do not need this patch but the dashboard showing the 23 critical updates for different devices something is obviously not in synch. Thanks

1445
jack.smith
sparrowhawk
sparrowhawkNovice
asked in Patch Tuesday
Managing 'stale' MS Teams installs under Windows

We use Tenable.io for vulnerability scanning and it has flagged a number of Windows endpoints that have old versions of Teams installed. I was puzzled by this as Automox patches Teams, and it turns out that because we’re using the machine wide installer, the Teams application is being installed into the user’s Appdata directory. This will only get updated if the user logs in but we don’t regularly log in with some accounts.I’ve read suggested fixes including:Create a GPO that deletes old accounts from the machines. This is problematic for us IT admins. Remove the machine wide installer so that Teams is not automatically installed when a user first logs in.Has anyone found a way to resolve this using Automox? I’d be interested to learn how others have resolved this. TIA

69510
S
S
Selvamuthukumaran ASRookie
asked in Industry Discussion
Customize SQL Patching

I would like to deploy SQL patches (not the latest version) but a N-1 version leveraging ‘Patch Only’ policy or We need to leverage our script to install a specific package.

1631
jack.smith
jack.smith
jack.smithAll Star
posted in Industry Discussion
Listen Now: The Fundamentals of Lasting Customer Satisfaction | Automox Insiders, Episode 4

Customer Engagement is KeyI completely agree that a customer's willingness to engage plays a big role in this success. Because of this, I've built fantastic relationships with various tools in my tech stack.Here's what I've found most engaging with different companies:Collaboration with Product & Engineering: Open discussions with product and engineering teams lead to better insights for future product enhancements. Meeting the Makers: Connecting with the amazing engineers who support or build the tools we use is valuable. Insights on Upcoming Features: Getting a sneak peek at upcoming features is exciting! Efficiency Hacks: Learning how to use tools more effectively is always a win. Early Access: Being part of beta programs for new features can be a great advantage. Customer Advisory Boards: Contributing to customer advisory boards allows you to directly influence product development. Rockstar CSMs: Partnering with rock star CSMs who connect you with the right people and unlock th

91
S
S
SophiaAXCommunity Manager
posted in Industry Discussion
CISO IT Episode with Rich Casselberry, VP of IT Security at ATN International

The latest installment of the CISO IT podcast is out now. Listen on your favorite podcast platform! This episode features special guest Rich Casselberry. Jason and Rich discuss the challenges of security and how to make better risk decisions. They explore the difficulty of proving a negative in security and the lack of obvious metrics of success. They emphasize the importance of balancing risk and finding the right level of security for the organization. Plus a whole lot more! We’d love to hear if you AGREE or DISAGREE with the following statement from the episode: Security is challenging because it involves proving a negative and lacks obvious metrics of success.

690
jack.smith
S
SophiaAXCommunity Manager
posted in Patch Tuesday
150 Vulnerabilities and a Zero-Day Demand Immediate Patching | April 2024 Patch Tuesday

This month's release comes with a notable increase in the number of Common Vulnerabilities and Exposures (CVEs) addressed, marking it as one of the most significant Patch Tuesdays in the past year and a half. Be sure to give the Patch [Fix] Tuesday podcast a listen! Also available on your favorite podcast platform! If you have any thoughts or experiences to share, drop them here for our hosts to see! 

240
S
Terms & ConditionsCookie settings