decrypted · 12 october 2026 · vulnerabilities and patching · uk policy and law · digital sovereignty

Microsoft sets an expiry date on Windows Update for machines that fall behind

Last Thursday Microsoft told administrators that a date has been set after which many Windows machines will stop being able to talk to Windows Update. Nobody has been hacked and nothing is broken today. The cause is the humble certificate: a digital credential with an expiry date. Two of the ones Windows uses to trust its update service run out in May and June 2027. For UK organisations, it is a tidy reminder that patching rests on a chain of trust you do not control, and on an inventory you must.

The announcement

Microsoft's Windows message center, posted on 8 October, says the certificates used to establish trusted connections to Windows Update expire on 17 May 2027 and 19 June 2027. Replacement certificates are already reaching supported versions through ordinary monthly updates. A device without them when its deadline passes will, in Microsoft's words, "lose access to Windows Update services and won't receive any updates as a result".

The baseline depends on the version:

Microsoft says devices that receive updates from WSUS are not affected.

The passport

Think of the certificate as the passport your PC shows at the border of Windows Update. A machine that arrives with an expired passport simply finds the gate shut, and it cannot talk its way through.

A machine that stops patching still boots, still runs the till, the scanner and the lab instrument. Nobody raises a ticket for a patch that never arrived. In my opinion, that is how a deadline becomes a security problem a year later.

What the defender sees

Very little before the deadline. Afterwards, devices that fell behind report failed update checks, if anyone is watching. Outdated but supported machines can still be updated by hand from the Microsoft Update Catalog or through existing management tools, per coverage of the announcement. That is a real fallback, but it converts an automatic process into a manual one, and manual processes are where councils, schools, clinics and small firms tend to lose track.

The likely UK exposure is the familiar list: specialist equipment tied to an old Windows build, laptops in drawers, kiosks, and offline estates that rarely connect. That is my inference, not Microsoft's.

The Secure by Design lesson

Microsoft did the right thing: a published expiry date, months of notice and a fix delivered in advance.

The second decision is yours: you cannot extend someone else's certificate, but you can know your estate. The cost is modest:

If you cannot answer those three questions today, the certificate is not your problem. The inventory is.

Also this week

Ofcom opens its first Online Safety Act investigation into Meta. On 6 October the regulator said it will examine whether Meta carried out the illegal content and children's risk assessments required before it launched Instagram Instants, a disappearing-photo feature released in May. Ofcom has stressed this is not a finding of wrongdoing, but a confirmed breach could cost up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. Meta says it ran a risk analysis and briefed Ofcom several times before launch. The design point is plain: assess the risk before shipping, not after.

A fake Claude installer abuses a search ad. Push Security found a Google ad for "claude mac" that displayed bing.com, passed through a Bing click-tracking redirect and a compromised retailer website, and landed on a lookalike download page. The page showed Anthropic's real install command, but its copy button put a different one on the clipboard. Push's write-up does not analyse what the script does. For UK firms, treat developer and AI tool installs as a phishing surface: point staff to an approved internal source, not a search result.

A contractor's system, 8.72 million customers. Japanese karaoke operator Daiichi Kosho says personal information on about 8.72 million customers may have been compromised through a system run by an external contractor. BleepingComputer reports the contractor found malware on an employee's computer and that the data includes names, dates of birth, email addresses and phone numbers, but not passwords. Theft has not been confirmed. It is the supplier-access pattern again: every copy of your data held by a contractor is a copy you must be able to audit.

Sources

If you would like help building the inventory before the deadline, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.

Play here Loads Apple's player when you press it.