News

Microsoft Overhauls Advance Notification, 8 Security Bulletins Coming Tuesday

Microsoft debuted an expanded Microsoft Security Bulletin Advance Notification service on Tuesday. In addition to warning administrators about new security bulletins, the service will now include non-security, high-priority Windows updates and information about updates to the Windows Malicious Software Removal Tool.

Microsoft's security team will deliver about eight security bulletins on April 12, Microsoft's monthly "Patch Tuesday." Four Microsoft product platforms come in for bulletins addressing security issues deemed "critical" in Microsoft's rating system. The number of security bulletins is deliberately vague in the advance notifications, and the fine print notes that the number could change.

Five security bulletins will affect Windows, with at least one of the bulletins earning a critical rating. One security bulletin each will affect Microsoft Office, MSN Messenger and Microsoft Exchange. The maximum security for the Office, Messenger and Exchange bulletins is critical.

The bulletins come after Microsoft formally released none in March following a February that brought 12 bulletins covering 17 security vulnerabilities, 10 of them critical.

Microsoft's advance notification service does not provide details about vulnerabilities. Among outstanding known security problems in Microsoft software are two remote code execution vulnerabilities reported to Microsoft by researchers at eEye Digital Security. The security firm rates both vulnerabilities highly severe. Both affect Internet Explorer, Outlook and several versions of Windows. One was reported to Microsoft March 16, and the other was reported March 29.

Two high-priority updates for Windows that are not security related will also be delivered on the Windows Update site on Tuesday. It is the first time Microsoft has used the Advance Notification to warn users that non-security issues are being patched. In another notification, Microsoft said it will offer an update to the malicious software removal tool, which is available on Windows Update and at the Microsoft Download Center.

On its advance notification page, Microsoft billed the change as "a response to consumer feedback." Critics recently accused the company of trying to slip non-security updates into the code-base quietly through update sites.

Despite the change, Microsoft is reserving the right to make unannounced updates at any time. "This information will pertain ONLY to updates on Windows Update and only about updates being released on the same day as security updates. Information will NOT be provided about Non-security updates released on other days," according to the company's advance notification page.

Microsoft launched the public version of early notification program in November after running the program for a limited group of customers for about a year.

The official Microsoft Webcast to discuss the month's bulletins and security updates will be held April 13 at 11 a.m. Pacific Time. More information is available here.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.

  • Report: Security Initiatives Can't Keep Pace with Cloud, AI Boom

    The increasingly fast adoption of hybrid, multicloud, and AI systems is easily outgrowing existing security measures, according to a recent global survey by the Cloud Security Alliance (CSA) and exposure management firm Tenable.

  • World Map Image

    Microsoft Taps Nebius in $17B AI Infrastructure Deal To Alleviate Cloud Strain

    Microsoft has signed a five-year, $17.4 billion agreement with Amsterdam-based Nebius Group to expand its AI computing capabilities through third-party GPU infrastructure.