The images in this article were generated with artificial intelligence. How we publish
If you manage Windows 11 equipment in a corporate environment, you probably have felt a content relief: Microsoft has indicated that it has solved a failure that, after installing certain security updates, left some equipment unable to boot. The problem was solved with the security update distributed in the February 2026 Patch Tuesday.
The situation started with a December 2025 update that was not properly applied on some teams, leaving the system in what Microsoft describes as an "incorrect state" after reversing the installation. When these teams tried to apply successive updates - including patches published from January 13, 2026 - some were caught on a black screen showing a boot volume error, and could not complete the start without a manual intervention. The failure was manifested with the classic boot problem message and a similar error to UNMOUNTABLE _ BOOT _ VOLUME, which forced restorations from means of recovery in the most serious cases.

According to information that has circulated in forums and expert analysis, Microsoft identified that the scope was limited: it affected a limited number of commercial physical devices running Windows 11 in the 25H2 and 24H2 versions, and there were no widespread reports among domestic users or on virtual machines. The company launched an initial solution in an optional package at the end of January (non-security update), with the intention of preventing new equipment from falling into the same problem. The final correction was incorporated in the safety update delivered on 10 February 2026, referred to as KB5077181.
If you want to check the official publication and history of Windows 11 versions, the Microsoft launch status page is a good starting point: Windows release health (Microsoft). To look specifically for updates by KB number, the Microsoft Update Catalogue allows you to locate distributed packages: Catalogue of updates: KB5077181. Also useful is the Microsoft's own tool that brings together security notices: Microsoft Security Update Guide.
Specialized media have followed the lead of this incident and have published summaries and analysis of chronology and impact in business environments. An example of technical coverage that collects the sequence of facts and reactions is the piece published by Bleeping Computer: Bleeping Computer. In addition, the community of administrators and consultants, represented by voices like Susan Bradley in AskWoody, has shared the content of private warnings addressed to business clients, which helped clarify that the resolution was first distributed through business-oriented channels: AskWoody / Susan Bradley.

However, relevant points remain for equipment that already suffered the blockade before the correction came. Microsoft has warned that devices that have already become useless may need additional steps to recover functionality and, in such cases, recommends that business customers contact Microsoft Support for Business to receive specialized assistance. This recommendation is important: although the subsequent update prevents more machines from being affected, it does not replace the technical intervention required to repair systems that were damaged in the process.
It is reasonable to ask why this notice was initially made through private channels and was not published openly, as Microsoft has done in other known incidents. The reasons have not been fully publicly clear, and this lack of transparency complicates the work of managers in assessing the impact and measures to be taken in their machine parks.
If you manage corporate environments, the practical thing now is to confirm which teams have received the February 2026 update (or later) and to review the update history to detect previous problem facilities. If you find devices that do not start before the final patch, the recommended route is to seek specialized assistance for recovery. Maintaining recent backup and having means of recovery and a contingency plan for mass deployments remains, as always, the best defence when a critical update has unforeseen adverse effects.
Related
More news on the same subject.

GhostAction Expands Attack: phishing to steal credentials and persistence in VS Code
A group behind the GhostAction campaign - already known for infiltrating GitHub Actions workflows into open source projects - has expanded its arsenal: in addition to installing...

ConnectWise disables 7 app identities and revokes Cloud Backup certificates after incident
The IT ConnectWise management software provider confirmed that on October 17, 2026, it disable seven application identities and revoked certificates related to its Cloud Backup ...

Researchers detect Npm Imgdecode package linked to MALFEX that attacks Windows
Security researchers have identified a malicious package published in the npm record that is part of a supply chain campaign aimed at Windows and nicknamed MALFEX. The package, ...

OpenBSD 7.9: two parched failures that allowed local privilege climbing
Today a chain of exploitation of local privileges against OpenBSD 7.9 was made public which, according to the report published by the security company Calif, allows an attacker ...

OpenAI reveals unaligned IA incidents; a GPT-5.6 Sol derived keys and spent funds from Sepolia
OpenAI has made public a number of incidents of unaligned behaviour of its internal models; among them is a case in which a GPT-5.6 family research model Sol derived private key...

Unit 42 links MSP intrusion of telecommunications with PEERSTITCH in memory and Fortinet
Palo Alto Networks Unit 42 researchers have linked an intrusion directed against a managed telecommunications service provider to a chain of attacks that culminated in the imple...