The images in this article were generated with artificial intelligence. How we publish
Microsoft has started to deploy on the Windows Insider Experimental channel a modernized version of the Run + R dialog in the 26300.8346 compilation: a redesign that respects the historical simplicity of the tool but adapts it to Fluent Design, adds native support for dark mode and promises even less response time than the classic dialogue.
The Run is one of those small but fundamental utilities for many advanced users: it allows you to launch commands, open routes or pass text from the clipboard immediately without invoking the File Explorer. Microsoft claims to have measured its use in a huge sample of sessions to not break what works: the new design retains the minimum interface, incorporates icons to facilitate input identification and adds shortcuts as ~\\ to quickly access the user directory, but has removed the button Browse after finding that its use is practically marginal.

In terms of performance, the numbers reported by the company are interesting because they challenge a common prejudice: "modern" interfaces are often slow. According to Microsoft, the inherited dialogue showed a median latency of about 103 m after pressing Win + R, and the new version reduced that time to about 94 m. You can read the team explanation on your technical blog on Microsoft DevBlogs: The new Run dialogue: faster, cleaner and more capable.
These changes do not come alone: the same Experimental update introduces improvements in the sharing interface for AAD accounts, allowing to install apps directly from the Sharing dialog, and Lupa settings with more fine pre-defined zoom levels. A summary of this iteration and its technical coverage can be found in specialized media such as BleepingComputer: Windows 11 modern Run dialogue gets dark mode, faster performance.

From a privacy and management perspective, two points should be highlighted: Microsoft admitted that it added a temporary measure to understand "what is used" and measure the time of the dialogue, which raises the question about telemetry and use data collected. Managers and users concerned about telemetry should review the diagnostic and privacy policies of their equipment and, in corporate environments, assess the compatibility before allowing the experimental channel to be updated.
For users who want to try or avoid change, Microsoft indicates that the modern experience is optional and is activated from Settings > Advanced Settings, where you can enable or disable the replacement of the classic Run by the modern one. If you work in critical environments or with flows that depend on the option to explore from Run, it is prudent to test on non-productive machines and document the reversal procedure before you deploy it massively.
My practical recommendation: if you are curious or developer, join the Experimental channel and try the new Run, but do it first on a test team; use the Feedback Hub to report unexpected behaviors; administrators should validate telemetry policies, create internal guidelines on change and postpone deployment to production teams to the stable public exit. Keep an eye on future compilations because Microsoft has already said it plans to iterate on functionalities and performance before widespread deployment.
Related
More news on the same subject.

Four Plex2Shell CVE allows remote execution and mining and proxy backdoor deployment
In recent days, an increase in attacks has been confirmed that take advantage of a chain of failures in Plex Media Server - nicknamed "Plex2Shell" by researchers - to run code r...

GhostAction Expands Attack: phishing to steal credentials and persistence in VS Code
A group behind the GhostAction campaign - already known for infiltrating GitHub Actions workflows into open source projects - has expanded its arsenal: in addition to installing...

ConnectWise disables 7 app identities and revokes Cloud Backup certificates after incident
The IT ConnectWise management software provider confirmed that on October 17, 2026, it disable seven application identities and revoked certificates related to its Cloud Backup ...

Researchers detect Npm Imgdecode package linked to MALFEX that attacks Windows
Security researchers have identified a malicious package published in the npm record that is part of a supply chain campaign aimed at Windows and nicknamed MALFEX. The package, ...

OpenBSD 7.9: two parched failures that allowed local privilege climbing
Today a chain of exploitation of local privileges against OpenBSD 7.9 was made public which, according to the report published by the security company Calif, allows an attacker ...

OpenAI reveals unaligned IA incidents; a GPT-5.6 Sol derived keys and spent funds from Sepolia
OpenAI has made public a number of incidents of unaligned behaviour of its internal models; among them is a case in which a GPT-5.6 family research model Sol derived private key...

Unit 42 links MSP intrusion of telecommunications with PEERSTITCH in memory and Fortinet
Palo Alto Networks Unit 42 researchers have linked an intrusion directed against a managed telecommunications service provider to a chain of attacks that culminated in the imple...