Threat Intelligence & APT BleepingComputer 3 weeks ago

Microsoft: September updates break File History backup feature

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft warned that the built-in File History backup feature in Windows may stop working on some systems after installing the September 2026 security updates. File History (introduced in Windows 8 and replaced by Windows Backup , which backs up data to OneDrive) automatically saves copies that let users recover accidentally deleted or damaged files using an older version from hours, days, or..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Windows

Microsoft warned that the built-in File History backup feature in Windows may stop working on some systems after installing the September 2026 security updates.

File History (introduced in Windows 8 and replaced by Windows Backup, which backs up data to OneDrive) automatically saves copies that let users recover accidentally deleted or damaged files using an older version from hours, days, or weeks ago.

By default, File History backs up all folders under the user's account profile (Documents, Music, Pictures, Videos, and Desktop) to an external hard drive, such as a USB flash drive, or a network storage location (NAS).

In a service alert seen by BleepingComputer and first spotted by Microsoft MVP Susan Bradley, Microsoft says that affected customers can see application crash events in Event Viewer referencing FileHistory.exe and KERNELBASE.dll.

"After installing the September 2026 Windows security update (the Originating KBs listed above), some customers using File History, might be unable to create or update backups," it said. "File History, available through Control Panel > System and Security > File History, is used to back up files to an external drive or network location."

On affected devices, Windows might also incorrectly display "Reconnect your drive" messages even when compatible backup drives are connected and working properly. Other symptoms include the "Last Backup" timestamp not updating and previously backed-up files showing "No previous version available."

Affected versions Originating update
Windows 11, version 26H1 KB5124012
Windows 11, version 25H2 KB5124008
Windows 11, version 24H2 KB5124008
Windows 11, version 23H2 KB5122880
Windows 10, version 22H2 KB5122878
Windows 10, version 21H2 KB5122878
Windows 10 Enterprise LTSC 2019 KB5122876
Windows 10 Enterprise LTSC 2016 KB5123099
Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →