Cybersecurity

Microsoft Introduces $150 Windows Server 2025 Hotpatching Fee Starting July 1

Published

22 seconds ago

April 28, 2025

Windows Server 2025 hotpatching subscription announcement

April 28, 2025 – Microsoft has confirmed that starting July 1, 2025, its hotpatching feature for Windows Server 2025 will transition from a free preview to a paid subscription, priced at $150 per year for a 100-core server. This technology, which allows administrators to apply security updates without rebooting, aims to reduce downtime for on-premises servers but has sparked debate among IT professionals about its cost and value. As businesses increasingly rely on uninterrupted operations, Microsoft’s decision highlights the evolving landscape of software updates and the costs associated with maintaining secure systems.

Hotpatching enables security patches to be applied without requiring a system restart, significantly minimizing downtime in critical environments. The new subscription fee will apply to on-premises Windows Server 2025 Standard and Datacenter editions, costing $1.50 per core per month—or $150 annually for a 100-core server. The feature, available in preview since August 2024, will follow a three-month cycle: a baseline monthly cumulative update followed by two months of hotpatches, cutting the need for reboots from 12 to 4 per year. This approach aligns with Microsoft’s broader strategy to enhance system reliability, similar to how AI-driven tools are being used to streamline processes across industries.

The decision to monetize hotpatching has drawn mixed reactions from the IT community. A report from The Register highlighted that while hotpatching is offered for free in Azure Editions of Windows Server, the new fee for on-premises servers has raised concerns among administrators. Some argue that the cost is justified, as it reduces the window of vulnerability by enabling faster patch deployment without downtime—a critical factor for businesses where even brief outages can lead to significant losses. Others, however, see it as an additional expense for a feature they believe should be standard, especially given Microsoft’s history of charging for extended support, as seen with the pricing model for extended security updates. Microsoft has clarified that users can opt out of the subscription by disenrolling before June 30, 2025, to avoid automatic enrollment.

Cost Breakdown and Implications

Here’s a look at the key details and considerations:

Pricing: $1.50 per core per month, equating to $150 per year for a 100-core server.
Cycle: One baseline update followed by two months of hotpatches, reducing reboots to 4 per year.
Availability: Applies to on-premises Windows Server 2025 Standard and Datacenter editions; free for Azure Editions.
Management: Requires Azure Arc, though using Arc for hotpatching incurs no additional cost.

The move to a paid hotpatching feature reflects broader trends in the tech industry, where companies are increasingly monetizing advanced features to offset development costs. It was noted in a recent article that Microsoft’s Xbox team has been a significant user of hotpatching, indicating its reliability for large-scale operations. However, the decision to charge for on-premises servers has drawn comparisons to other paid security models, raising questions about accessibility for smaller organizations. This shift comes at a time when cybersecurity is a top priority, as evidenced by the increasing threat of cyberattacks on critical infrastructure, which underscores the need for timely security updates without operational disruptions.

Microsoft argues that the subscription fee is a worthwhile investment for businesses that cannot afford downtime. According to Forbes, hotpatching can simplify change control, shorten patch windows, and ease orchestration, potentially allowing IT admins to reclaim weekends previously spent managing reboots. For industries like finance or healthcare, where uptime is critical, the ability to apply patches without interrupting services could be a significant advantage. However, the cost may deter smaller businesses or those with less stringent uptime requirements, especially as they navigate other IT expenses, such as adopting privacy-focused technologies that are becoming standard in enterprise environments.

The introduction of a paid model also raises questions about the future of software updates. Microsoft will continue to offer traditional updates on its current schedule, meaning hotpatching is optional. However, this trend of charging for premium features could set a precedent for other software vendors, potentially increasing the overall cost of maintaining secure systems. IT administrators will need to weigh the benefits of reduced downtime against the subscription fee, considering factors like their server workload, budget, and operational needs. The decision mirrors broader debates in the tech industry, such as those surrounding digital platform accessibility, where cost and usability are key considerations for users and businesses alike.

Microsoft’s new hotpatching subscription for Windows Server 2025 reflects the growing complexity of balancing security, cost, and operational efficiency in the digital age. While the feature offers undeniable benefits for businesses that prioritize uptime, its cost may prompt some organizations to stick with traditional update methods. As the July 1 deadline approaches, IT professionals will need to evaluate whether the investment aligns with their needs, while Microsoft faces the challenge of justifying the fee to a diverse user base. What’s your take on Microsoft’s new hotpatching fee? Is it a fair price for reduced downtime, or an unnecessary expense? Share your thoughts in the comments, and let’s discuss the future of software updates in enterprise environments.

Cybersecurity

Cybersecurity Firm CEO Arrested for Allegedly Installing Malware on Hospital Computers

Published

2 hours ago

April 28, 2025

Liam Chen

Hospital computer with malware warning sign

April 28, 2025 – The CEO of a small cybersecurity firm in Oklahoma has been arrested for allegedly installing malware on computers at St. Anthony Hospital in Oklahoma City, raising serious concerns about the security of healthcare systems. Jeffrey Bowie, head of Veritaco, a company that claims to specialize in cybersecurity and digital forensics, faces charges under Oklahoma’s Computer Crimes Act after reportedly accessing hospital computers without authorization. This incident underscores the growing vulnerability of hospitals to cyber threats, even from those who are supposed to protect them.

According to Cybersecurity News, the incident occurred on August 6, 2024, when Bowie allegedly entered St. Anthony Hospital and accessed two computers, one of which was designated for employee use only. Security camera footage captured him wandering through the hospital, attempting to enter multiple offices before installing malware on the devices. The malware was designed to take screenshots every 20 minutes and transmit them to an external IP address, as reported by Bank Info Security. Bowie was arrested on April 14, 2025, following a forensic investigation by the hospital, which confirmed the breach but found no evidence that patient data was accessed.

Bowie’s actions are particularly alarming given his role as the CEO of Veritaco, a firm that touts itself as a provider of “top-class” cybersecurity and private intelligence services. Campus Safety Magazine notes that when confronted by a hospital employee, Bowie claimed he had a family member in surgery and needed to use the computer—a claim that investigators have not substantiated. The incident has sparked outrage, as hospitals like St. Anthony are critical infrastructure, and any breach can have severe consequences for patient care. This case highlights the risks of insider threats, a growing concern in the healthcare sector, as seen in recent ransomware attacks on hospitals that have disrupted operations and endangered lives.

Details of the Incident and Charges

Here’s a breakdown of the incident and its implications:

Malware Functionality: The malware took screenshots every 20 minutes and sent them to an external IP address.
Charges: Bowie faces two counts of violating Oklahoma’s Computer Crimes Act, with potential penalties including fines up to $100,000 and/or 1–10 years in prison for felony convictions.
Hospital Response: St. Anthony confirmed no patient data was accessed, thanks to immediate action to address the breach.
Broader Context: The incident reflects the growing vulnerability of healthcare systems to cyber threats, including insider attacks.

The breach at St. Anthony Hospital is particularly concerning given the context of hospital cybersecurity. Security Affairs reports that healthcare facilities are prime targets for cybercriminals due to their wealth of sensitive patient data and often outdated infrastructure. The malware installed by Bowie could have been used for espionage, data theft, or even as a precursor to a larger attack, though the exact motive remains unclear. This incident follows a pattern of malicious insider activity in hospitals, with GB Hackers noting recent cases involving a physical therapist accessing patient records and a pharmacist installing spyware on colleagues’ devices. Such breaches underscore the need for robust security measures, a topic also relevant to AI-driven privacy concerns in other sectors.

St. Anthony Hospital issued a statement emphasizing its commitment to data security: “On August 6, 2024, an unauthorized individual was identified accessing a hospital computer in an alleged attempt to install malware. The protection of data and the integrity of our systems are top priorities. Due to precautions in place, the issue was addressed immediately, and no patient information was accessed,” as quoted by Cybernews. While the hospital’s swift response mitigated potential harm, the incident raises questions about how someone like Bowie, who claims expertise in cybersecurity, could exploit vulnerabilities in a healthcare setting.

The case also highlights the broader implications of insider threats in the cybersecurity industry. Veritaco, which employs 2–10 people and offers services like digital forensics and incident response, is now under scrutiny, with its website offline as of this writing. Bowie’s actions betray the trust that hospitals place in cybersecurity firms to protect their systems, a trust that is critical in an era of increasing cyber threats. This incident could prompt healthcare providers to reevaluate their vendor relationships and strengthen internal security protocols, much like how WhatsApp’s recent privacy updates aim to enhance user protection through features like blocking screenshots.

The arrest of a cybersecurity CEO for such a blatant act of malice serves as a wake-up call for the healthcare industry. Hospitals must invest in better employee training, layered security controls, and frequent system audits to prevent both external and insider threats. The incident also underscores the need for stricter oversight of cybersecurity firms, ensuring they adhere to ethical standards. As the case against Bowie unfolds, it will likely spark broader discussions about accountability in the cybersecurity sector and the measures needed to protect critical infrastructure like hospitals. For those interested in cybersecurity trends, exploring AI’s role in digital safety could provide further context on how technology can both help and hinder security efforts.

What are your thoughts on this alarming breach? How can hospitals better protect themselves from insider threats, especially from those in trusted roles? Share your perspectives in the comments, and let’s discuss the future of cybersecurity in healthcare.

Cybersecurity

Apple Warns iPhone Users to Delete Google Chrome Over Privacy Concerns

Published

4 hours ago

April 28, 2025

Michael Thompson

Apple privacy warning with Google Chrome icon

April 28, 2025, Cupertino, California – Apple has issued a stark warning to iPhone users, urging them to delete Google Chrome due to significant privacy risks associated with the popular browser. The alert, which highlights Chrome’s tracking practices, comes amid growing tensions between Apple and Google over user data, spotlighting a broader debate about privacy in the tech industry. As consumers become increasingly aware of how their data is handled, Apple’s move could reshape how iPhone users approach online browsing.

According to NY Post, Apple’s warning stems from Chrome’s reliance on third-party cookies, which Google recently decided to retain despite earlier promises to phase them out. These cookies enable advertisers to track users across the web, collecting data on browsing habits, search history, and more. Apple’s advisory specifically targets iPhone users, noting that Chrome’s settings on iOS do not allow users to disable these cookies, leaving them vulnerable to invasive tracking. This issue is particularly concerning given the rise of AI-driven privacy concerns, as companies increasingly use advanced technologies to collect and analyze user data.

Apple has long positioned itself as a champion of user privacy, often contrasting its approach with Google’s ad-driven business model. Forbes reports that Apple’s latest campaign includes a series of videos mimicking Alfred Hitchcock’s The Birds, depicting trackers as birds spying on users. The campaign, titled Flock, is a direct jab at Google’s initial tracking cookie replacement plan, Federated Learning of Cohorts (FLoC), which Apple mocked for its privacy shortcomings. Apple’s message is clear: iPhone users should switch to Safari, which offers more robust privacy controls, including the ability to block third-party cookies by default. This warning comes at a time when privacy features are becoming a key differentiator, as seen with WhatsApp’s advanced privacy controls that block screenshots and exports to protect user data.

The privacy risks associated with Chrome are not new, but Apple’s alert underscores their severity on iOS devices. AL.com notes that Google’s decision to maintain third-party cookies affects Chrome’s 3 billion users, including an estimated 400 million iPhone users. Unlike Android, where users can disable tracking cookies, Chrome on iOS automatically enables them, and disabling them requires clearing cookies entirely—a process that signs users out of websites and deletes saved preferences. This lack of control has fueled Apple’s criticism, especially as Google aims to convert more iPhone users from Safari to Chrome to bolster its search dominance, a strategy that could be disrupted by TikTok’s potential ban and its impact on digital advertising.

What iPhone Users Can Do

Here’s a breakdown of the situation and user options:

Privacy Risk: Chrome on iOS enables third-party cookies by default, with no option to disable them without clearing all cookies.
Apple’s Recommendation: Switch to Safari, which blocks third-party cookies and offers enhanced privacy features.
Alternative Option: Use Chrome’s Incognito Mode, which offers better privacy but comes with trade-offs in functionality.
Broader Context: The warning reflects ongoing tensions between Apple and Google over user data and privacy practices.

Apple’s warning also highlights the broader implications of in-app browser security risks, a topic that has gained attention in recent years. Colitco points out that Chrome’s tracking practices are part of a larger issue with in-app browsers, which can monitor user activity even within apps like Instagram and Facebook. This aligns with Apple’s App Tracking Transparency (ATT) feature, introduced in 2021, which requires apps to seek permission before tracking users across different platforms. However, ATT does not fully address tracking within in-app browsers, leaving a gap that Chrome exploits on iOS. For users concerned about digital safety, exploring AI-driven privacy solutions could provide additional context on how companies are addressing these challenges.

The tech industry is at a crossroads when it comes to privacy, with Apple and Google representing two opposing philosophies. Apple’s focus on user control and data minimization contrasts sharply with Google’s ad-driven model, which relies on extensive data collection to fuel its advertising business. This clash has been evident in other areas, such as Google’s Veo 2 rollout, which raised questions about data usage in AI-generated content. As privacy becomes a top priority for consumers, Apple’s warning could push more iPhone users to reconsider their browser choices, potentially shifting the balance in the ongoing browser wars.

For iPhone users, the decision to delete Chrome may depend on their priorities. Safari offers a more privacy-focused experience, but Chrome’s integration with Google services like Gmail and Drive remains a draw for many. Those who choose to keep Chrome can mitigate risks by using Incognito Mode or regularly clearing cookies, though these solutions are far from ideal. As the debate over privacy continues, Apple’s warning serves as a reminder of the importance of understanding how apps and browsers handle personal data. What’s your take on Apple’s alert? Are you switching to Safari, or sticking with Chrome? Share your thoughts in the comments, and let’s discuss the future of online privacy.

Cybersecurity

Sophisticated Gmail Phishing Campaign Exploits Google Infrastructure, Puts Users at Risk

Published

6 days ago

April 22, 2025

Liam Chen

A new phishing campaign is leveraging Google’s own systems to dispatch ultra‑convincing scam emails from genuine “[email protected]” addresses. Security experts warn this technique could ensnare millions of Gmail users before filters catch on.

Google first acknowledged the flaw in mid‑April after multiple reports surfaced of fraudulent messages masquerading as subpoena notices. The attack’s sophistication lies in its exploitation of Google’s OAuth framework and DomainKeys Identified Mail (DKIM) — allowing malicious emails to pass authentication checks that normally mark spoofed mail as spam.

Recently I was targeted by an extremely sophisticated phishing attack, and I want to highlight it here. It exploits a vulnerability in Google’s infrastructure, and given their refusal to fix it, we’re likely to see it a lot more. Here’s the email I got: pic.twitter.com/tScmxj3um6

— nick.eth (@nicksdjohnson) April 16, 2025

Why It Matters:
With over 2 billion active Gmail accounts, a successful breach of trust in Google’s email infrastructure represents one of the largest‑scale phishing threats in recent memory. The campaign illustrates how attackers are escalating beyond basic spoofing to weaponize trusted platforms.

In the most prevalent variant, recipients receive an email seemingly from Google saying their account is under legal scrutiny, complete with a fake court case number and a link to review documents. Clicking the link takes victims to a counterfeit login page hosted on Google Sites, where credentials and two‑factor tokens can be harvested. According to a 9to5Mac security alert, the attackers created a malicious OAuth app that signs outgoing mail with Google’s own DKIM signature, bypassing spam filters altogether.

Several early victims described the email as indistinguishable from genuine Google correspondence. “It even used the correct Google logo and footer,” one cybersecurity researcher told Forbes, underscoring how the scam’s professional polish left users with little reason to doubt its veracity.

How the Scam Evades Defenses

To execute the scheme, attackers register an app through Google’s OAuth developer console. They configure it to send messages from a “[email protected]” address and to request only minimal permissions — just enough to harvest the user’s email and basic profile data. Once a user consents (often without reading the fine print), the app gains tokenized access to send mail on their behalf.

Next, the phishers make use of DKIM authentication, which cryptographically signs outbound mail with Google’s private key. Because the signature matches Google’s published DNS record, anti‑spoofing checks pass and the message lands in the inbox rather than the spam folder.

Worst of all, the landing page URL begins with a legitimate “sites.google.com” domain. Victims who hover over the link see “google.com” and rarely suspect the page’s true intent. Once credentials are entered, attackers can log in to the real Gmail account and install malware, exfiltrate data, or pivot to other internal systems.

Google’s Mitigation Efforts

By late April, Google deployed patches to tighten OAuth app verification and began grandfathering in stricter enforcement of its DMARC policy. A company spokesperson told Newsweek that the loophole “no longer allows unauthorized apps to spoof Google’s no‑reply address” and that “users who have not yet been targeted are automatically protected.”

Google also issued a blog post advising all Gmail users to:

Enable Two‑Factor Authentication (2FA). Accounts using SMS or auth‑app codes are significantly harder to hijack.
Use Passkeys. Passkeys replace passwords entirely and are immune to credential‑phishing.
Review Connected Apps. In Gmail’s security settings, users should revoke any unfamiliar OAuth apps.

Despite these measures, experts warn that variations of the scam could emerge. “We’ve seen threat actors pivot to invite‑based sharing links and even abuse Google Forms,” said the lead analyst at a major security firm.

Broader Implications for Email Security

This incident highlights a troubling trend: attackers are moving from simple display‑name spoofing into deeper technical manipulations of trust frameworks. Last year’s surge in AI‑generated phishing made generic scams easier to craft; now, criminals are weaponizing legitimate developer tools against users.

Organizations must therefore rethink perimeter defenses. Briskfeeds recently published a report on corporate email security that recommends advanced solutions, such as:

OAuth Anomaly Detection. Flagging apps that request minimal yet suspicious permissions.
Zero‑Trust Email Gateways. Inspecting inbound mail even if it passes DKIM/DMARC.
User Education Campaigns. Simulated phishing drills to train employees on spotting unconventional threats.

What Users Should Do Now

Even with Google’s patch, vigilance remains crucial:

Verify Unusual Requests. If an email demands urgent action—like reviewing subpoena documents—contact Google support directly rather than clicking links.
Check the App Permissions Page. Navigate to Gmail’s Settings → Security → Third‑Party Apps to revoke dubious entries.
Keep Software Updated. Ensure your browser and OS have the latest security fixes to block drive‑by downloads.
Report Phishing Attempts. Use Gmail’s “Report phishing” feature to help improve Google’s filters.

Conclusion

As phishing tactics evolve, the line between legitimate and malicious email continues to blur. This latest campaign underscores the need for layered defenses, from technical controls to user awareness. For a deeper dive into enterprise‑grade email protections, see our Briskfeeds report on corporate email security. Stay informed—your inbox depends on it.