This week’s useful checks are fairly specific: confirm who owns your Windows rollout, review Google Meet’s automatic note-taking settings, and ask your mail provider about Zimbra if that is what they run. For an exposed, unpatched Zimbra server, the security check comes first.
Here is what changed, who it affects and what I would put on the follow-up list. This recap covers the seven days ending at 2:18:24 a.m. Eastern on October 2, 2026, starting at the same time on September 25. It is a selected set of developments, with sources checked through that cutoff.
Windows 11’s 2026 update has started rolling out
What changed: Microsoft announced Windows 11 version 26H2 on September 29. Eligible computers running 24H2 or 25H2 can receive it through a small enablement package, which activates the new release. Availability expands gradually, and compatibility safeguards can hold an update back. Microsoft’s release announcement
Who should care: Businesses managing Windows PCs, and households deciding what to do with an update prompt.
My recommendation for a small office is to pick a representative computer first. Try the work that matters: opening your business application, printing a real document, joining a meeting and accessing shared files. Give someone responsibility for recording what passed and what needs attention before scheduling the rest.
At home, choose a time when a restart will not interrupt something important. If the update is not offered, check the device’s eligibility and Microsoft’s guidance before trying to force it. A staged rollout is not a reason to assume the computer is broken.
Windows settings backup has a new default on eligible managed PCs
Microsoft’s September 30 message says settings backup becomes enabled by default on eligible devices with version 26H2 when an administrator has not explicitly configured the policy. Existing enable or disable choices remain in force. Restore settings still need administrator configuration. Windows message center
Who should care: The person managing your organization’s Windows devices. The feature preserves supported settings and the Microsoft Store app list; it is not a replacement for a complete file, email and recovery plan. Windows settings backup documentation
Ask for two separate answers: “What gets backed up?” and “Have we tested putting it back?” Record which account and device types are covered, then test the restore process on an appropriate spare device. That gives you something more useful than a checkbox that says backup is on.
For the separate question of protecting business email and files, our Microsoft 365 backup and retention guide explains what to review.
Google Meet’s automatic notes deserve a settings check
What changed this week: Settings announced on September 22 began taking effect on September 29. Google added an option to start “Take notes for me” automatically only for meetings with three or more people. That setting defaults on for Business Standard and Business Plus, while several other eligible editions default off. Existing alpha participants may already have it configured.
Google says the rollout can take longer than 15 days. Admin and host settings should be checked in the actual account. Google’s announcement and edition details
Who should care: Google Workspace administrators and anyone hosting meetings about clients, personnel or other sensitive subjects.
Before the next meeting, decide whether notes are appropriate, who should receive them and who will review the result. Tell participants how the meeting will be documented. Treat an AI summary as a draft to check, especially before turning it into a client commitment or assigning work.
New Zimbra research calls for more than checking a version number
Microsoft published new research on September 30 about exploitation of CVE-2026-73570 in Zimbra mail servers. The affected configuration requires the optional zimbra-snmp package and enabled SNMP notifications.
The timeline matters: the fix was in Zimbra 10.1.20, released July 20, and public disclosure followed on August 13. This week’s development is the new investigation, which documents real compromises. It is not a newly released patch. Microsoft’s investigation and response guidance
Who should care: Organizations running Zimbra or paying a provider to operate it. If you are unsure what runs your email, ask your provider directly.
Have the administrator confirm the affected configuration and installation of 10.1.20 or later, then assess whether the server was compromised before patching. Updating alone does not remove every possible trace of an earlier intrusion. Suspected compromise needs incident-response help, including review of persistence and affected credentials.
A short checklist to hand to the right person
Use this as a work list, with a name and a follow-up date beside each applicable item.
| Check | Owner | Useful evidence of completion |
|---|---|---|
| Identify your mail platform | Mail provider or IT administrator | Written platform and version confirmation; investigation plan if Zimbra exposure is possible |
| Plan Windows 26H2 deployment | Person managing PCs | Pilot results for the applications and equipment your team uses |
| Check settings backup and restore | Device administrator | Documented coverage and a completed restore test |
| Review automatic meeting notes | Workspace administrator and meeting hosts | Agreed defaults, sharing expectations and a review step for summaries |
You do not need to turn every technology announcement into an emergency. You do need to know which ones apply and who will handle them. If a task is marked “our provider does that,” ask for the result and the next review date.
IT MGMT can help you work through managed IT responsibilities and cybersecurity priorities. Book a conversation to review what applies to your business. For a household technology question, use our Home IT booking option.
