Help Desk Blogger

Your friend’s laptop got 26H2 last week. Yours still says “You’re up to date.” You press Check for updates, restart, press it again, and Windows 11 26H2 not showing stays the whole story. Seven checks, in this order, will either find the reason or tell you it’s time for the manual route.

Why is Windows 11 26H2 not showing in Windows Update?

Microsoft’s release health page said on 28 October 2026 that 26H2 is available for all eligible devices, so a PC that sees nothing has a local reason: the wrong version, a missing prerequisite update, or the early-offers toggle off.

1. Read your version. Press Windows key + R and type winver. Microsoft’s KB5121794 covers only versions 24H2 and 25H2. On anything older, skip to check 7.
2. Switch on early offers. Open Settings > Windows Update and turn on “Get the latest updates as soon as they’re available”. Microsoft’s 29 September post says the 26H2 option appears there once your device is eligible.
3. Check the prerequisite. KB5121794 requires the 22 September 2026 preview update KB5124010 (24H2 build 26100.9546) or a later one. A 24H2 build ending below 9546 means install updates first.
4. Check for updates and read the whole page. If “Windows 11, version 26H2 is available” appears, select Download & install. KB5121794 says the install needs a restart.
5. Look for a hold. Microsoft may place a safeguard hold on a device with a known compatibility issue. A Learn more link may open “Safeguard holds affecting your device”.
6. Scan release health. The 26H2 page, updated 30 October 2026, lists open issues; a mitigated one on your hardware is a reason to wait.
7. Only now go manual. Microsoft’s download page offers the Installation Assistant and an x64 ISO. Run one after checks 1 to 6, not instead of them.

What does waiting on 24H2 actually cost?

Microsoft’s KB5127648 page says Windows 11 24H2 Home and Pro “has reached end of updates”, so on those PCs waiting now costs you security patches, one day at a time.

Our earlier post on the 24H2 end-of-support deadline explains the date; these four numbers set the urgency, and the 24-month window is from Microsoft’s 29 September post.

The restart figure is the reason not to fear this switch, or more exactly this latch: KB5121794 says the 26H2 features already sit inside the monthly update, dormant until the package turns them on.

KB5127648 says devices without the newer certificates still start and keep receiving updates, so Secure Boot is no reason to wait. Run our three-step Secure Boot certificate check afterwards.

Worked example: take a Home PC on 24H2 on 1 November 2026 whose owner spends 14 more days on this problem. Assumptions: Home and Pro end dates from Microsoft’s lifecycle page (24H2 on 13 October 2026, 26H2 on 9 October 2028), counted as Pacific-time dates. Unpatched days when the owner finally moves: 19 already gone since 13 October plus 14 waiting, so 33 days. Patch days left on 26H2 after that move: 708 from today to 9 October 2028, minus the 14 waited, so 694 days. The same sum on 25H2 gives 345 days left today, and moving to 26H2 adds 363 more. Now do yours: open winver, read your version, and set the calculator to match.

Which fix fits your PC after winver?

Match your winver result to one row: the version decides the route, the build decides whether you must update first, and a hold message decides whether to wait.

Row 3 catches people: winver says 24H2, the toggle is on, and still nothing, because the minimum update never installed. On Microsoft’s Q&A forum on 30 October 2026 a volunteer moderator there pointed a poster to the 26H2 ISO, while an independent advisor first asked which version the PC ran. We would put the ISO last, because it skips the diagnosis.

Friction points: holds, hardware and known issues

Holds and hardware can still stop the offer: Microsoft’s 26H2 pages do not say whether safeguard holds apply to 24H2 and 25H2 PCs, and the manual route works only on x64 processors.

Microsoft’s hold page says holds lift once the issue is resolved. That is the grey area, and our opinion is plain: if Windows shows a hold, wait, because the issue behind it is what the manual route cannot skip.

The download page says installing on an unsupported PC “is not recommended and may result in compatibility issues”, and tells Arm-based PCs to wait for Windows Update.

Release health still lists USB audio failures on USB Audio Class 1.0 devices as mitigated, not resolved. If a USB headset runs your day, read our USB audio Code 10 triage first.

• Forcing past a hold. Wrong when the known issue touches your hardware; check release health first.
• Work or school PCs. Update rings and policies still apply, so ask your admin before using an ISO.

Decide this week whether to wait for the offer or go manual. A 24H2 Home or Pro PC should not wait: once checks 1 to 5 pass and no hold shows, run the Installation Assistant. A 25H2 PC can give the offer one more week. Either way, start by writing down your winver version and build.

"Your iPhone is up to date," Settings says. Yet the last update you remember landed in spring. If that phone is an iPhone 8, an X or older, you read it right: Apple's iPhone security updates for those models stopped after 11 May 2026, while newer phones were patched again on 26 October. Before you shop or panic, check one date: the day Apple released your version.

How do I check when my iPhone was last patched?

Read your iOS version in Settings, find that exact number on Apple's security releases page, and note the date beside it; that date, not the "up to date" message, tells you whether fixes are still coming.

1. Read the version. Open Settings, General, About and note the iOS Version line.
2. Find its date. Search that number on Apple's security releases page, which lists each release's date and models.
3. Count the days. Count from that date to today.

Step three is the sum to remember: "up to date" only means no newer build exists for your model. In January 2026 an iPhone X owner on Apple's Support Community asked whether the phone was still safe for banking. Nobody could name an end date.

Is the iPhone 8 still getting security updates?

Not since 11 May 2026: Apple's last release for the iPhone 8, 8 Plus and X was version 16.7.16, and that branch sat out every later wave of fixes that reached newer models.

Apple's list shows the branch's 2026 rhythm: 26 January, 2 February, 11 March and 11 May, then silence. The May release fixed a notification bug (CVE-2026-28950) with no reported attacks. The iPhone 6s, 7 and first SE, on version 15.8.8, stopped the same day.

Then, on 26 October, version 18.7.11 for the XS and XR fixed CVE-2026-86950, a CoreGraphics bug Apple says "may have been exploited in an extremely sophisticated attack" on versions before iOS 27. Nothing shipped for iOS 16 or 15, and Apple has not said whether they carry the bug. That unknown is the real risk for an iPhone X owner, more than any one flaw, really.

Apple never announces the end. Microsoft prints its dates, as with Office 2021's end of support and the Windows 11 24H2 cut-off; Apple leaves you to infer it from a gap, and we think owners should do that sum now.

Four figures from Apple's security releases page, read 30 October 2026, show who is covered and at what cost.

The XS card deserves a second look: missing a major iOS version is not missing fixes. The patch stream is what stopped for the iPhone 8 and X.

Which models still get iPhone security updates?

Every iPhone from the XS and XR onward got a security release on 26 October 2026, while the iPhone 8, 8 Plus, X, 6s, 7 and first-generation SE have had nothing since 11 May.

Find your model and read across; versions are as of October 2026.

The middle rows split on one date: the release date, not the version number, is what to check.

Worked example: an iPhone X shows version 16.7.16 on 30 October 2026. Assume 11 May is its latest release and the branch's longest earlier 2026 gap is its normal ceiling. 11 May to 30 October is 20 + 30 + 31 + 31 + 30 + 30 = 172 days. 11 March to 11 May is 20 + 30 + 11 = 61 days. 172 divided by 61 is 2.8. Past twice, we treat the phone as unsupported for banking and passwords.

Does the iPhone 11 get iOS 27?

Yes: Apple released iOS 27 on 14 September 2026 for the iPhone 11 and later, the same floor as iOS 26, so a leak claiming four older models would be cut turned out to be wrong.

MacTrast reported on 4 June 2026 that a leaker, Instant Digital, expected iOS 27 to drop the iPhone 11, 11 Pro, 11 Pro Max and second SE. Apple's 27.2 notes say "iPhone 11 and later", and we would call selling an iPhone 11 on that rumour a mistake. It lacks only Apple Intelligence, which those notes limit to the iPhone 15 Pro and later.

• No way back. Apple says installed updates cannot be downgraded, so stay on 26.7.x until you want iOS 27.
• Bank apps follow the bank. The App Store listing's Compatibility line shows each app's minimum iOS.
• Nothing breaks on a date. Unlike Wemo plugs after Belkin's shutdown, an old iPhone keeps working unpatched.

So did they stop in May? For the iPhone 8, X, 7 and 6s, yes, as far as Apple's own list shows; for the XS and later, no. The decision is whether that old phone still deserves your passwords. This week, read your version and count the days. Past twice the branch's longest 2026 gap, move banking and password apps to a supported phone. If Apple's list shows a newer build for your model, recount before you buy.

Windows Security shows a green tick beside Secure Boot, yet every headline says a certificate ran out. Both can be true, and that gap is the whole problem. Microsoft's Windows Production PCA 2011 expired on 19 October 2026, and the secure boot certificate that replaces it may or may not be on your PC. You can find out in about a minute, in three places, checked in order.

How do I check if my PC has the Secure Boot certificate update?

Run three checks in order and stop at the first clear answer: the exact wording in Windows Security, Event 1808 or 1801 in Event Viewer, then one registry value read in PowerShell.

1. Windows Security. Open Device security, then Secure Boot, and read the sentence under the badge. On Microsoft's status page, "all required certificate updates have been applied" means no action, while "older boot trust configuration" means install updates and restart.
2. Event Viewer. In the System log, filter for source TPM-WMI. Event 1808, "This device has updated Secure Boot CA/keys," is the all-clear. Event 1801 means certificates updated but not yet applied to firmware, per Microsoft's events list.
3. PowerShell. In an administrator window, run Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing | Select-Object UEFICA2023Status, UEFICA2023Error. Microsoft's registry page treats Updated with an error of 0 as finished; NotStarted or InProgress means not yet.

That is the one-minute check to run on your own PC tonight, and step one alone is not enough. Malwarebytes wrote on 28 May 2026 that a green checkmark alone does not confirm the new certificates were applied. An asker on Microsoft's Q&A site wanted to know how to confirm the fix had worked, which says plenty about the signal, or maybe just how many people share the question.

Will my PC still boot now the 2011 certificates have expired?

Yes: Microsoft says devices without the 2023 certificates continue to start and operate normally, and ordinary Windows updates still install, so an expired date alone does not lock you out.

What stops is the early-boot side. Microsoft states that such a PC can no longer receive new Boot Manager updates, Secure Boot database and revocation-list updates, or fixes for newly found boot-level flaws. Our reading: maintenance, not emergency, but with no natural reminder, so it gets skipped. The fix arrives through Windows Update, so confirm your build with the Windows 11 24H2 winver check, and if updates keep failing, start with the September Windows 11 update problems.

Worked example: a Windows 11 PC with Secure Boot on has never logged Event 1808, and still holds its factory 2011 certificates. Today is 25 October 2026. The key-exchange certificate expired on 24 June 2026, so 24 June to 24 October is 30 + 31 + 31 + 30 = 122 days, plus one to reach today: 123 days. That PC has booted through 123 days of an expired certificate without failing, so expiry alone is not the risk; the missing 2023 certificates are.

Four numbers frame the urgency, and the retry schedule comes from Microsoft's troubleshooting guide.

The retry cadence makes patience a fair first move: a PC showing Event 1801 may simply be mid-way.

What does each result mean, and what should I do?

Find your row and read across: 1808 means finished, 1801 means restart and recheck, errors 1795 and 1796 point at the firmware, and 1032 means pause BitLocker first.

Only the error rows need a human: Microsoft says to contact the device maker for 1795, and 1032 sits with your BitLocker setup.

Does the Secure Boot update trigger BitLocker recovery?

It can: Microsoft logs Event 1032 when your BitLocker setup would trigger recovery mode if the update were applied, and its fix is to suspend BitLocker for two restarts, then turn it back on.

Microsoft also notes a device may ask for the recovery key once after the update; enter it and check for firmware updates. Windows Latest reported on 26 May 2026 that HP had acknowledged a BIOS update leaving some commercial PCs in a BitLocker recovery loop, with the 2023 certificates failing to install meanwhile. Our call: treat every firmware update on a BitLocker PC as a recovery-key moment, and store the key somewhere that is not that PC.

One poster on Microsoft's Q&A forum described a status stuck at InProgress with events 1796 and 1801 repeating, an update that keeps retrying and never lands.

• Secure Boot off. A PC in legacy BIOS or CSM mode, Malwarebytes reports, sits outside this update.
• Reset to defaults. Microsoft says avoid it unless the maker's defaults include the 2023 certificates.
• Dismissed warnings. Dismiss installs nothing, and Microsoft calls it not recommended.
• Windows 10. Microsoft's expiry page lists Windows 10 22H2, so run the same three checks; patch timing is in the Windows 10 ESU extension to October 2027.

The decision is whether to wait for Windows or step in yourself, and for most PCs it is wait. Tonight, run the three checks. At Event 1808, close the laptop. Otherwise install updates, restart, recheck tomorrow, and touch firmware only once your recovery key is saved off the PC.