Просмотр новости
Найдите то, что Вас интересует
Спутники
РН
SpaceX
Роскосмос
NASA
СпутникиРНSpaceXРоскосмосNASA
AI-based assistants and agents are generally supposed to expedite software development lifecycles. For Microsoft’s Exchange team, it may be doing the opposite, in turn leaving enterprise IT teams waiting for an update that will require extensive compatibility testing before implementation.
In response to customer questions, Microsoft said in a blog post that it was again being forced to delay the first Cumulative Update (CU1) for its Exchange Server Subscription Edition because its engineers were racing against time to validate a growing volume of security findings surfaced through AI-assisted code scanning.
“Over the last few months, various Microsoft execs made statements explaining how Microsoft is leveraging a variety of AI tools to help find vulnerabilities in our products (examples of such announcements can be found here, here and here),” the company wrote.
“Many teams, Exchange Server included, are working through reported issues – which includes validation that they are real security issues, reproducing, fixing, testing for regressions / issues after fixes are deployed and releasing updates monthly,” it added.
The company had initially indicated that CU1 would arrive by the end of the first half of 2026, before revising its target to the second half of 2026. The latest delay, where Microsoft is yet to offer any timeline, therefore marks the second time the hyperscaler has pushed back its expected release window.
A Cumulative Update (CU) is a periodically released package for Exchange Server that consolidates recent bug fixes and security updates, while also potentially introducing new features, architectural changes or removing deprecated components.
Unlike the monthly security updates that Microsoft has continued to issue for Exchange Server Subscription Edition (SE) consistently, CUs represent a more substantial update to the server software and are typically released once or twice a year.
This gives enterprise administrators the option of adopting a consolidated package of fixes and changes rather than managing individual updates separately, although the broader scope of a CU also means enterprises need to conduct more extensive testing before deployment.
Enterprises should stop waiting for a CU1 date
The second revision of the CU1 release timeline combined with the unavailability of a committed shipping date or month, according to Manoj Chandra Jha, principal analyst at Nord-IQ Research, should be reason enough for enterprises to course correct.
Enterprises should start tracking the monthly security update cadence as their operational patch baseline, and treat CU1 as a discrete, trigger-based project ,not a scheduled release until Microsoft provides a firmer signal,” Jha said.
For enterprises that are waiting for a commitment or CU1’s release to begin their preparation, however, the delay shouldn’t mean standing still, Jha pointed out.
“With no committed ship date, CIOs should separate CU1 readiness from Microsoft’s release calendar by maintaining a test environment, inventorying and pre-validating authentication, APIs and management tools, and establishing a fast-track change-approval process that can be activated once Microsoft announces the update,” Jha noted.
AI is moving the software bottleneck downstream
Microsoft’s Exchange isn’t the only company division confronting the unintended consequences of AI-driven increases in software output.
GitHub, which helped popularize AI-assisted coding through its vibe coding tool Copilot, has also been grappling with the volume and quality of code being generated by AI tools.
In February, GitHub considered allowing repository maintainers to restrict or even disable pull requests after maintainers warned that a surge of low-quality, often AI-generated submissions was overwhelming open-source projects. The problem was not simply that AI was generating more code, but that humans were struggling to review and manage the resulting flood of contributions.
GitHub subsequently introduced Stacked PRs in April, saying the feature was designed to help developers manage larger and more complex code changes as AI-assisted development increases the volume of code requiring review. Its rationale was to break larger changes into smaller units, in turn making them easier to review and merge.
AWS too identified a similar issue and in June added release management features to its DevOps Agent to help teams validate, test, and review AI-generated code before deployment.
More recently, AI-based Code Review platform CodeRabbit also added new features to help developers sort and prioritize pull requests in wake of the growing volume and complexity of code changes generated by vibe coding agents.
This mismatch between the volume of AI-generated output and the amount of human attention available to assess it extends beyond code review.
Earlier, in May, GitHub also said it had seen a sharp increase in low-quality security submissions to its bug bounty program, driven in part by newer generative AI tools.
The company responded by scaling back cash rewards for reports with low security impact and asking researchers to focus on vulnerabilities that represent meaningful security risks.
AI-based assistants and agents are generally supposed to expedite software development lifecycles. For Microsoft’s Exchange team, it may be doing the opposite, in turn leaving enterprise IT teams waiting for an update that will require extensive compatibility testing before implementation.
In response to customer questions, Microsoft said in a blog post that it was again being forced to delay the first Cumulative Update (CU1) for its Exchange Server Subscription Edition because its engineers were racing against time to validate a growing volume of security findings surfaced through AI-assisted code scanning.
“Over the last few months, various Microsoft execs made statements explaining how Microsoft is leveraging a variety of AI tools to help find vulnerabilities in our products (examples of such announcements can be found here, here and here),” the company wrote.
“Many teams, Exchange Server included, are working through reported issues – which includes validation that they are real security issues, reproducing, fixing, testing for regressions / issues after fixes are deployed and releasing updates monthly,” it added.
The company had initially indicated that CU1 would arrive by the end of the first half of 2026, before revising its target to the second half of 2026. The latest delay, where Microsoft is yet to offer any timeline, therefore marks the second time the hyperscaler has pushed back its expected release window.
A Cumulative Update (CU) is a periodically released package for Exchange Server that consolidates recent bug fixes and security updates, while also potentially introducing new features, architectural changes or removing deprecated components.
Unlike the monthly security updates that Microsoft has continued to issue for Exchange Server Subscription Edition (SE) consistently, CUs represent a more substantial update to the server software and are typically released once or twice a year.
This gives enterprise administrators the option of adopting a consolidated package of fixes and changes rather than managing individual updates separately, although the broader scope of a CU also means enterprises need to conduct more extensive testing before deployment.
Enterprises should stop waiting for a CU1 dateThe second revision of the CU1 release timeline combined with the unavailability of a committed shipping date or month, according to Manoj Chandra Jha, principal analyst at Nord-IQ Research, should be reason enough for enterprises to course correct.
Enterprises should start tracking the monthly security update cadence as their operational patch baseline, and treat CU1 as a discrete, trigger-based project ,not a scheduled release until Microsoft provides a firmer signal,” Jha said.
For enterprises that are waiting for a commitment or CU1’s release to begin their preparation, however, the delay shouldn’t mean standing still, Jha pointed out.
“With no committed ship date, CIOs should separate CU1 readiness from Microsoft’s release calendar by maintaining a test environment, inventorying and pre-validating authentication, APIs and management tools, and establishing a fast-track change-approval process that can be activated once Microsoft announces the update,” Jha noted.
Microsoft’s Exchange isn’t the only company division confronting the unintended consequences of AI-driven increases in software output.
GitHub, which helped popularize AI-assisted coding through its vibe coding tool Copilot, has also been grappling with the volume and quality of code being generated by AI tools.
In February, GitHub considered allowing repository maintainers to restrict or even disable pull requests after maintainers warned that a surge of low-quality, often AI-generated submissions was overwhelming open-source projects. The problem was not simply that AI was generating more code, but that humans were struggling to review and manage the resulting flood of contributions.
GitHub subsequently introduced Stacked PRs in April, saying the feature was designed to help developers manage larger and more complex code changes as AI-assisted development increases the volume of code requiring review. Its rationale was to break larger changes into smaller units, in turn making them easier to review and merge.
AWS too identified a similar issue and in June added release management features to its DevOps Agent to help teams validate, test, and review AI-generated code before deployment.
More recently, AI-based Code Review platform CodeRabbit also added new features to help developers sort and prioritize pull requests in wake of the growing volume and complexity of code changes generated by vibe coding agents.
This mismatch between the volume of AI-generated output and the amount of human attention available to assess it extends beyond code review.
Earlier, in May, GitHub also said it had seen a sharp increase in low-quality security submissions to its bug bounty program, driven in part by newer generative AI tools.
The company responded by scaling back cash rewards for reports with low security impact and asking researchers to focus on vulnerabilities that represent meaningful security risks.
| # | Наименование новости | Тональность | Информативность | Дата публикации |
|---|---|---|---|---|
| 1 | August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw | 0 | 20.98 | 14-08-2026 |
| 2 | It took $58 to break Microsoft’s SCCM, but a patch made it harder | 0 | 12.46 | 13-08-2026 |
| 3 | Microsoft canceled Copilot Search for Outlook after user outrage, in a rare AI reversal | 0 | 6.01 | 28-07-2026 |
| 4 | AI is finding bugs faster than Microsoft can fix them | 0 | 13.41 | 30-07-2026 |
| 5 | Microsoft ends tradition of naming competitors in regulatory filings | 0 | 5 | 31-07-2025 |
| 6 | Microsoft stops rollout of some Teams and Outlook features | 0 | 12.15 | 24-07-2026 |
| 7 | Microsoft 365 servers down as outage may have hit Teams, Outlook, SharePoint, and more | 0 | 10.42 | 23-07-2026 |
| 8 | Microsoft ends tradition of naming competitors in regulatory filings | 0 | 5 | 31-07-2025 |
| 9 | “Catastrophic Mismanagement” And AI Gambits Led To Mass Xbox Layoffs, Expert Says | -5 | 7 | 06-07-2026 |
| 10 | У властей США нет данных о взломе федеральных ведомств из-за уязвимости в ПО Microsoft | 0 | 0 | 10-03-2021 |