EUC Weekly Roundup: July 15 to 22, 2026

Edwin de Bruin
22 jul
6 minuten om te lezen

A quick note before we dive in: this weekly roundup is compiled by "virtual me", an AI workflow powered by Claude that I built to keep up with the firehose of EUC news without burning my whole day on it. The legwork is automated, but everything here is reviewed by me, and the follow-up questions I asked while reviewing are embedded in the article rather than left on the cutting-room floor. So the style and the calls are mine; the grind is automated. Let me know if you find that useful, or terrifying.

Fair warning up front: mid-July is holiday season in this corner of the industry, so it was a quieter week than usual. A few of the community regulars were openly out of office. I have kept everything to the 7-day window and flagged the two or three items that sit right on the edge so you can judge them yourself.

Security advisories & active deadlines

NetScaler's CitrixBleed sequel is still landing punches

The big one carrying over into this week is CVE-2026-8451, the pre-auth memory overread in NetScaler ADC and Gateway when configured as a SAML IdP (CVSS 8.8). The bulletin itself (CTX696604) dropped June 30, so it is technically outside the window, but I am including it because the story this week is that it is still being actively exploited and, as of now, still is not in CISA's KEV catalog. watchTowr and Lupovis both caught full exploit payloads within 24 hours of disclosure, and the Dutch angle is covered on security.nl. If you have anything running as a SAML IdP on 14.1 before 14.1-72.61 or 13.1 before 13.1-63.18 and it is not patched yet, that is your Friday sorted. Details at The Hacker News and CyberScoop.

Patch Tuesday needed a bigger boat

July's Patch Tuesday (KB5101650, released July 14, coverage landing July 15) fixed a record 570 vulnerabilities, roughly 4x the same month last year. Microsoft is openly attributing the jump to AI-assisted vulnerability discovery and warns this is the new normal for patch volume. So if your maintenance windows already felt tight, they are about to feel tighter. On the plus side, the same update ships Point-in-time Restore (72-hour rollback) and the ability to pause updates for up to 35 days, which is genuinely useful for anyone running gold images. Windowslatest tested it here.

Entra is retiring SMS and voice OTP (mark February 1, 2027)

Announced July 13 and rippling through the community all week: Microsoft is phasing out its own SMS one-time codes and voice-call MFA by February 1, 2027. Passkeys are the preferred replacement, and if you truly cannot move off SMS/voice you will need to source it from a telecom provider via the Microsoft Security Store from September 18, 2026. For a healthcare or public-sector rollout that still leans on SMS fallback, that is a migration project, not a checkbox. Tony Redmond has the clear-eyed write-up at Office 365 for IT Pros.

Quiet EOL clock ticking: SQL Server 2016 and vSphere 8

Two deadlines worth keeping on the radar even though neither is new this week.

SQL Server 2016 hit its ESU transition on July 14 (Windows Server 2016 itself still runs to January 12, 2027).

VMware by Broadcom has vSphere 8 reaching end of General Support in October 2027, which is the deadline quietly driving every hypervisor migration conversation below.

HyperVisor news

Nutanix's free-year carrot expires July 31

If any of your customers are still weighing an ESXi exit, Nutanix's limited-time migration promo (one year of free licensing plus their "zero data migration" path for supported external storage) ends July 31. Not a technical breakthrough, but a real calendar item if a business case is sitting half-finished on someone's desk.

XenServer is having its comeback arc

More trend than news, but it kept surfacing, and I owe an update here: XenServer 9 is now in public preview. It is based on Xen 4.21 with a modernised 6.x control-domain kernel, plus NUMA tuning and Secure Boot, and Citrix is openly pitching XenServer as a mainstream server-virtualisation option again, not just for desktops. Full GA is expected later in 2026, so treat it as preview-grade for now. One licensing gotcha alongside it: Citrix file-based licensing hit EOL on 15 April 2026, so LAS is the only activation path going forward. Add Gartner's stat that 52% of IT leaders are now weighing multi-hypervisor strategies and you can see why the conversation is not going away, even if I suspect a chunk of it is leverage against Broadcom rather than genuine re-platforming. Background here.

Omnissa

Genuinely quiet week on the official channels. Nothing I could confirm as newly published inside the 7-day window on Horizon, Workspace ONE or Access. The recent-ish items still floating around (App Volumes Manager support for physical endpoints reaching GA, Workspace ONE Assist for Linux) predate this window, so I am leaving them out rather than pad the section.

The Horizon plus vSphere bundle and what it means for support

One licensing note worth a reminder while we are in the Omnissa section, because it came up this week: Omnissa sells combined-offering Horizon (SaaS and Term) licenses bundled with VMware vSphere Foundation for VDI, which is vSphere, vCenter and vSAN. You get to use that vSphere as needed to support your licensed Horizon user count, in Named User or Concurrent metrics on 1 to 5 year terms, and you pick up the new VVF for VDI entitlement at renewal. The part that actually matters operationally: for the combined offering you contact Omnissa support for everything, including the VVF for VDI layer, so you are not ping-ponged between Omnissa and Broadcom when something breaks in the virtualisation stack under your desktops.

Microsoft (Intune, Windows 365, AVD)

The E3/E5 repackaging is now live, not theoretical

The headline for Intune this week is that the December 2025 packaging change actually took effect: as of July 1, the advanced Intune Suite capabilities (Endpoint Privilege Management, Advanced Analytics, Remote Help, Enterprise Application Management, Cloud PKI) are now included in Microsoft 365 E5, with a subset in E3. Microsoft published its "now available" confirmation this month. Worth a licensing review if any of your tenants were paying for the standalone Suite add-on, because you may now be double-paying.

AVD goes properly hybrid

Still getting community pickup: Arc-enabled servers can now be configured as AVD session hosts, which extends AVD beyond Azure Local onto Hyper-V, Nutanix AHV, vSphere or plain physical Windows Server. For anyone who wants the AVD control plane but has to keep the compute on-prem for data-residency reasons (which, in Dutch healthcare, is most of them), this is the more interesting announcement than any of the licensing noise. Microsoft's write-up.

Performance testing, tooling, DEX

Liquidware puts CommandCTRL in the browser

Just outside the window (July 8) but too relevant to skip: Liquidware shipped CommandCTRL v1.5, adding AI-assisted endpoint diagnostics and browser-based remote control across Windows, macOS, Linux and IGEL OS / eLux endpoints. The browser-based remote control is the part I would want to test, since it removes the "install yet another agent" friction that usually kills these tools in locked-down environments. Announcement here.

On the research side, GO-EUC had nothing new this week; their latest remains the "Does ECC matter in a vGPU powered VDI environment?" piece. A must read for sure!

Andrew Taylor's Intune newsletter took the week off (last edition July 10), so the usual Friday community reading is thinner than normal.

Community & fun

The stateless MCP spec is nearly final

The genuinely novel thread this week is more adjacent than core-EUC, but it is the one I would actually go read: the Model Context Protocol spec is moving to stateless at the protocol layer, with the release candidate posted for July 28. Stateless MCP is the kind of plumbing change that makes "an MCP server that fronts your Horizon / Intune / NetScaler estate" a lot more practical to build and scale. If someone in the EUC community has not yet wired an MCP server into their monitoring stack, this is the week the groundwork got easier. I suspect we will see the first serious EUC-specific MCP servers before the year is out. (Yes, the same MCP that quietly compiled half of this post. Turtles all the way down.)

Housekeeping note: UAG and DEM both had nothing new this week that I could confirm inside the 7-day window.

That is the lot for this week. Thinner than a normal Friday thanks to the mid-July lull, and I stayed strict on dates rather than dressing up older items as fresh. If you spot something I missed, or want me to go deeper on any of these next week, drop a comment below.