Windows 11's memory story has split into three contradictory parts. Microsoft is tuning the operating system so that machines with 8GB of RAM run better, outside researchers are showing that a fully patched Windows box can still be compromised below the OS, and a developer has demonstrated Windows 11 26H2 running with 128MB of memory, far below anything Microsoft supports. Read together, the stories describe an operating system whose resource floor and security floor are being set by different people with different priorities, and US buyers are absorbing the consequences.
The floor keeps moving
The clearest signal comes from Microsoft itself. As Engadget reported, the company has listed concrete ways Windows 11 improves on 8GB of RAM, and users with that configuration should notice better performance across a wide range of apps. That is a meaningful admission in a market where 8GB has become the default base configuration for mainstream laptops sold to US consumers and to small businesses that buy in volume. For years the practical advice was to avoid 8GB for anything beyond light use. Microsoft is now saying the configuration is worth optimizing for rather than merely tolerating, which implies the installed base at that level is too large to write off.
The Tom's Hardware experiment pushes the same question to an absurd extreme. A stripped-down installation of Windows 11 26H2 ran with 128MB of memory, which the outlet described as 3.1% of the recommended minimum, while retaining the Desktop, File Explorer and Notepad. The resulting system was far too slow for everyday use. The value here is not the machine; it is the demonstration that the gap between what Windows 11 requires and what it can technically survive is enormous, and that a sufficiently determined tinkerer can occupy the space below the official line.
Those two stories pull in the same direction: the effective memory floor for Windows 11 is being negotiated downward, partly by Microsoft and partly by people outside it. That is good news for anyone trying to keep aging hardware in service. It is also a support problem, because the range of configurations Microsoft is willing to stand behind is now wider and less predictable than the stated system requirements suggest.
Security sits below the operating system
The Ars Technica story describes the opposite kind of pressure. A UEFI bootkit called BlackX infected fully patched Windows machines, and the reporting frames the episode around Microsoft's lack of clarity regarding Secure Boot protections. Where the memory stories concern what happens once Windows is running, this one concerns whether the Windows that runs can be trusted at all.
This is the harder problem for US buyers to reason about. Memory tuning is visible: an app opens faster or it does not. A bootkit operates beneath the layer where users, and most security tools, are accustomed to looking. The fact that the machines in question were fully patched undercuts the central promise of the update model, which is that keeping current is sufficient. If patched systems remain exposed because of ambiguity in how a firmware-level protection is configured or documented, then the advice to stay updated is necessary but not sufficient.
For US technology companies, the exposure is concentrated in fleets. Enterprises, hospitals, school districts and government agencies buy Windows machines in bulk and assume that a standard image plus current patches equals a defensible baseline. A bootkit class of attack that survives at the firmware layer challenges procurement assumptions that are rarely revisited between hardware refresh cycles.
Three messages, one confused buyer
Set the stories side by side and the pattern is not that Windows is getting better or worse. It is that Microsoft is sending three different messages about what Windows 11 is. To the value segment it says the operating system will meet 8GB machines where they are. To the security community it has left enough ambiguity around Secure Boot that researchers are publicly asking whether the company bears responsibility for a bootkit that defeated patched systems. And to the enthusiast fringe it says nothing at all, which is precisely why a 128MB installation is a story rather than a curiosity.
