Patch

Technically a patch ranges from a literal diff applied to source code (the unified diff format of diff/patch and git) to a binary delta, a replacement package version or a cumulative update. Windows now ships monthly cumulative updates, so each one contains all earlier fixes and machines cannot selectively skip one; Linux distributions ship rebuilt packages, often backporting a security fix into an older upstream version, which is why a vulnerability scanner that compares only version strings reports false positives on RHEL or Debian. Firmware, BIOS/UEFI, network appliances and embedded devices have their own, frequently manual, update channels and are the most commonly forgotten.

Microsoft's Patch Tuesday, the second Tuesday of each month, dates from 2003 and was adopted in similar form by Adobe, SAP and others; Oracle uses quarterly Critical Patch Updates. Out-of-band releases follow for actively exploited flaws. Publication starts a race, because attackers diff patched and unpatched binaries to derive the vulnerability ("patch diffing"), sometimes producing working exploits within days. Prioritisation therefore should not rely on CVSS base scores alone (CVSS v4.0 was released in November 2023) but combine them with exploitation evidence such as the CISA Known Exploited Vulnerabilities catalogue, which US federal agencies must remediate under Binding Operational Directive 26-04 (June 2026, replacing BOD 22-01) within a deadline set per CVE by exposure, exploitability and impact, as short as three days, and with probability estimates such as EPSS and the asset's exposure.

NIST SP 800-40 Rev. 4 (April 2022) recasts patching as preventive maintenance with a defined risk response for each asset class: patch within a maintenance plan, apply an emergency cycle for severe exploited flaws, mitigate with configuration or network controls when no patch exists, or accept and document residual risk. A mature process has an up-to-date asset inventory, test rings (pilot, broad, critical systems), rollback plans, maintenance windows agreed with the business, and verification afterwards through scanning or configuration management, since "deployed" is not the same as "installed and rebooted". ISO/IEC 27001:2022 control 8.8 (management of technical vulnerabilities) is the usual audit anchor, and NIS2 Art. 21(2)(e) requires vulnerability handling and disclosure as part of cybersecurity risk-management measures.

Regulation is now reaching the vendor side. Under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), manufacturers of products with digital elements must, from 11 September 2026, notify actively exploited vulnerabilities and severe incidents to their CSIRT and ENISA (early warning within 24 hours), while the obligation to provide free security updates throughout a declared support period applies with the main requirements from 11 December 2027. Patches can also be the attack vector: compromised update infrastructure delivered malware in NotPetya (via M.E.Doc, 2017) and SolarWinds Orion (2020), which is why updates must be signed and their signing keys protected. A patch fixes a defect; a workaround or mitigation only reduces exposure and should be tracked until the real fix is applied.