A software patch is a change supplied to correct a vulnerability, defect, or compatibility problem in an existing application, operating system, firmware, or device. A patch usually changes a limited part of the product rather than replacing it completely.
Patch, update, hotfix, and upgrade
- A security patch corrects a weakness that could be exploited.
- A bug-fix patch corrects faulty behavior, crashes, or data errors.
- A hotfix is an urgent, narrowly scoped correction, sometimes released outside the normal schedule.
- An update may contain several patches plus small improvements.
- An upgrade moves the product to a substantially newer version and can change features or requirements.
Vendors do not use these labels consistently, so release notes and the affected version range are more important than the name.
Why patching matters
Once a vulnerability and its fix are public, attackers can compare old and new code or use published proof-of-concept tools. Systems that remain exposed are easier targets for an exploit. Most incidents do not require a rare zero-day when a known weakness is still available.
A safe patching process
- Inventory: know the product, version, owner, exposure, and support status.
- Prioritize: consider active exploitation, internet exposure, privileges, data sensitivity, and vendor severity.
- Prepare: read release notes, confirm dependencies, back up important data, and define a rollback method.
- Test: use a representative device or staged group when the environment is complex.
- Deploy: install during an appropriate maintenance window, starting with the highest-risk systems.
- Verify: confirm the new version, required restart, service health, and vulnerability-scan result.
Home users should enable automatic security updates for the operating system, browser, office software, router, and security tools. Restart when requested; some fixes are not active until the old process or kernel is replaced.
When no patch is available
Follow vendor mitigations, disable the affected feature, restrict network access, increase monitoring, or remove the product if the risk cannot be controlled. Unsupported software should be replaced because new vulnerabilities may never receive a fix. See Zero-Day Attack for temporary protection when a fix is not yet available.