Glossary · Security

Patch (Software)

A patch is a software update that fixes bugs or closes security vulnerabilities, and applying it promptly is one of the most effective defenses.

Updated October 6, 2026

A patch is a piece of code released by a vendor to fix a defect or close a security vulnerability in existing software. Applying patches is called patching or patch management.

Why it matters

Attackers quickly build exploits once a fix is published, because the patch reveals the flaw. Systems left unpatched for weeks are an easy target, and many major breaches involved flaws with fixes available for months. Good patch management means inventorying software, testing updates and applying them on a defined schedule, faster for critical issues.

Example

A vendor publishes a security advisory with a fixed version of a web framework. You upgrade from 4.2.3 to 4.2.5 in staging, run tests, then deploy to production within your critical-patch window.

Common mistakes

  • Postponing updates indefinitely because something might break.
  • Forgetting libraries, plugins and firmware, patching only the operating system.
  • Skipping a rollback plan or backups before major updates.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityALPN (Application-Layer Protocol Negotiation)ALPN is a TLS extension that lets client and server agree on the application protocol, such as h2 or http/1.1, during the handshake.Glossary · SecurityCertificate Chain (Chain of Trust)A certificate chain is the ordered path of certificates from a server's leaf certificate through intermediates up to a trusted root.Glossary · SecurityCipher SuiteA cipher suite is a named bundle of algorithms for key exchange, authentication, bulk encryption and integrity used in a TLS connection.Guide · SSL & SecurityHow to Check an SSL Certificate Expiry Date (3 Easy Ways)Find out when your SSL certificate expires using a free online checker, your browser, or one command, and learn what to do if the date is close or has passed.7 min readGuide · PerformanceHTTP/2 and HTTP/3 Explained: What Changes and How to Enable ThemUnderstand multiplexing, QUIC and head-of-line blocking, when HTTP/2 and HTTP/3 actually help, and how to enable and verify them on nginx and Cloudflare.7 min readGuide · EmailMTA-STS and TLS-RPT Guide: Enforce TLS for Inbound EmailHow to set up MTA-STS and TLS-RPT: the DNS TXT records, the policy file on mta-sts.example.com, testing, enforce mode, and how to read TLS reports.6 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.