Patch

No major program is free of errors when it’s sold. Some errors are merely annoying, others let attackers into the system. So that manufacturers don’t have to ship the entire program anew every time, they send out small corrections. That’s exactly what a patch is: an addendum that replaces or adds individual parts of an installed program. The English word literally means “patch,” as in a piece of cloth, and that describes the matter well. The patch is sewn onto the existing pair of trousers instead of buying a new pair.

Why unpatched software becomes a gateway

The most important reason for patches is security. Once a vulnerability in a widely used program becomes known, criminals read about it too. They then build tools that exploit exactly this vulnerability. From that moment on, every computer that still lacks the patch is vulnerable.

Major waves of attacks in the past almost always hit systems for which a fix had long been available. In 2017, the malware WannaCry encrypted hundreds of thousands of Windows computers worldwide. The matching patch had already been available for nearly two months at that point. Those affected were mainly organizations that had not installed it, including British hospitals.

For companies, patching is therefore not a side job but a task in its own right with its own name: patch management. Behind this lies a conflict of goals. A patch can itself introduce new bugs or render programs unusable that depend on the old behavior. But whoever tests for too long remains vulnerable for a long time.

What happens when a fix is installed

A program consists of files that the computer executes. A patch contains the changed parts of these files and an instruction on where they belong. The update program replaces the affected spots and leaves the rest untouched. That’s why a patch is often only a few megabytes in size, even though the program itself takes up several gigabytes.

The origin lies in the source code, i.e., the human-readable text from which a program is built. A developer changes a few lines there. Comparing the old and new versions produces a list of the differences. In technical jargon, this list is also called a patch and often travels to the project via email or platforms like GitHub.

A patch should be distinguished from an upgrade. A patch only repairs, without bringing new features; the version number usually increases only in the last digit, for example from 14.2.1 to 14.2.2. An upgrade brings new features and larger overhauls. A particularly urgent patch that appears outside the normal schedule is called a hotfix.

Update Tuesday, game consoles, and AI models

You encounter patching constantly in everyday life, usually under the name update. The phone downloads something overnight, the browser wants to keep working after a restart, a game demands a download before it starts. Microsoft traditionally releases its collective packages on the second Tuesday of the month, the so-called Patch Tuesday. Security agencies such as Germany’s BSI regularly warn against postponing such packages.

In the news, patches usually appear together with a discovered vulnerability. A common term here is zero-day: a vulnerability that is exploited before a patch exists. The time between the release of the fix and its installation is called the patch gap. It is the window in which attackers have the best chances.

With AI products, the principle works similarly, but not identically. The software surrounding a language model is patched in the classic way. The model itself cannot be fixed in individual lines, because its knowledge is embedded in billions of numerical values. Misbehavior is therefore corrected through retraining or additional filter rules. Providers nonetheless often speak of a patch, because the result is the same for users: a known problem has been fixed afterward. One caveat, by the way: in image processing, a patch means something completely different, namely a small square of an image into which a model decomposes a photo.