Why Does Everything Need a Security Update?
It seems like every time we turn on our computers, there's another security patch waiting. Are software vulnerabilities really increasing, and what does that mean for your business?
It seems like every time we turn on our computers, there’s another security patch waiting. Are software vulnerabilities really increasing, and what does that mean for your business?
Remember when software updates were something we looked forward to? A new version of an application might introduce useful features, improve performance or give us a refreshed interface.
Today, it seems that hardly a day goes by without another urgent security update. Windows, web browsers, WordPress plugins, business applications, servers and even our phones constantly need patches.
And increasingly, these aren’t updates that introduce exciting new features. They’re fixes for security vulnerabilities that could potentially allow someone to steal information, disrupt a system or gain unauthorized access.
So what’s going on? Is software becoming less secure? The answer is a little more complicated than you might think.
Yes, Software Vulnerabilities Are Increasing
This isn’t just our imagination. According to the U.S. National Institute of Standards and Technology (NIST), submissions to the Common Vulnerabilities and Exposures (CVE) program increased by 263% between 2020 and 2025.
A CVE is a publicly identified security vulnerability in software or hardware. These reports help developers, security professionals and IT administrators identify potential weaknesses and take corrective action.
The increase has been so significant that NIST announced changes in April 2026 to how it processes vulnerability information, prioritizing the most important threats rather than attempting to analyze every reported vulnerability equally.
Two Examples From Just the Past Week
If you want to understand how quickly the cybersecurity landscape is changing, consider two recent announcements.
October 21: Critical PHP Security Vulnerabilities
PHP is the programming language behind millions of websites, including WordPress.
On October 21, PHP developers released emergency security updates to address two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
The vulnerabilities, collectively called php2shell, could allow an attacker to execute malicious code on a vulnerable web server without needing a username or password.
The severity was significant enough that the Canadian Centre for Cyber Security issued an alert advising organizations to update affected PHP installations immediately. By October 27, the Centre had updated its original warning to confirm reports that the PHP vulnerabilities were being actively exploited. This is a clear example of how quickly a newly disclosed software weakness can become a real-world security threat.
For businesses running websites, this wasn’t simply a matter of installing the latest WordPress plugin. The vulnerability affected the underlying software running on web servers, making it an issue for hosting providers and website administrators.
October 27: Google Chrome and Claude AI
Just six days later, Google released a Chrome security update addressing 52 vulnerabilities, including four classified as critical.
What’s particularly interesting is how some of these vulnerabilities were discovered. Anthropic, the company behind Claude AI, had been using an experimental AI model to investigate software security.
Its researchers reported that the model could not only identify vulnerabilities but also combine multiple weaknesses into working attacks. The research involved Chrome, Safari, Android, Windows and Linux.
Some vulnerabilities fixed in Chrome’s October 27 release were credited to researchers assisted by Claude. In other words, AI is no longer simply helping developers write software. It’s becoming a powerful tool for finding ways to break it. Fortunately, these discoveries were reported to the affected software vendors so they could develop and release patches.
Two major security announcements in less than a week, affecting technologies used by millions of businesses and individuals. No wonder it feels like we’re constantly updating something.
Why Are We Seeing So Many Security Patches?
There are several reasons.
Software is more complicated. Today’s applications rely on enormous collections of code, third-party libraries, cloud services and integrations. A vulnerability in one component can affect thousands of applications that depend on it.
We’re getting better at finding problems. Security researchers have more sophisticated tools for identifying vulnerabilities. AI is accelerating this process, allowing researchers to examine code and discover potential weaknesses faster than ever.
Software changes more frequently. Rather than releasing a major version once or twice a year, developers now routinely release improvements and fixes continuously. More frequent changes can introduce vulnerabilities, but they also allow problems to be corrected faster.
Cybercriminals are looking for weaknesses, too. Attackers use automated tools to search for vulnerable systems, sometimes exploiting weaknesses shortly after they’re publicly disclosed.
More vulnerabilities are being reported. The cybersecurity industry has become better organized around identifying, documenting and disclosing security problems. Vulnerabilities that might once have gone unnoticed are now being formally recorded.
In other words, we’re seeing more vulnerabilities partly because there is more software, partly because we’re looking harder, and partly because the pace of development has accelerated.
Not Every Security Update Is an Emergency
Here’s something that often gets lost in the headlines. Just because a vulnerability has been discovered doesn’t mean every computer or website is in immediate danger. Some vulnerabilities require very specific circumstances to exploit. Others affect features that a business might not even use.
On the other hand, certain vulnerabilities are actively exploited by criminals and require immediate attention. The challenge is knowing the difference.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintains a catalogue of Known Exploited Vulnerabilities, identifying security weaknesses for which there is evidence of real-world exploitation.
This is particularly useful for IT professionals because it helps distinguish theoretical risks from vulnerabilities that attackers are actually using.
For a business owner, the important lesson is that security updates need to be managed, not simply ignored or installed without consideration.
What Does This Mean for Your Business?
Most businesses depend on far more software than they realize. Consider a typical small or medium-sized business:
- Employees use Windows or macOS computers, browsers and productivity applications.
- The company website may run WordPress, Shopify or another content management system.
- Customer information may be stored in a CRM or accounting platform.
- Email, file sharing and communications depend on cloud-based services.
- Routers, firewalls, printers and other network devices contain software that also requires updates.
Every one of these systems can potentially have security vulnerabilities. And while large software companies usually have dedicated teams working on security, small businesses often don’t have anyone specifically responsible for keeping everything updated.
That’s where problems can develop. An outdated WordPress plugin, an unpatched firewall or an employee’s neglected computer can become an entry point into an otherwise well-managed business.
According to CIRA’s 2026 Cybersecurity Survey, 39% of surveyed Canadian organizations experienced an attempted or successful cyberattack or incident, while 76% had increased the staffing resources devoted to IT systems management and cybersecurity. Clearly, Canadian businesses are taking these threats seriously.
The Answer Isn’t to Stop Updating. It’s to Manage Updates Better.
For most businesses, there are a few practical steps that can make a significant difference.
- Know what software you’re using. Maintain an inventory of business applications, website plugins, computers, servers and network equipment. You can’t protect systems you don’t know you have.
- Enable automatic updates where appropriate. Browsers, operating systems and many everyday applications can update automatically. For business-critical systems, updates may need testing or scheduling to avoid disruption.
- Prioritize serious vulnerabilities. Not every update needs to interrupt the workday. But actively exploited vulnerabilities, particularly those affecting internet-facing systems, should receive prompt attention.
- Keep reliable backups. Updates occasionally cause problems, and security incidents can happen even when systems are maintained. Tested backups provide an important recovery option.
- Assign responsibility. Someone needs to monitor security notifications, apply patches and verify that updates have succeeded. Whether that’s an internal employee or an external IT provider, it shouldn’t be left to chance.
Security Is No Longer a Once-a-Year Project
Perhaps the biggest change is that cybersecurity has become an ongoing operational responsibility. There was a time when businesses could install software, configure their computers and largely leave everything alone until the next major upgrade. Those days are gone. Modern software is continuously changing, and the threats against it are changing just as quickly.
The good news is that more frequent security updates also mean developers are finding and fixing weaknesses before they can cause widespread damage. But businesses need processes that keep pace.
At Dunham, we see this from both sides of our business. Our Dunham Web team maintains websites, applications and integrations, while Dunham Connect helps businesses manage their computers, networks and IT security. In both cases, the principle is the same: keeping technology secure requires ongoing attention, not just a good initial setup.
The next time you see another security update notification, don’t automatically assume it’s evidence that your software is poorly built. It may actually be evidence that someone is actively working to keep it safe.
The important thing is making sure those updates don’t get ignored.
Leave a Comment