Body
Summary
Software updates arrive more often than they did a few years ago, and the interval between them is shrinking. This is an industry-wide change in how vulnerabilities are found, how software is built, and how quickly flaws are exploited. It is not specific to JCB or Cornell, and it is not a fault with any individual computer. The trend is expected to intensify. For a JCB-managed computer the practical requirement is unchanged: install updates and restart when prompted, within the deadline shown.
For how patching works on a JCB computer — timelines, deadlines, and what the prompts look like — see How Your JCB Computer Stays Patched (and Why It Matters).
The volume of vulnerabilities has quadrupled
The number of publicly catalogued software vulnerabilities (CVEs) rose from roughly 10,600 in 2016 to 45,100 in 2025, and 2026 is on pace to exceed that. Each catalogued flaw is a fix a vendor has to ship and an update a device has to install.
What has changed
Four shifts over the last decade account for the increase, and they reinforce one another.
The fourth shift is the one that drives deadlines. Rapid7's 2026 Global Threat Landscape Report puts the median time from a vulnerability's publication to its confirmed exploitation at 5 days, down from 8.5 days, and reports that confirmed exploitation of high- and critical-severity flaws more than doubled from 2024 to 2025 (71 to 146). Cornell's install deadlines (see article 9083) exist because that window keeps shrinking.
This trend will continue
None of the four shifts is reversing. Vendors now use automated and AI-assisted tools to find vulnerabilities in their own products, which produces more fixes, not fewer; Microsoft cited this as a reason for the size of its October 2026 release. JCB IT controls when updates reach managed computers and tests them before release. It cannot reduce how many updates there are, and neither can any other IT organization.
Recent examples across vendors
The pattern is visible across every vendor whose software runs on a JCB computer. Between August and October 2026:
| When / vendor | What happened | Relevance to a JCB computer |
|---|
PHP
Oct 21, 2026 | Emergency release for two critical flaws rated 9.2 of 10; attack attempts reported within hours of the fix (Canadian Centre for Cyber Security). Detailed below. | Web servers, handled by administrators. Illustrates the fix-to-attack window. |
Microsoft
Oct 13, 2026 | October Patch Tuesday fixed a record 1,411 vulnerabilities, 70 rated critical, including one already being exploited (BleepingComputer). Microsoft attributed the volume in part to AI-assisted vulnerability discovery. | Arrives on JCB Windows computers through Cornell's patching service about 7 days after release. |
Microsoft
Jan–Feb 2026 | Out-of-band emergency Windows updates now follow nearly every monthly release, including a January fix for an actively exploited Office flaw (The Register). | Explains Windows updates that arrive mid-month, outside the usual cycle. |
Google
Sep 4, 2026 | Chrome update for CVE-2026-85046, the sixth Chrome zero-day exploited in the wild in 2026 (eSecurity Planet). | Source of the "Relaunch to update" prompt in Chrome and Edge. |
Apple
Aug 6–18, 2026 | Fix for CVE-2026-65400, a critical Screen Sharing authentication bypass in macOS; exploitation reported by the Netherlands NCSC and Microsoft. Patched in three macOS versions at once (The Hacker News). | Delivered to JCB Macs through Jamf; the 7-day deadline applies when a flaw is actively exploited. |
Dell
Jun–Aug 2026 | Dell's security advisory numbering passed 350 for the year by mid-August (DSA-2026-351). June's DSA-2026-204 required BIOS updates on several Dell laptop lines for three high-severity firmware flaws. | BIOS and driver updates reach JCB Dell computers through the same channel as Windows updates and require an uninterrupted restart. |
A closer look: the October 2026 PHP release
PHP runs a large share of the world's websites. On October 21, 2026, its maintainers shipped emergency fixes for two critical flaws that allow an attacker to run code on a web server without credentials. The sequence from first warning to active attacks took about 48 hours.
JCB faculty and staff do not run PHP, and this incident was handled by server administrators. The same sequence, at smaller scale, is behind every out-of-cycle update to Windows, macOS, a browser, Zoom, or Office: a flaw is found, a fix ships, and the window before exploitation begins to close.
What this means on a JCB computer
Most updates on a JCB-managed computer install in the background. The prompts that appear are the part of the process that requires a person: a restart, or occasionally a click.
| What you see | What is happening | What to do |
|---|
| Windows: a restart notification from the system-tray icon near the clock | A Windows security update was installed through Cornell's centrally managed patching service, about 7 days after Microsoft released it. It is not active until the computer restarts. | Save your work and choose Restart now, Restart tonight, or Schedule a time, before the deadline shown in the notification. |
| Mac: a reminder window with a countdown and an Update Device button | A macOS update is available through Jamf, Cornell's Mac management platform. The install deadline is 14 days, or 7 days if the flaw is already being exploited. | Save your work, click Update Device, then Update Now, and allow the restart to complete. |
| Browser shows Update available or Relaunch to update | Browsers patch every few weeks, and within days when a flaw is being exploited. | Relaunch at the next convenient point. Open tabs are restored. |
| An application (Zoom, Teams, Office) updates mid-week | Vendors ship fixes when ready rather than on a fixed schedule. | Allow it to finish. Most take under a minute. |
| A second update arrives days after the first | A fix for a newly found flaw, or a correction to the earlier fix. | Install it. Updates are cumulative. |
The action that matters most is restarting when prompted, the same day where possible. An update that is installed but waiting on a restart provides no protection until the restart completes. Screenshots of the Windows and Mac prompts are in article 9083.
Common questions
- "Can I defer an update?" — Within the deadline, yes. Windows shows the deadline in the restart notification; Macs allow 14 days, or 7 if the flaw is being actively exploited. After the deadline the computer restarts on its own to complete the update. Restarting before the deadline avoids an unscheduled restart.
- "Why is a restart required?" — The operating system components being replaced are in use while the computer is running. They can only be replaced during startup.
- "Why several updates in one week?" — Windows or macOS, the browser, and each application come from different vendors on different schedules, and any of them can issue an emergency fix. Overlap is common.
- "How do I tell a real update prompt from a fake one?" — Legitimate updates appear as the Windows system-tray notification, the macOS Software Update reminder, or a prompt inside the application itself. They do not arrive as a web page pop-up, an email link, a phone call, or a file sent by someone else. If a web page instructs you to "update now," close it and check inside the application. When in doubt, contact JCB IT before clicking.
- "Can automatic updates be turned off?" — No. Patching is part of Cornell's Certified Desktop security standard and University Policy 5.10. If update timing conflicts with specific work (a presentation, a long computation), contact JCB IT to discuss options.
- "Do updates slow the computer down?" — Briefly, during installation. Afterward, no. Updates frequently resolve existing slowdowns and crashes.
Related articles
Still stuck?
If an update or restart is interfering with your work, or a prompt looks suspicious, contact JCB IT through the JCB IT Client Portal.
Sources
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (BleepingComputer, Oct 13, 2026)
- Microsoft's 'atypical' emergency Windows patches are becoming awfully typical (The Register, Feb 2, 2026)
- Google's Chrome update patches sixth zero-day exploited in 2026 (eSecurity Planet, Sep 4, 2026)
- macOS Screen Sharing flaw CVE-2026-65400 (The Hacker News, Aug 15, 2026)
- DSA-2026-351 and DSA-2026-204 (Dell Security Advisories, Aug 17 and Jun 22, 2026)
- AI-enabled adversaries compress time-to-exploit following vulnerability disclosure (Infosecurity Magazine on Rapid7's 2026 Global Threat Landscape Report, Mar 18, 2026)
- Alert AL26-026: Critical vulnerabilities impacting PHP (Canadian Centre for Cyber Security, Oct 21, 2026); PHP warns admins of two critical flaws (BleepingComputer, Oct 20, 2026)
- CVE statistics and trends (TridentStack; yearly CVE counts, read Oct 23, 2026; counts vary slightly between trackers)