--- id: CP-552 slug: urgent-zero-day-update lang: en title: "Urgent update: why install as soon as possible" description: An urgent security update only protects once installed. What to do on notification, and how to spot fake updates. canonical_url: https://startbrain.io/cyberpedia/en/articles/urgent-zero-day-update/ markdown_url: https://startbrain.io/cyberpedia/en/articles/urgent-zero-day-update.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: "Brain, \"Urgent update: why install as soon as possible\", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/urgent-zero-day-update/ (CC BY 4.0)" wing: 5 theme: outsmart_social_engineering reflex: cr-043 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/urgent-zero-day-update/ fr: https://startbrain.io/cyberpedia/fr/articles/mise-a-jour-urgente-zero-day/ de: https://startbrain.io/cyberpedia/de/articles/dringendes-update-zero-day/ es: https://startbrain.io/cyberpedia/es/articles/actualizacion-urgente-zero-day/ sources: - "n": 1 title: Update Software | CISA publisher: CISA url: https://www.cisa.gov/secure-our-world/update-software accessed: "2026-11-03" - "n": 2 title: Known Exploited Vulnerabilities Catalog | CISA publisher: CISA url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog accessed: "2026-11-03" - "n": 3 title: Pourquoi et comment bien gérer ses mises à jour ? publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mises-a-jour published: "2019-11-26" accessed: "2026-11-03" - "n": 4 title: Vulnerability management guidance publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/vulnerability-management/guidance accessed: "2026-11-03" - "n": 5 title: Drive-by Compromise, Technique T1189 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1189/ accessed: "2026-11-03" - "n": 6 title: Exploitation for Client Execution, Technique T1203 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1203/ accessed: "2026-11-03" - "n": 7 title: User Execution, Technique T1204 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1204/ accessed: "2026-11-03" - "n": 8 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" --- # Urgent update: why install as soon as possible Many people choose "Remind me later" when an update alert appears. Yet many updates exist to fix security risks, and a fix that is not installed protects no one [1]. CISA also maintains a catalog of vulnerabilities known to be exploited [2]. This article is for employees who see an urgent update message on their browser, computer or phone. It explains why the useful answer is to install as soon as possible, what to check afterwards, and how to tell a real update from a trap. ## In 30 seconds - Where it happens: on the browser, the computer or phone system, and applications, whenever an update alert appears. - What the attacker wants: to get in through a security flaw on a device that has not been updated [1], or to make you install a fake fix that is really a virus [3]. - The reflex: install updates as soon as possible [1], check by hand if needed that the update worked, and download only from official sites [3]. - If it is already done: editorial advice, tell the IT department if you installed an "update" that came from a pop-up window or an ad. ## Straight answers ### Why install as soon as possible? CISA puts it this way: when a critical update is announced, install it as soon as possible [1]. Cybermalveillance.gouv.fr asks people to run updates as soon as they are available, because a single device that is not up to date is enough to open a breach in the digital environment [3]. The UK NCSC recommends applying updates as soon as possible, ideally automatically [4]. ### What does MITRE say about zero-day flaws? The MITRE ATT&CK framework mentions them in connection with specific cases: one group used watering hole attacks, "often with zero-day exploits" [5]. ### Who knows which flaws are being exploited? CISA publishes a catalog of vulnerabilities known to be exploited (Known Exploited Vulnerabilities Catalog). It invites people to search it for the software they use and to treat those updates as a priority [1][2]. ### What does "update as soon as possible" mean for an employee? The first reflex comes down to three steps, according to CISA: watch for notifications, install updates as soon as possible, turn on automatic updates. CISA specifies that all updates should be installed, in particular those for web browsers and antivirus software [1]. ### How can you check that a device is up to date? Cybermalveillance.gouv.fr recommends turning on automatic download and installation when the software allows it, then making sure, if needed, through a manual check that the update works [3]. CISA says to look in the device settings, possibly under "Software" or "Security", for the "automatic updates" option [1]. ### What if the IT department handles it? In a company with an IT department, it is generally the one that updates devices and software. Without an IT department, staff do it under the authority of the head of the company [3]. ## How it works Vendors publish updates to fix flaws. If a criminal gets in through a security flaw, they then look for sensitive information to exploit [1]. As long as the update is not installed on your device, the flaw stays there. MITRE describes a common attack route, drive-by compromise. A user visits a website that hosts the attacker's content. Scripts then look for the version of the browser and its plugins, searching for a vulnerable version. If one is found, the exploit code is sent to the browser. If it succeeds, the attacker gets code execution on the machine, unless other protections are in place [5]. Visiting a legitimate site that has been compromised, or a malicious ad served by a legitimate ad provider, can be enough to trigger the chain [5]. MITRE classes separately the exploitation of client-side software to obtain code execution. Among its examples, one group exploited numerous ActiveX flaws, including zero-days [6], and a piece of malware used a known Adobe Flash zero-day flaw to run on victims' machines [6]. ## What you do - Install updates as soon as notified, without choosing "Remind me later" [1]. - Check by hand if needed that the update worked [3]. - Turn on automatic updates in the settings [1]. - Use a period of inactivity (lunch, a meeting, overnight) if the update is long: it can last from a few seconds to several minutes or hours [3]. - Download updates only from the official sites or channels of vendors and manufacturers [3]. - Report to the IT department a device that cannot be updated. Cybermalveillance.gouv.fr states that such a device must be protected another way, for example by disconnecting it from the Internet or isolating it from the rest of the network [3]. ## Pitfalls ### Putting off the update CISA tells the story of Veda, who regularly clicked "Remind Me Later" on her computer and her phone. According to the account, the malware probably came from her son, who had clicked a link leading to an infected site. The malware then exploited a known flaw in her old operating system. She lost access to several accounts and money was withdrawn from her bank account [1]. The CISA account carries no date, and the page is marked "Archived Content": it may not reflect current policy [1]. ### Accepting a site's warnings and notifications MITRE notes that, in a drive-by attack, the user may have to help the process along by enabling scripts or notifications, or by ignoring warning windows [5]. Accepting a site's notifications can also give it permission to run JavaScript code in the browser [5]. ### Fake updates Messages that look like update alerts can appear while browsing: fake ads or malicious pop-up windows. This can be a technique to get you to install a fake fix that is really a virus [3]. MITRE describes actions the attacker can get from the user: opening a link or a file, downloading and running malware, turning on a remote access tool [7]. The following illustration is neutralized: the address is invented and leads nowhere. ```text [Illustration] Window that appears while browsing: "Update required. Download the fix now." Button: hxxps://mise-a-jour-navigateur[.]exemple[.]invalid/correctif ``` Editorial advice: close the window, download nothing, and start the update from the device or browser settings. Cybermalveillance.gouv.fr also reminds people to watch for pre-checked boxes during installation, which can amount to accepting unwanted software [3]. ### Putting off an update alone The UK NCSC adds that the decision not to update belongs at management level, as a risk accepted by the organization [4]. The NCSC also recommends, against phishing, using only supported software and devices kept up to date with the latest patches [8]. ## Sources 1. CISA, "Update Software | CISA". https://www.cisa.gov/secure-our-world/update-software (accessed 3 November 2026) 2. CISA, "Known Exploited Vulnerabilities Catalog | CISA". https://www.cisa.gov/known-exploited-vulnerabilities-catalog (accessed 3 November 2026) 3. Cybermalveillance.gouv.fr, "Pourquoi et comment bien gérer ses mises à jour ?", 26 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mises-a-jour (accessed 3 November 2026) 4. NCSC (UK), "Vulnerability management guidance". https://www.ncsc.gov.uk/collection/vulnerability-management/guidance (accessed 3 November 2026) 5. MITRE ATT&CK, "Drive-by Compromise, Technique T1189 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1189/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Exploitation for Client Execution, Technique T1203 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1203/ (accessed 3 November 2026) 7. MITRE ATT&CK, "User Execution, Technique T1204 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1204/ (accessed 3 November 2026) 8. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/urgent-zero-day-update/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.