Patch To Get Some New Holes

This blog post examines reports that Microsoft’s MS09-008 update may not have fully fixed a vulnerability and uses that example to explain why security patches frequently have flaws. The author outlines contributing factors—complexity of correctness and security bugs, differences across supported versions and patch states, limited testing, developer assumptions, and pressure to release fixes quickly—and concludes that despite occasional imperfect patches, applying updates promptly is still the prudent approach.