Cybersecurity Awareness Month: Make time for updates.

The third Cybersecurity Awareness Month theme from the Digital Trust Hub is Make Time for Updates, built on a practical routine: Save. Update. Restart. An update protects a device only after it is installed and the device has restarted. This week’s resources help staff finish that routine and help technology departments follow up when it doesn’t happen.

Updates are arriving faster

The volume of security updates has grown sharply this year. BleepingComputer’s monthly counts of Microsoft’s Patch Tuesday releases show the change:

• July: 570 vulnerabilities fixed
• August: 400
• September: 966, a record at the time
• October: 1,411, a new record, including 70 rated critical and one already exploited in attacks (BleepingComputer)

Much of the increase comes from how flaws are being found. Microsoft now runs an AI-powered system it calls MDASH, a multi-model agentic scanning harness, that scans critical Windows components for vulnerabilities and checks its findings with several AI models. In July, Microsoft told customers to expect “a higher volume of security updates included in each security release” (BleepingComputer). Three months later, October’s release was more than double July’s.

For a school district, that means more updates, more restarts and less time between one fix and the next.

Not every update is on a laptop

The same week these resources went out, PHP released an emergency fix for two critical flaws, known as PHP2Shell, that could let an attacker run code on a web server. Details leaked before the planned disclosure, so the fix shipped ahead of schedule. PHP published no configuration workaround, and versions 8.1 and earlier receive no fix at all.

PHP runs behind many websites and web applications, including some that districts host themselves or rely on through vendors. It is a reminder that updates to servers, applications, infrastructure and vendor-managed systems matter as much as updates to staff devices.

For staff

• A staff email template that explains how updates protect devices, why required restarts matter and how to recognize a suspicious update prompt. It includes update instructions for Windows 11, Chromebooks and iPads, in Word and Google Docs formats.
• A flyer for staff spaces, newsletters and digital displays, with messaging that works all year

Each district adds its own help desk information and device instructions to the staff email, and confirms that the guidance matches how it manages updates.

For the technology department

• SOP: Devices That Do Not Update, a suggested procedure for investigating update failures, prioritizing corrective action, applying temporary protections, documenting exceptions and verifying resolution. It also covers monitoring security advisories and acting on those that affect district systems.

An update that stays incomplete may point to a technical problem, a compatibility concern, unsupported equipment or a restart that never happened. The procedure supports the model Vulnerability Management Policy and is a starting point that each department aligns with its own systems, responsibilities, remediation deadlines and approval process.

Make the next step clear

This week’s action for technology departments is to tell people exactly what is expected of them:

• which updates happen automatically
• what employees and students need to do
• when a restart is required
• what notice and maintenance windows they can count on, whenever possible

Reviewing recurring problems can reveal barriers that reminders alone will not fix.

More themes follow through the end of October.