August 2024 Patch Tuesday forecast: Looking for a calm August release

August 2024 Patch Tuesday is now live:
Microsoft fixes 6 zero-days under active attack

July ended up being more ‘exciting’ than many of us wanted; we’re supposed to be in the height of summer vacation season. First, we had a large set of updates on Patch Tuesday, then we had to work through the CrowdStrike event, and finally many of us had Azure outages due to Microsoft responding to a DDoS attack. The forecast for August Patch Tuesday is a little lighter, but let’s revisit this month’s events first.

August 2024 Patch Tuesday forecast

The July 2024 Patch Tuesday release kept everyone busy with updates for Microsoft Windows, Office, SharePoint, SQL Server and .NET framework, plus Mozilla released their Firefox and Firefox ESR updates in the afternoon. The Windows 11 and Windows 10 updates addressed 74 and 85 vulnerabilities respectively. These updates were rated Critical with two zero-day vulnerabilities addressed as well as one that was publicly disclosed. The SharePoint update was also rated Critical with the remaining patches all being Important.

Just 10 days later, CrowdStrike dropped an update to their Falcon product which resulted in millions of Windows systems crashing. As later reported in their root cause analysis report, there was an error in their Content Validator component which allowed the faulty update to pass testing and be publicly released. And then just 11 days later, Microsoft experienced an Azure interruption in several regions which impacted Microsoft O365 and many other services for several hours. As per the report, this occurred in response to a DDoS attack.

We’re all prepared to deal with a large set of Patch Tuesday updates when they happen, but the added load of unexpected security and operational events really adds to chaos and workload. As the phrase ‘add insult to injury’ implies, there were also threat actors taking advantage of the situation by sending out phishing attacks with ‘free advice and tools’ to help you recover from these incidents. During chaotic times like these you need to remain diligent, systematically work through your recovery processes and return your systems to a secure, functional state.

Microsoft announced mid-month the updates for Windows 11 24H2 are changing to what they are calling ‘checkpoint cumulative updates.’ This redesign introduces the concept of a periodic cumulative checkpoint file that incorporates a series of several months’ cumulative updates. Once the checkpoint file has been issued the subsequent updates will be cumulative but much smaller because they start new using the last checkpoint as a baseline.

Per Microsoft, with the introduction of this technology “you get even smaller downloads to Windows devices, sustainable redistribution of updates within your infrastructure, and a better update experience for annual feature updates.” The article provides a detailed explanation of how they are using these checkpoint files and also states that if you are using the standard Windows update mechanisms then no changes are required to your current processes.

The preview updates which just came out for Windows 10 and 11 address several issues which have been tracked for a while. On Windows 10, the January update from this year broke Microsoft Connected Cache (MCC) node discovery and on Windows 11, the preview fixes an issue that caused Windows backups to fail on devices with an Extensible Firmware Interface (EFI) system partition (ESP). Be on the lookout for these two problems to be fixed in the releases next week.