February 2025 Patch Tuesday forecast: New directions for AI development

The new year has started with a whirlwind of activity, and one of the hottest topics in the news is the increasing emphasis on AI.

DeepSeek ad Stargate

DeepSeek took the world by storm as millions of copies were downloaded to personal devices, but soon security concerns arose as to how the chatbot used personal data. As research continues, many countries have banned the app from sensitive systems, and other countries and organizations, including the US, are also considering banning it.

The Trump administration announced the Stargate project to accelerate AI development in the US. This was done while simultaneously revoking several federal regulations, which could slow development. Many of these regulations addressed safety and security restrictions to prevent cyberattacks on people and infrastructure. It is unclear at this point which, if any, federal organizations will be tasked with overseeing new AI initiatives. As I mentioned in previous months, Microsoft and others have embraced AI for security and many other functions, so it remains to be seen how this new AI direction will factor into our patch operations in the months and years ahead.

Mass patching

Patch releases have also contributed to the January whirlwind, with Microsoft addressing near-record numbers of CVEs in their Patch Tuesday updates. There were 130 CVEs fixed in Windows 10 and 11, including three zero-day and two publicly disclosed vulnerabilities. There were also critical fixes for all versions of Microsoft Office and an important update for SharePoint Server and .NET framework release.

EOL woes

It’s still early February, but everyone should be planning and budgeting to address all the products reaching their end-of-life later this year. Microsoft sent out reminders several times this month. The largest for most of us to deal with is the last security update for Windows 10 coming on October 14th. Estimates show 40%+ of all Windows desktop machines are still running this operating system. The latest and final version is Windows 10 22H2.

As part of a phased rollout, Microsoft announced they are now offering Windows 11 24H2 to eligible Windows 10 22H2 devices. If you have devices which need to continue running Windows 10, there is a 3-year ESU program starting in November but that gets expensive as the price doubles each year for these security updates. Also on October 14th, Exchange Server 2016 and Exchange Server 2019 will reach the end of support.

In the continued march to the cloud, Microsoft recommends migrating to Exchange Online or Microsoft 365. And finally, don’t forget that Microsoft will deprecate WSUS driver synchronization on April 18, 2025. They will continue to be available in the update catalog, but you won’t be able to import them into WSUS. Microsoft has some migration recommendations in its latest announcement.

Apple

Apple issued security updates for multiple products on January 27th which included a fix for its first zero-day vulnerability CVE-2025-24085 allowing privilege escalation. Apple acknowledged this vulnerability was under active exploitation. In addition to this vulnerability, there were up to 28 additional fixes depending upon the product. If you haven’t already deployed these updates, ensure they are part of next week’s Patch Tuesday program.

February 2025 Patch Tuesday forecast

• Can Microsoft continue to release updates addressing such large numbers of CVEs? I suspect we’ll see the usual 40-50 next week scattered over the usual supported operating systems and Office updates. We saw a .NET framework release last month, so don’t anticipate another.
• Adobe updated some of their bigger products like Photoshop, Illustrator and Animate last month. We may see some minor releases next week, but don’t expect many.
• Apple released security updates for almost all their product line, which included Ventura 13.7.3, Sonoma 14.7.3, Sequoia 15.3, Safari 18.3 and iOS 18.3. The next round of updates will probably come in five to six weeks.
• Google Chrome Dev for Desktop beta came out last week, so expect the usual drop this week.
• The Mozilla Foundation released security updates for all their products on February 4th. All the updates were rated High with 12 vulnerabilities reported in Firefox. These releases were Thunderbird ESR 128.7 and Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and finally Firefox 135. Be sure to include these in your Patch Tuesday mix if you haven’t deployed them already.

I told you last month to hang on for a fun ride! The roller coaster is just getting started.