A malicious update is a software update package that delivers harmful code instead of legitimate fixes, features, or security patches. It may look like a normal maintenance release, which makes it especially dangerous because users and systems are trained to trust update channels.
In cyber security, malicious updates matter because they can bypass many traditional defenses: the attack arrives through a trusted distribution path. Attackers may tamper with update servers, redirect traffic, compromise signing or validation steps, or abuse supply-chain dependencies so that poisoned content reaches clients. Defenders reduce this risk by using strong code-signing, checking update metadata, validating integrity end to end, monitoring routing and server behavior, and isolating update infrastructure from other services.