If you run Windows, this is the one update you don’t want to sit on. On June 9, Microsoft shipped one of its largest Patch Tuesday releases in years — a stack of security fixes that includes several flaws attackers already knew about, and at least one being used in real attacks before the patch existed. You don’t need to follow the technical detail. You need to make sure your PC has installed it. Here’s how to check in about two minutes, and how to stay covered for the next round.
What actually happened
Patch Tuesday is Microsoft’s monthly security release, landing on the second Tuesday of each month. June’s was unusually large — more than 200 separate fixes across Windows and related software, with dozens rated “critical.” The part that matters for everyday users isn’t the sheer volume, it’s that some of these were zero-days: holes that were publicly known, or already being exploited, before Microsoft had a fix available.
When that’s the case, the gap between “patch released” and “patch installed on your machine” is exactly the window attackers count on. A few are worth calling out in plain terms. Several let an attacker who already has a foothold on a PC quietly upgrade themselves to full system control — the kind of flaw that turns a minor compromise into a complete one.
One of the fixes also closed a bypass affecting BitLocker, the disk-encryption feature built into Windows. That’s a useful reminder that “I encrypt my drive” and “I keep Windows updated” are two different protections, and you want both. And it wasn’t only Microsoft: Google pushed an emergency Chrome fix in the same week for a flaw that was already being exploited, so your browser needs attention too.
Are you affected?
If your computer runs Windows 10 or Windows 11, assume the answer is yes. These fixes apply broadly, and the ones being exploited don’t care whether you’re a large business or someone checking email at the kitchen table. The flaws that were public or under active attack before patch day are the ones to prioritise, but for a home user the practical takeaway is simpler: get current, and stay current.
The good news is that Windows installs most updates automatically. The catch is that “most” and “automatically” hide a lot of paused updates, deferred restarts, and “I’ll do it later” clicks. A machine that downloaded an update but never restarted is still exposed, because many fixes only take effect after a reboot. The only way to know where you stand is to look.
This is also a good moment to check any second devices that tend to get neglected — an old laptop, a family PC, a media machine in the corner. Those are the ones most likely to be sitting several updates behind, and they’re on the same network as everything else you care about.
How to update Windows the right way
The two-minute version is straightforward:
- Open Settings (press Windows + I).
- Go to Windows Update — it’s near the bottom of the list on Windows 11, or under “Update & Security” on Windows 10.
- Click Check for updates and let anything waiting download.
- When prompted, choose Restart now — this batch, like most security updates, isn’t fully applied until you reboot.
- After it restarts, reopen Windows Update and confirm it reads “You’re up to date.”
If updates are stuck, paused, or failing with an error, that’s worth fixing on its own — a PC that can’t update stays exposed every single month, not just this one. Our full guide to updating Windows 11 safely walks through update timing, what you can and can’t pause, checking your exact build, and recovering when an update goes wrong. If you only do one thing after reading this, make it confirming that your main PC actually shows “up to date.”
The encryption angle
The BitLocker bypass in this batch is a good prompt to check that your sensitive files are protected the way you assume they are. Disk encryption is excellent for the stolen-laptop scenario, but it isn’t a substitute for keeping the system patched, and it doesn’t do much for individual files you share or sync to the cloud.
If you’ve been meaning to sort this out properly, our guide to the best encryption software for Windows compares full-disk and file-level options and explains which one fits which problem. And if you only need to lock down a folder or two rather than an entire drive, password-protecting a folder in Windows covers the simpler route without extra software for most people.
The broader point is that encryption and updates solve different problems. One keeps your data unreadable if the hardware is lost or stolen; the other closes the doors attackers use to get in while the machine is running. Treating either as a replacement for the other leaves an obvious gap.
Don’t forget your browser
Because Chrome’s fix this month was for an actively-exploited flaw, updating it is just as time-sensitive as Windows. Chrome usually updates itself in the background, but it only finishes the job when you relaunch — so if you’re the kind of person who keeps the browser open for weeks at a stretch, you may be running an old, vulnerable version without realising it.
To force the check, open the menu, go to Help, then About Google Chrome. It’ll check for updates and show a Relaunch button if one is waiting; clicking it reopens your tabs where you left them. The same idea applies to whichever browser you use — none of them protect you until the new version is actually running.
While you’re in there, it’s a sensible moment to revisit what your browser exposes day to day. Our Chrome privacy guide covers the settings worth tightening, from tracking and ad-topic toggles to what syncs to your Google account.
Staying protected beyond this month
One update doesn’t fix the habit that matters. The single most effective thing you can do is leave automatic updates switched on for both Windows and your browser, and actually restart when you’re prompted rather than postponing it for days. That one change closes most of the exposure window on its own.
Beyond that, keep Microsoft Defender — or whatever antivirus you run — current, since it’s part of how freshly disclosed exploits get detected and blocked. Keep a backup you could actually restore from, because the worst outcomes, ransomware especially, are survivable when your data isn’t living in only one place. And stay a little sceptical of urgent “your PC is at risk, click here” messages, which tend to arrive precisely when real security news is in the headlines.
If you want the bigger picture rather than a one-off checklist, our complete guide to security and privacy ties these habits together, and if the jargon around exploits and infections trips you up, the different types of malware, explained is a plain-English primer. For the official technical detail — affected versions, CVE numbers, and download links — the Microsoft Security Response Center website publishes the full list at msrc.microsoft.com, and the CISA website at cisa.gov tracks which vulnerabilities are being actively exploited across the industry.
The bottom line
This isn’t a moment to panic, it’s a moment to patch. Open Windows Update, install what’s waiting, restart, and do the same for Chrome. Five minutes now closes the exact gap this month’s attackers were relying on — and building the habit means next month’s release is a non-event instead of a scramble.
