Glossary: Vulnerability, Asset and Change Management

Malicious update

Also written: malicious updates

Harmful code shipped inside a trusted update, as in the 2020 SolarWinds attack. Hashes and signatures help, but they can't prove innocence if the vendor's build system was compromised.