Update, April 30, 2025: This story, originally published April 28, has been updated with further information regarding the hotpatching security update service for Windows Server 2025 users, as well as news of how to get security updates for legacy Windows operating systems that no longer have security support or patches available from Microsoft. .
When it comes to security updates, those that fix vulnerabilities in an operating system used by billions are high on the mandatory agenda. Which is why it has not been the greatest month for Microsoft, what with the online furor after a recent Windows security patch added a mysterious folder, without any explanation. Social media “experts” advised users to delete it, only for Microsoft to issue an advisory warning that would leave them open to attack. That update, and the installation of the inetpub folder, has now been shown to actually open the path to a different Windows hack attack. Now the whole Windows security update business has another contentious issue to deal with: charging a monthly subscription to receive no-reboot security “hotpatch” updates.
What Is Windows Hotpatching?
As I reported April 14, Microsoft is moving toward a time whereby a hotpatching function would negate the need to reboot your Windows system following a security update. The no-reboot security fixes would download and install in the background, deployed within the in-memory code of already running processes. That report was concerning the feature coming to users of a very specific version of Windows 11: Windows 11 Enterprise, version 24H2 for x64 (AMD/Intel) CPU device users running Microsoft Intune for deployment. Now, Janine Patrick, Windows Server product marketing manager, and Artem Pronichkin, a senior program manager at Microsoft, have confirmed that the hotpatch system for Windows Server 2025, comes out of preview mode on July 1.
Microsoft has said that hotpatching brings a number of important benefits to the security update process. Not least that there will be higher availability with fewer reboots required, and that’s no bad thing in anyone’s book. Updates will be faster to deploy as they will arrive in much smaller packages that install quickly and, Microsoft pointed out, have easier patch orchestration with the optional Azure Update Manager. Finally, and most important as far as I am concerned, is the fact that because there is no rebooting required, the windows of vulnerability, that period between a vulnerability becoming known and getting patched, so leaving it open to exploit by attackers, closes sooner. This is particularly of note, Microsoft said, “if an administrator might normally delay an update and restart after a Windows security update is released.”
Who Needs To Pay The $1.50 Per Core Windows Update Subscription Fee?
Microsoft has said that the Windows Server 2025 hotpatching feature, which has been available in preview mode since 2024, will become a subscription-only service from July 1. So, who has to pay the fee?
Well, first things first, to be able to run the no-reboot hotpatch security updates feature, Microsoft said that you will need to be using “Windows Server 2025 Standard or Datacenter, and your server must be connected to Azure Arc.” The important and controversial bit quickly followed: “You will also need to subscribe to the Hotpatch service.”
Although hotpatching has been available for the longest time for Windows Server Datacenter: Azure Edition, and it will continue without charge, these security updates for Windows Server 2025 users will cost $1.50 per CPU core per month. Yes, you read that right, per core.
“With hotpatching,” Microsoft said, “you will still need to restart your Windows Servers about four times yearly for baseline updates, but hotpatching can save significant time and ease the inconvenience of a traditional Patch Tuesday.” Only you can decide if it is for you, and the service is entirely optional.
How To Get Legacy Windows Updates When Security Support Has Ended — Hotpatching Included
All this talk of paying for the optional hotpatch technology if you are a Windows Server 2025 user must be driving users of legacy Windows operating system platforms crazy. While there are plenty of people who still enjoy using old, and I do mean old, versions of Windows in their daily lives, what they won’t be enjoying are security updates. End of support means just that. No more support, no more security updates, no more protection against attackers. There is, however, a way to get around this security update conundrum. When I read about the hotpatching subscription intent, I couldn’t help but think about the 0patch service, which I have written about a few times now. 0patch usually crops up when I’m covering a zero-day threat that is being exploited in the wild by attackers, but Microsoft does not yet have a working fix for it. 0patch is a micro-patching service, and a commercial one at that, providing what you might think of as vulnerability sticking plasters until such a time as Microsoft gets the real deal circulated to its users. Which isn’t to say they don’t work, they certainly do. What’s more, they work without requiring a system restart. Yes, that’s right, they are hot patches and have been around for years now. They work by applying the necessary fix in memory without disturbing the relevant process itself. Even better, more often than not, when a hot patch becomes available for an exploited zero-day, 0patch makes them available free of charge until the Microsoft fix is in.
When it comes to users of legacy Windows platforms this is good news, as 0Patch is pretty much the only way to get patches for security vulnerabilities. The good news, as I reported April 29, is that 0patch has decided to extend the availability of these hot patches for users of Windows 7 and Windows Server 2008 R2 until at least January 2027. “Our security patches are the only security patches existing for these Windows versions,” Mitja Kolsek, the CEO of ACROS Security, the company behind 0patch, said.
