No one is updating their Android devices, new data shows

"Patch early and often?" Not so much.

It’s typically good advice to patch early and often. What’s said less often is that most of the time it just isn’t happening.

Duo Security has new data to back that up: The company released a study Wednesday finding 90 percent of over 10.7 million Android devices across the U.S. and Western Europe are running outdated versions of the operating system. Additionally, only 8 percent of Android phones ran the latest security patch, according to the report.

It’s a significant gap that’s due in large part to Android’s enormous, fractured ecosystem. Users often receive updates haphazardly through their carriers or phone manufacturers, and that’s if they get them at all. Attackers often take advantage of this, with new malware frequently popping up that preys on old Android models.

Even as Android’s competitor Apple is doling out patches through its App Store, there is a significant gap in users updating to the latest version of iOS. Duo found that 56 percent of iOS devices are running old versions of the software.

The out-of-date software problems aren’t solely confined to mobile devices. Duo found that computers are often behind on operating systems as well: Seventy-four percent of MacOS and 85 percent of ChromeOS machines were not running the latest software.

The number is for ChromeOS is peculiar, given that machines running Google’s system auto-update on every restart. But for ChromeOS, widely hailed as one of the most secure computing environments available today, the numbers don’t necessarily tell the whole story.

“Because Chrome updates more frequently than other operating systems, its users may be technically out-of-date, but they’re likely only a couple of weeks behind, as compared to potentially being many months out-of-date on other platform,” said Kyle Lady, an engineer at Duo Security. “In this case, an out-of-date OS doesn’t necessarily determine if it is ‘less safe’ compared to others, given that the security model of ChromeOS means it is likely safer while out-of-date, especially since it’ll get an update ready for whenever the next reboot happens.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure