Applying patches may be a basic security principle, but that doesn’t mean it’s always easy to do in practice.