§1

Every edition

With the Fine Meter reading of the day, for the historians.

  1. No. 46
    Both ends of the remote-support cable went bad on the same day

    “Remote management is a door you fit on your own behalf, into your own wall, and then hand the key to a supply chain whose hiring policy you have never read.”

    3/5 · Not especially fine
  2. No. 45
    Microsoft patched a four-figure number this month and nobody can agree which four figures

    “The size of a patch release measures how good the vendor has become at finding bugs. It measures nothing at all about Thursday.”

    3/5 · Not especially fine
  3. No. 44
    Four new KEV entries, and the one that matters is in sshd

    “A leak site that posts 134 listings in one day is not 134 breaches. It is one script, and a business model that has discovered the pre-order.”

    3/5 · Not entirely fine
  4. No. 43
    Five remote holes in a router that has no one left to fix it

    “A device at end of life has not stopped working. It has stopped being anybody's responsibility except yours, and the exploit does not read release notes.”

    3/5 · Not great, not yet a crisis
  5. No. 42
    Four ways in this week, and none of them needed your password

    “Every ransomware surge is a posting schedule before it is a set of incidents: the spike is the operator's calendar, drawn on your dashboard, and you will still…”

    3/5 · Not fine, but standing
  6. No. 41
    Key-only was a configuration claim, and somebody checked

    “The gap between disclosure and exploitation is not a window. It is the length of time it takes someone to read the same advisory you did, while you were in a m…”

    3/5 · Not especially fine
  7. No. 40
    Key-only authentication was a claim, not a control, and it has been a claim since 2016

    “A locked account is not a control. It is a sentence in a config file that nobody has yet tried to contradict with three hundred characters.”

    3/5 · Not entirely fine
  8. No. 39
    Your incident happened at a company you have never audited

    “Third-party risk management is the belief that a questionnaire returned in April governs a refrigeration controller in November.”

    3/5 · Not fine, but survivable
  9. No. 38
    Binance did not lose billions to a sophisticated attack. It lost them to a job interview

    “A supply chain is a list of strangers whose Monday becomes your Friday, and it is always Friday.”

    3/5 · Not entirely fine
  10. No. 37
    Two more Ivanti Connect Secure zero-days land in KEV, about a month after someone else found them

    “Every advisory contains two dates, and the one the attacker used is always the older one.”

    3/5 · Not especially fine
  11. No. 36
    CISA put two Ivanti flaws in the catalogue. The attack needs three

    “A vulnerability chain is not three bugs. It is one bug that took three release cycles to finish assembling, and the vendor shipped every part of it.”

    3/5 · Not fine, but survivable
  12. No. 35
    CISA lists two Ivanti Connect Secure flaws. The attackers were using three

    “Three medium findings chained end to end are not three findings. They are one root shell with a project plan, and it was always going to be filed under 'sophis…”

    3/5 · Three: a chain, a catalogue entry, and a Sunday
  13. No. 34
    KEV took delivery of the edge: a 10.0 in GitLab, a firewall that reloads on request, and two Ivanti links in somebody's chain

    “A zero-day in the box that terminates your VPN is not a vulnerability. It is a change of ownership, published as a release note.”

    3/5 · Noticeably not fine
  14. No. 33
    CISA adds a Cisco firewall zero-day whose entire payload is the firewall falling over

    “A deadline you did not set is still a deadline. The leak site's release calendar is the only schedule in the incident that has never slipped.”

    3/5 · Not entirely fine
  15. No. 32
    The deadline was Thursday. It is Thursday.

    “A vulnerability with a brand name is patched before a vulnerability with only a number, which tells you that our prioritisation engine is, and has always been,…”

    3/5 · Less fine than usual
  16. No. 31
    PHP2Shell is on KEV with a Thursday deadline, and every confirmed shell so far landed in a honeypot

    “Every "actively exploited in the wild" begins life as "somebody's honeypot did its job"; the distance between those two sentences is where your entire week goe…”

    3/5 · Not entirely fine
  17. No. 30
    PHP is in KEV twice, and the shells landed before the advisory did

    “The bug with three marketing names has a patch and no victims; the bug with a boring name has thirty-five shells and a due date.”

    3/5 · Not fine, but survivable
  18. No. 29
    CISA moves Collabora Online and Arista VeloCloud Orchestrator from 'possible' to 'already happening'

    “A gang that is cooling at 22:58 and escalating at 23:50 has not changed its behaviour in under an hour. The dashboard has, and the dashboard is the one in the…”

    3/5 · Probably fine, with an asterisk
  19. No. 28
    CISA adds critical flaws in Collabora Online and Arista VeloCloud Orchestrator to its exploited list, on a Friday, naturally

    “A second source that read the first source is not corroboration. It is an echo with a confidence score.”

    3/5 · Fine-adjacent
  20. No. 27
    CISA adds two exploited bugs, and one is the third Arista VeloCloud zero-day in four months

    “Three feeds agreeing is not corroboration. It is one feed with a hobby and two friends who repost it within ten hours.”

    3/5 · Not entirely fine
  21. No. 26
    PHP2Shell was in the wild four days before the fix, and most of what hit the sensors afterwards does not work

    “A patch date is not the start of the attack. It is the moment the attack acquires a reference number and somebody to blame.”

    3/5 · Not especially fine
  22. No. 25
    PHP patched the internet's plumbing at two in the afternoon; the sensors had company before lunch

    “The window between a leak and a patch is not a gap in the timeline. It is a product, and someone else is shipping in it.”

    4/5 · Not fine, but patchable
  23. No. 24
    MFA did not fail on PAN-OS. It was never asked

    “A root of trust is not a mathematical fact. It is a statement about the worst morning somebody had during a key ceremony, preserved in your trust store for a d…”

    3/5 · Not entirely fine
  24. No. 23
    The backup was the way in: ConnectWise suspends Cloud Backup after confirming an intrusion, and researchers say its credentials opened Microsoft 365 tenants

    “The backup is the only complete copy of the company that nobody watches, which is why it is the copy the attacker reads first.”

    3/5 · Not entirely fine
  25. No. 22
    One credential, 173 tenants: ConnectWise pulls the plug on Cloud Backup

    “A credential that works in 173 organisations is not a credential. It is a weather system, and you do not patch weather.”

    3/5 · Not especially fine
  26. No. 21
    The BeyondTrust bug was doing its job for seven weeks before anyone gave it a number

    “A zero-day is a vulnerability that has been working for seven weeks and has only just been given permission to have a number.”

    3/5 · Not entirely fine
  27. No. 20
    BeyondTrust zero-day joins KEV on a Friday, having been exploited since late August

    “A zero-day is not a new vulnerability. It is an old one, dated from the moment the vendor found out, which is why the clock always starts late and never runs b…”

    3/5 · Not especially fine
  28. No. 19
    Four edge products were exploited yesterday. The catalogue gained one entry, and it was none of them

    “A vulnerability becomes "actively exploited" on the day somebody finishes the paperwork. It became exploited considerably earlier, and nobody sent a calendar i…”

    3/5 · Not fine, but survivable
  29. No. 18
    Ivanti shipped fixes for two of the three flaws. The attackers were only ever using all three

    “A patch that fixes two bugs in a chain of three is not remediation; it is a pause in the attacker's typing, which you have agreed to call a resolution.”

    3/5 · Not especially fine
  30. No. 17
    Ivanti Connect Secure: rooted while fully patched, and one of the three holes is still open

    “The number of flaws a vendor fixes in a month is not a measure of their diligence or your risk. It is a measure of how much code they shipped while nobody was…”

    3/5 · Not fine, but survivable
  31. No. 16
    Forty maritime victims, one clock: N0n's port dump all expires at 13:27 UTC on 19 October

    “Forty countdowns that expire in the same minute are not forty incidents. They are one supplier, counted by its customers.”

    3/5 · Not fine, but survivable
  32. No. 15
    One pulse says Artifactory is being exploited through three chained CVEs. The question this morning is what one pulse is worth

    “A bounds check that only runs in the debug build is a promise the developers made to each other. The attacker was never in the room.”

    3/5 · Fine, in the way a smoke alarm with a flat battery is quiet
  33. No. 14
    SonicWall patched on Tuesday. It was being exploited by Friday.

    “An arrest is a personnel change. The leak site has no notice period.”

    3/5 · Not fine, but defensible
  34. No. 13
    Patched Tuesday, exploited Friday, and the backup platform never got a patch at all

    “A patch is not a control until it is installed. Until then it is a public disclosure with your name on the distribution list.”

    3/5 · Not entirely fine
  35. No. 12
    FortiBleed: the patch is not the remediation, because the attacker has an account now

    “A patch closes the door the attacker came through. It does not log out the account they made on the way in.”

    3/5 · Not fine, but not yet loud
  36. No. 11
    Atlassian patched on Monday. The exploitation attempts arrived two hours after the details did

    “The disclosure window is not a window. It is a doorbell, and the two hours you thought you had were the time it took someone to walk up the path.”

    3/5 · Not fine, but survivable if you move today
  37. No. 10
    Ten ransomware crews peaked on the same day, and the vulnerability feed picked that day to go quiet

    “An actor classified as cooling has not stopped working. It has stopped talking to you and started talking to its scheduler.”

    3/5 · Not entirely fine
  38. No. 9
    Eight ransomware brands with no prior history all posted victims on the same day, and one of them named T-Systems

    “A leak site with no history is not a new adversary. It is an old one with a clean spreadsheet, a fresh logo, and the same Monday as everybody else.”

    3/5 · Not fine, but survivable
  39. No. 8
    The KEV entry says denial of service. The researchers have not finished reading

    “An impact rating is not a property of the vulnerability. It is a property of how long somebody has been looking at it.”

    3/5 · Not entirely fine
  40. No. 7
    FortiMail joins the KEV catalogue while Citrix NetScaler takes a second hit in a week

    “The appliance you bought to inspect all of the traffic is, on the day it fails, the fastest available route to all of the traffic.”

    3/5 · Not especially fine
  41. No. 6
    CISA confirms exploitation of a FortiMail zero-day, and adds a two-bug Zammad chain for the weekend

    “A vulnerability feed that goes quiet has not made the week safer; it has simply stopped photographing the tide.”

    3/5 · Not fine, but survivable
  42. No. 5
    Citrix, Cisco, FortiMail and Zimbra are all being exploited, and the CVE feed has gone quiet

    “A known-exploited-vulnerabilities catalogue is not an early warning. It is the attacker's homework, marked and handed back to you days after they finished with…”

    3/5 · Not especially fine
  43. No. 4
    The edge gave way in three places and only two of them made the catalogue

    “Every appliance sold to guard the perimeter eventually becomes the perimeter, and shortly after that it becomes the incident.”

    3/5 · Not fine, but survivable with coffee
  44. No. 3
    Citrix NetScaler zero-day exploited in default configurations while the news took two days to notice

    “A feed you do not poll yourself is not early warning. It is a witness statement, taken later, by someone who was not there.”

    3/5 · Not especially fine
  45. No. 2
    Two NetScaler zero-days, exploited before the patch, and a Wednesday deadline

    “A key in a .env file is not a secret. It is a subscription you have opened, generously, to everyone who can type a URL.”

    3/5 · Not entirely fine
  46. No. 1
    Two Citrix NetScaler zero-days, exploited, on KEV, and federal agencies have until Wednesday

    “Every emergency patch deadline is a measurement of how long the attacker had before anyone wrote it down.”

    3/5 · Not entirely fine

Read the latest: No. 46 →