622 Flaws Addressed in Microsoft Patch Tuesday; CVD Program Guidance from CISA & Internat'l Partners

I think many will see this number and shout "vulnerability apocalypse is here," but I would wait until we see clear increases in both exploitation and resulting incident damages.

Microsoft is a bit of a different beast when people discuss an upcoming Vulnerability Apocalypse because they have so much money to throw at the problem. A 622-patch-per-month release cycle is what they can do, if not more. The smaller players will be the ones that will have a more difficult time with this number of bugs. But I am going to take a bit of a contrarian take on something just so that folks can be more rational about this. If you have thousands of bugs to patch and prioritize, which ones would you do first? In my opinion, patching Windows is obvious and easy, but after that, which ones go first? I would choose the ones with actual exploits behind them. Now we have yet to see many public PoCs for these 600+ patches, and I’m waiting to see how that pans out. How many public PoCs that work will see over 600 vulnerabilities in one month? That will be the tell. To be clear: patch and patch now, but also keep an eye on what the attackers are doing.

I, for one, welcome our new vulnerability overlords, as AI helps us drain the swamp of vulns long hidden. It’s going to be an interesting ride for our industry as this becomes the new normal. I’ve personally taken a special interest in the evolving concept of VulnOps, applying the lessons of continuous development pioneered in DevOps (with a lift from AI too) to the vulnerability management space to help handle the deluge of vulnerabilities we now face.

This month's record number of vulnerabilities from Microsoft reinforces that organisations need to move beyond just patching towards a mature vulnerability management programme. This means maintaining an accurate asset inventory, continuously identifying vulnerabilities, prioritising remediation based on exploitability and business impact, implementing compensating controls where patching is not immediately possible, and continuously monitoring for signs of compromise. In an era where AI is dramatically shortening the time between vulnerability disclosure and exploitation, operational discipline and not simply applying patches will determine an organisation's resilience.

In addition to the 622 vulnerabilities from Microsoft, 72 of which are marked critical, Chromium has another 422 vulnerabilities, which affect Microsoft Edge. The trick is not to panic. Yes, this is a surge thanks to the use of AI tools to find and address current as well as previously undiscovered flaws; even so, we were already past the point for individual care and feeding of each applied update. We need to organize systems and compensating controls. To paraphrase a suggestion from Paul Asadoorian: Tier 1 where patches are auto-applied, Tier 2 which targets 72 hours with approved change windows and automated regression testing, and Tier 3 (critical apps) at seven days, using pre-built playbooks and pre-authorized decisions. In addition, compensating controls, WAF, RASP, Segmentation, and behavior detection to mitigate risks of unaddressed/undiscovered flaws.

We are seeing a bumper crop of vulnerabilities, proving just how good AI has become at sniffing out software flaws. But while we still rely on CVSS scores to prioritize patches, that's about to change. AI's ability to chain seemingly minor vulnerabilities into sophisticated, multi-stage attacks means static scoring isn't enough anymore. If organizations haven't automated and overhauled their vulnerability management processes over the last few months, they need to start now.

There used to be a TV show called "House" where a team of doctors tried to diagnose a patient with an exotic ailment, and when they were stumped, someone would inevitably say "We need to do a full body MRI scan." Dr. House would say "No, that will show us all kinds of things wrong with the patient — we are only interested in this one life-threatening thing wrong with the patient." In cybersecurity, triage is more complex: both the good guys and the bad guys can and do run "full body scans" of apps. Thirty years ago, automated vulnerability scanning tools like Satan forced regular patching, and in the early 2000s, software testing tools like Fortify and Sanctum came out and Microsoft moved to monthly patch release, forcing Vulnerability Management to evolve as a critical security practice. This wave of good guys and bad guys using AI tools needs to spur another evolution of faster patch releases (which already happens with browsers) and faster patching.

This is not simply "patching as usual." There is risk in applying so many patches at once. The larger the enterprise, the greater the risk.

Dovetailing on the large number of vulnerabilities this month, I see that multiple agencies are trying to get ahead of things by helping the smaller companies formalize the reporting process. This is a good move.

This is exciting! We've seen what happens when disclosures are ignored or can't be delivered, but you can't just ask AI to create your CVD program either. This comprehensive approach, driven by global input, is the droid you're looking for. If you already have a CVD or VDP, take a look to see if you missed any tricks. Even so, remember that people are reporting flaws in pet projects, which may not be received well by everyone, and that you need to guide people toward realizing that this is being done out of support and a desire to help you do better, not to criticize or make you look bad.

As the vulnerability space gets more and more cluttered and noisy, this initiative has great promise. I’m appreciative of the organizations working on it from around the world! Good stuff.

Treat this USG and partner-nation guidance as a strong foundational baseline, but don't stop there. Use it as a stepping-stone while you concurrently deploy AI to automate vulnerability discovery and secure your development pipelines.

Although this guidance comes from CISA and its international partners, it is essential reading for any organisation that develops or sells products with digital elements into the EU. The EU Cyber Resilience Act (the EU CRA) requires manufacturers to have robust vulnerability handling and coordinated vulnerability disclosure processes in place throughout the lifetime of their products. Organisations that have yet to establish or mature these capabilities would do well to use this guidance as a practical starting point.

This guidance is helpful but this remains a hard problem. It will get harder as the time between vulnerability identification and exploitation continues to shrink. In the long-run we must improve the quality of our code. We should encourage the use of AI for both coding and testing.

Cisco Smart Install is one of those bugs we constantly see at my consultancy during testing. The number of internal and external hosts that still have this bug is very alarming. Take some time and harden your network infrastructure.

Russian FSB-linked attackers, namely Energetic Bear, aka Dragonfly or Crouching Yeti, are still finding and exploiting public SNMP community strings, Cisco SMI, and TFTP loaded configurations. These were things we did back in 1999, not 2026. I believe the Metasploit module to exploit these flaws is from 2010. If you have SNMP exposed to the Internet, block it, or Cisco SMI, turn it off. Then ask, why were we still doing this?

Routers, switches, and other network devices are often deployed and then forgotten until something goes wrong, making them attractive targets for attackers. Maintaining current firmware, replacing end-of-life devices, and disabling unnecessary services remain some of the simplest and most effective ways to reduce your organisation's threat profile.

This new joint guidance on routers outlines foundational security controls that are equally critical for end-user devices. For leadership, implementing these practices is not optional — it is a core component of a legally defensible cybersecurity program. Omitting these controls leaves an organization highly vulnerable to claims that it failed to exercise a standard duty of care in safeguarding its digital assets.

I am not aware of any routers that support strong authentication. SOHO users are limited to strong passwords. Enterprises should consider strong passwords, parts of which are held by different individuals. That said, there are obvious lessons here for router design.

This is a more traditional supply chain disruption, and maybe an excuse to make sure you've kept your physical supply chain DR plans updated. An interesting approach taken by KFC Japan is to suspend online ordering to reduce demand on their foreshortened inventory. Of concern is that the Nichirei Group is withholding information about the incident to prevent further damage; this is as much of a hint that there are exploitable weaknesses, if not more so, as a more traditional disclosure would. This may also erode the opportunity for others to learn from the incident to prevent a similar event locally.

This incident is another reminder that cyberattacks can have consequences far beyond the organisation directly affected. Disruption to a logistics provider quickly cascaded into food shortages and operational challenges for retailers and restaurants. As regulations such as NIS2 increasingly emphasise resilience alongside cybersecurity, organisations should assess not only their own resilience but also that of critical suppliers within their supply chains.

This one is a reminder to review your supply chain security efforts — is your risk definition/mapping up to date?

As a massive global conglomerate, the Nichirei Corporation undoubtedly dedicates significant resources to enterprise defense. This incident serves as a stark reminder that scale and a robust security budget do not guarantee immunity; even the largest organizations remain vulnerable to sophisticated cyber criminals.

Are you sure that you are not infrastructure?

In parallel with looking for IoCs, remind users to watch out for "Click Fix" scams where you copy and paste into a command or terminal window or Windows Run. With hacker summer camp just around the corner, it's an opportunity to expose others to social engineering villages, or similar, to see just how effective (and easy) these sorts of attacks are, hopefully resulting in support for helping your users make good decisions.

VirusTotal remains a vital tool for the security community, but basic endpoint hygiene still plays a massive role. It sounds simple, but execution is everything: if a device starts behaving strangely, reboot it. Above all, do not click on or trust any active dialog boxes or pop-ups that appear during the anomaly.

This is a reminder that we need to really understand how biometric data is protected, shared, and disposed of before contributing to that data set. I'm cautiously optimistic that this addresses the problem. Even so, verify these controls are in place before using the system under the new owner. Think ‘trust but verify.’

I’m hoping this serves as precedent case law for similar bankruptcies we will surely see as AI shakes out, with even more security sensitive data being impacted in AI models/databases created by the companies in bankruptcy.

It is past time to implement strong authentication both for Internet facing services and internally. Strong authentication is now considered to be both efficient and essential. Passkeys are even convenient. No excuses left.

These operations demonstrate that effective international law enforcement cooperation can significantly disrupt organised cybercrime. However, the scale of these fraud networks also shows how cybercrime has evolved into a highly organised global business, making prevention through public awareness and financial fraud detection just as important as law enforcement actions.

The idea of a fradulent investment isn't new, heck, it's older than we are, but the hook is getting into the new and shiny cryptocurrency — after all, who wants to be left behind for the next financial frontier? This comes back to helping our family, friends, and users make good choices when faced with social engineering scams. For grins, talk to your financial institution about how their fraud unit can help you, as they may have training or other guides you can leverage.

While it is good news to read about cybercriminals receiving prison sentences for their illegal actions, it saddens me when I read the background of young individuals like these two. Cases like this demonstrate that arrests and prison sentences, while necessary, come too late for everyone involved. The damage to victims has already been done, and the offenders have lost years of their own lives. With both individuals having had previous contact with law enforcement, there is a clear need for better early intervention programmes to identify young people who are vulnerable to recruitment and grooming by cybercriminal groups. Breaking that cycle before criminal careers begin would benefit society far more than simply prosecuting offenders after the fact.

Those guilty pleas got them a fifteen percent reduction in their sentence. Scattered Spider was behind the recent attacks on MGM Resorts, Marks & Spencer, the Co-op, and Harrods; it's nice to see them set back. The TfL attack leveraged purchased credentials which were then used to reset 2FA credentials. Note that it took a few tries to pull that off, but they did. Once they had those credentials, they were able to elevate privileges and access systems and databases. One thing that worked well was early engagement of law enforcement, which facilitated the arrests and conviction. I see this as a reminder to make sure your MFA is not one which is easily compromised, as SMS is. Look forward to implementing phishing resistant MFA as well as deprecating unsecure fallback authenticators.