#NSBCS.146 - Taking a stick and beating the PATCH NOW horse
Recently, there have been headlines regarding ArtCraft and how AI was used to develop a clone of Adobe and Microsoft products. What piqued my interest was chatter around how AI could have been used to reverse-engineer the products. Note: This is what the headlines said; it hasn’t been confirmed officially.
But it is an interesting time to be alive for vulnerability research, and probably a terrible time if you have to manage patches. Currently, most security frameworks recommend a patching timeframe for critical vulnerabilities (with a known exploit) of between 24 and 48 hours, and that’s reasonable considering the time and effort involved, particularly for enterprise production applications. Organisations often prioritise urgent patching when there is a known exploit, rather than treating every critical vulnerability with the same urgency, which makes sense as patching also means resourcing and effort. But in reality, organisations still have a tough time meeting the 24–48-hour window.
AI reduces the barrier to vulnerability research, adding capability to researchers and threat actors alike who may not have had that ability prior to AI. When applying this to vulnerability disclosures, this opens up another difficult the question: even if a critical vulnerability is not exploited or does not have a known exploit at the time of release, how quickly can AI produce a working POC if provided with all the context it needs? On release, a threat actor can obtain the patch, which contains the fix for the vulnerability, and a brief description of what the vulnerability is. They can simply point their AI workflow at these, and it’s possible for a proof of concept to be produced within 24–48 hours. This isn’t a new concept, with open-source projects creation of 1-day exploits is pretty common, but with proprietary applications where the underlying code is not visible AI can be used to reverse engineer the code, making the potential for 1-days greater than it used to be.
So what do we do from here? There isn’t a silver bullet here; rather, we need to ensure we adopt the fundamental security practices, especially for our internet-facing systems and applications.
Establish vulnerability management program. You can’t patch if you don’t know a patch is available.
Optimise patching. Ensure the patching process is optimised and can meet patching timeframes. Be sure to test, though, so as not to break production.
Apply perimeter mitigations and controls. If you cannot patch, use controls such as your web application firewall to mitigate attack traffic or even block vulnerable paths and disable unused features.
Improve detection capability. Can you detect when your server is under attack? Can you detect when your internet server is compromised and is going rogue? Can you detect when a legitimate account is accessing information it shouldn’t be? Ensure you have the logs you need and can investigate quickly.
Limit the blast radius. Limit what can be accessed from the internet server through APIs, don’t allow SSH access to other resources if it’s not required, and don’t keep sensitive information on the server. If you can download your full database from the internet server, then so can the threat actor. Taking a server offline is better than having to rebuild your whole fleet.
Review and test backups. Some organisations tend to treat backups for their web servers as a lower priority, particularly when the servers are mainly used to serve web content, but honestly, a backup is easier than a rebuild.
AI hasn’t introduce some new concept that we haven’t dealt with before, it has just shrunk the time that we had to respond to them.
What we read this week
ACSC Updates Critical Alert on Citrix NetScaler with New SAML Memory Overflow Flaw - The Australian Cyber Security Centre has updated its alert on Citrix NetScaler ADC and Gateway products after the disclosure of CVE-2026-107406, a critical memory overflow vulnerability (CVSS 9.5) that can lead to remote code execution or denial of service. The flaw affects appliances configured as SAML service providers or identity providers; importantly, earlier patches for previously exploited NetScaler issues do not remediate this one. The ACSC has previously confirmed exploitation of related NetScaler vulnerabilities against Australian organisations and continues to urge immediate review of Citrix guidance, application of the latest builds, monitoring for compromise indicators, and reporting of any impact. Organisations should prioritise internet-facing or SAML-enabled instances and treat unpatched systems as high risk.
ACSC Issues Alert on Operational Technology and Edge Device Risks After Overseas Refrigeration Attacks - On 14 October the Australian Signals Directorate’s Australian Cyber Security Centre published guidance on cyber risks to operational technology, including refrigeration and cooling systems, following overseas incidents in which attackers remotely manipulated commercial refrigeration controllers (notably in French supermarkets). While no active targeting of Australian systems has been observed, the ACSC recommends organisations operating internet-connected OT assess exposure, review network segmentation, apply vendor guidance, and harden edge devices. The alert highlights the growing risk to physical systems that were not designed with modern cyber threats in mind and encourages proactive measures for both small businesses and critical infrastructure operators.
Microsoft’s Record October Patch Tuesday Fixes More Than 1,400 Flaws Including Exploited Windows Shell Zero-Day - Microsoft released its largest-ever Patch Tuesday update, addressing approximately 1,413 vulnerabilities across Windows, Office, SharePoint, SQL Server and other products. The most urgent is CVE-2026-96951, an actively exploited Windows Shell security-feature bypass (CVSS 8.8) that allows attackers to evade Mark of the Web protections via specially crafted files delivered by email or messaging. CISA added the flaw to its Known Exploited Vulnerabilities catalogue with a short federal remediation deadline. Microsoft attributes part of the high volume of discoveries to AI-assisted analysis. Organisations should prioritise deployment of the October cumulative updates, especially on endpoints that handle email and downloads, and restart systems promptly.
Ivanti Connect Secure Zero-Day Chain Exploited for Root Access on Fully Patched Appliances - Researchers at Volexity identified a previously unknown threat actor (UTA0576) chaining three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to achieve unauthenticated root-level code execution, even on fully patched systems at the time. CVE-2026-104935 covers an authentication bypass and remote code execution path (CVSS 8.6); a related privilege-escalation component remained unpatched at disclosure. Attackers focused on credential theft, data exfiltration, reconnaissance and log tampering. CISA added the vulnerability to its KEV catalogue and set a short deadline for federal agencies. Organisations should upgrade immediately to fixed versions (including 22.8R2.5 and later 25.x builds), rotate credentials, and conduct forensic checks, as integrity tools may not detect in-memory activity.
Cisco Patches Actively Exploited Critical Flaw in Secure Email Gateway - Cisco has released updates for CVE-2026-76519, a critical relative path traversal vulnerability (CVSS 9.8) in the Advanced Malware Protection feature of Secure Email Gateway. An unauthenticated attacker can send a crafted email attachment that allows arbitrary file writes and command execution with root privileges on the underlying operating system when the File Reputation service is enabled. Cisco and CISA confirmed active exploitation beginning in October 2026. There are no workarounds; affected organisations must upgrade to fixed AsyncOS releases and review systems for compromise indicators. Cloud instances have received mitigations, and customers contacted by Cisco are advised to renew credentials and cryptographic materials.