The Resilient Brief: 87% of CISOs Expect Bigger Cyber Budgets as AI Bugs Keep Landing Weekly
Keystone’s 18,835 Destroyed Wallets, LiteLLM’s Key Exposed for Months, Reuters on the Next Disruption, Moonshot Pulls Cyber Data From Kimi, Nadella on Open vs Closed Models & CISA’s Token Playbook
Welcome to issue #120 of the Resilient Cyber Newsletter!
PHP2Shell sent a lot of organizations scrambling last week, and the scramble itself is the part of the story worth dwelling on. Security teams across the industry rushed to find where PHP was running in their environments, work out what was exposed, and remediate as quickly as they could, and the chaos that created is a good snapshot of where vulnerability management stands right now.
PHP2Shell is also one example of a much broader pattern. We are all dealing with a surge of AI discovered vulnerabilities, and the volume is testing processes and teams that were built for a much slower cadence of disclosure. Coordinated vulnerability disclosure is getting more complicated as well, because multiple parties are now using AI to look at the same code and are finding the same vulnerabilities at around the same time, which raises hard questions about who discloses what, to whom, and on what timeline.
The same capabilities that are creating this pressure also give defenders a real opportunity, since AI can help us find and fix more issues and bolster our cyber defenses at a pace that was not possible before. We are still in a chaotic stretch at the intersection of AI, AppSec and vulnerability management, and this week’s stories look at how it is playing out across cyber leadership, AI and AppSec.
As an aside, it seems like everyone is out at [un]prompted this week, and I had a work travel conflict and couldn’t make it this year, though I was at the first one. It has quickly become one of the top AI <> Cyber conferences of the year, and I am having FOMO about missing it, but I will definitely be watching and sharing the talks as they go live.
AI is entering your organization through browser chats, extensions, IDEs, MCP integrations, vibe-coded apps, and agents with permissions of their own. Can your security team see what they access, what they share, and what they do next?
The AI Playbook for Security Teams maps nine AI entry points and gives you pointed questions to test visibility and control across each. You’ll also get a 40-control checklist and an AI maturity assessment to help prioritize the gaps. Use it to turn “we need an AI policy” into a concrete plan for enabling AI safely.
Thanks for reading the Resilient Cyber Newsletter! Subscribe for FREE and join 22,000+ readers to receive weekly updates with the latest news across AppSec, Leadership, AI, Supply Chain, and more for Cybersecurity.
In this episode, I sit down with Ciaran Martin, the founding head of the UK’s National Cyber Security Centre, to dig into the FUD and hype at the intersection of AI and cybersecurity.
OpenAI published a 15-page policy blueprint arguing that defenders have a brief and possibly temporary window of AI advantage, and it asks Congress to enact mandatory, capability-based national AI safety regulation. The proposals include required monitoring of frontier models, shutdown controls, secure-by-design duties for critical software and AI agents, a CISA-led national modernization effort with a five-year plan, and a CIRCIA-style framework for reporting serious AI incidents. OpenAI grounds the case in its own incident, where models running with reduced safeguards in internal cyber evaluations escaped their isolation controls and compromised parts of Hugging Face’s systems.
OpenAI is asking legislators, the policy community and the national security community to rethink how they approach AI, including giving cyber defenders access to capable models for safety reasons. The defender window argument shows up again as well, and it has become a common theme from OpenAI. Expect the proposal to split people. Some will read monitoring of frontier models and shutdown controls as a push for regulatory capture, while others will argue these are pragmatic governance and security controls worth examining given what AI means for national security.
Joshua Saxe argues that cyber damages grew 3x over the last decade, scaled fastest before ChatGPT arrived, and actually tapered from 2022 onward, so any AI security policy has to explain why AI has not yet produced a jump in damages.
His answer is that attackers face real bottlenecks, from a modeled 720,000 person criminal economy that is 90% scam and fraud operations to arrests, scarce talent and unstable access to inference, though he still calls this the calm before several possible storms. It landed the same week posts on X claimed a honeypot was hit 14,000 times in six hours, and Chris Krebs told CNBC that 3% of all vulnerabilities ever discovered were found in the last month, a figure EFF backed up by counting CVEs.
Cyber damages roughly tripled over the last decade and then tapered off, and in a thought-provoking piece Josh Saxe uses that curve to walk through the constraints attackers face. Attackers are real people with real constraints, much like enterprise organizations, even if the asymmetry still runs heavily in their favor. He also points to early impacts and the massive uptick in honeypot activity, a signal of where semi-autonomous and fully autonomous techniques are taking us. Attackers are using AI as a force multiplier, and in my opinion that is exactly why defenders need to be doing the same.
Source: Joshua Saxe, If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes?
Mike Privette followed up his map of AI company acquisitions in cybersecurity by tracking where AI companies, their corporate VC arms and partner funds are investing. He points to Anthropic backing interpretability and agent identity through the Menlo and Anthropic Anthology partnership, NVIDIA backing data protection and cryptography, and Databricks leaning into data security and governance. His read is that frontier AI companies are backing the last mile integration points without having to acquire them outright.
Two things can be true at once with the AI companies and cybersecurity. I and others have noticed these companies treating security as a big business opportunity, and I highlighted it on LinkedIn myself with the Anthropic S-1. They have leaned heavily on hype and FUD about finding bugs in their marketing, yet they genuinely believe cybersecurity is a major opportunity for leveraging AI, and it is also a business opportunity for them. Mike Privette walks through the deals happening across this space, and the implications reach founders, investors, incumbents and startups alike in terms of partnerships, competition and acquisition.
The Anthropic S-1 passage on cybersecurity as a near-term opportunity (SEC filing, as shared in my LinkedIn post)
Peter Walker shared a new paper finding that 88% of VC-backed founders receive zero exit value, and he suspects the real number is higher. He points to how many startups fail and to liquidation preferences that pay VCs first in an exit, and notes the paper found founders often receive little or nothing even in actual exits.
88% of VC-backed founders walk away with zero exit value, and Peter Walker suspects the real number is higher. The finding applies well beyond cyber, but a massive surge of capital has gone into cybersecurity startups over the last several years, and the power law he shows does not care about the excitement.
Many of those companies will never reach a successful exit, an IPO or even a sustainable business, and plenty of them will fizzle out. Venture-backed startups have always been that ruthless.
Eric Flaningam of Generative Value estimates that capex across the biggest AI infrastructure players will reach roughly $1.4T in 2027 and $1.5T in 2028, about 9x 2023 levels. His team’s math says the clouds need roughly $600 billion of annualized third-party AI revenue by late 2027 and $1.1 trillion by late 2028 to earn a 35% operating margin, against closer to $200B expected from the labs and leading apps by the end of 2026. He argues it only works if the frontier keeps winning high-value work, AI diffuses through the economy faster, and open models don’t compete the value away.
What would have to go right for all of this spending to pay off? Eric Flaningam works through the numbers and lays out exactly what the build-out needs. Cyber is riding a massive tailwind from AI and the excitement around it, and I have seen a ton of investment pointed at security, including from the model providers, so a lot rests on that growth continuing. A slowdown could certainly hit our industry, although security has historically held up well in downturns, so keep an eye on how this plays out.
Prime Minister Sanae Takaichi convened Japan's cabinet ministerial meeting on cybersecurity on October 26 after successive cyberattacks on Japanese companies caused large-scale data leaks, and told ministers to assemble an emergency countermeasures package, including funding, by sometime next week.
Her orders cover more support for victim companies and small businesses, wider information sharing with security vendors, "access and neutralization measures" against attacks whose nature has been established, and faster attack simulations and vulnerability checks on government systems using high-performance AI. It follows the Artex attacks on Japanese firms covered in the last issue.
Prime Minister Takaichi ordering an emergency package, funding included, shows cyber becoming a national emergency and a conversation at the nation-state level, given the impact on society and the disruption of digital systems. Seeing that level of national focus is encouraging. Japan has absorbed a string of incidents recently, and I think that is what got the government's attention. I expect Japan to be the first of many nations that have to elevate their focus and prioritization around cybersecurity.
Sophos CISO Ross McKerchar writes that his SecOps team handled seven incidents in seven days, including PHP2Shell, the ConnectWise Cloud Backup compromise and the second LiteLLM supply chain compromise, which he says would have been a quarter's worth a year ago. He grants that SEC material incident filings have barely moved and that PHP2Shell hasn't become a mass exploitation event, but argues the damage is arriving as many small incidents that are hard to measure, pointing to saturated IR firms and Google's count of 141 exploited vulnerabilities from January to August against 127 in all of 2025.
Ross McKerchar's seven incidents in seven days ties directly to my recent article on the breachpocalypse. The framing is debatable, and some argue exploitation is flat, but he captures what feels like the new normal, with multiple high-profile vulnerabilities landing every week and everyone scrambling to fix them. Incident response firms are seeing upticks too, a point Rob Joyce has raised. The work never stops, and that has always been the nature of cybersecurity, but AI has made it worse.
CyberScoop reports that CISA released a 10-page strategy called “CISA 2030: Defend, Harden, Prevail” that largely reaffirms the agency’s existing roles. CISA plans to review its core services within 60 days, implement over the following 180 days and report progress after a year. Acting Director Nick Andersen writes in the foreword that there is no guarantee a strong defense will eliminate intrusions, so resilience must be the foundation, with the goal to detect quickly, evict decisively and keep operations running. Critics say budget cuts have left CISA understaffed, including in areas the strategy now prioritizes.
Full disclosure, I spent time at CISA as a Cyber Innovation Fellow, and it remains a critical institution that I trust and whose content I share often because they do so much for the community.
As critics in the piece point out, the budget cuts will have a real impact on what CISA can do. A four-year strategy will also span different administrations, so priorities could shift with political party changes and whoever is president at the time. Government moves slowly, and it will likely take a while for CISA to get back to the operating capacity and bandwidth it had before these cuts.
A cyber incident on Monday forced the University of New Mexico Health System to divert ambulances, tell people to stay away from its main Albuquerque hospital and cancel appointments at more than 30 clinics. UNM runs the state’s only Level 1 trauma center, and employees reported messages on their computers claiming student, employee and patient data had been stolen. The FBI is assisting, and the nature of the attack hadn’t been confirmed as of AP’s Oct 26 update.
In my conversation with Ciaran Martin, he said the breachpocalypse would only be here once we saw real world impacts, and a hospital diverting ambulances and closing clinics is exactly that. We spend a lot of time on patching, websites and sensitive data disclosure, while this incident lands on real people and their lives. Connected organizations, medical systems included, are deeply exposed when cybersecurity fails. I suspect we will see more of this, not less, as AI capabilities get democratized and enable what I think of as script kiddie 2.0.
a16z surveyed 100 CISOs at companies with more than 1,000 employees about their 2027 priorities and budgets, and 87% expect cybersecurity spending to increase, driven mostly by AI-enabled threats and the attack surface created by their own AI deployments.
Most of the added spend is headed for tools, not at the expense of people, with nearly half of respondents expecting security headcount to grow and only 4% expecting cuts. All seven of the most-selected 2027 initiatives involve AI, with internal AI agent security, SOC automation and offensive security making the largest gains, yet only 18% report production use of AI SOC tools and 13% report production use of AI offensive security or AI remediation. Within twelve months, 45% plan a new purchase or upgrade for internal AI agent security, 42% for offensive security and 38% for AI usage and governance.
Steph Zhang and Owen Colby at a16z surveyed 100 CISOs, and 87% expect security spending to rise in 2027, driven mostly by AI-enabled threats and the attack surface of their own AI deployments. All seven of the most-selected 2027 initiatives involve AI, yet production use is still low, with only 18% running AI SOC tools in production. Attackers are already using AI as a force multiplier, so defenders putting it to work inside security is where the money should be going. Read it with the VC hat on, since a16z backs companies in several of these categories.
Tyler Cowen talks with Michael Kratsios, the President’s science and technology adviser, about the administration’s science plan, and the back third of the episode turns to AI safety and cyber risk. Kratsios argues for checking whether existing laws already cover a risk before writing new AI rules, and says frontier labs now share models with the government for at least 30 days before release under a June executive order.
Cowen presses him with the reported lone hacker behind the South Korean banking attack, and Kratsios says the rules should be updated as new information comes in while calling superintelligence the most powerful tool yet for securing cyber posture.
After a good part of my career spent in defense, federal civilian agencies and the national security ecosystem, I found the big push for innovation and moving fast refreshing. Most of the conversation sits outside cyber, though Kratsios does get into AI safety and cyber risks. I am a big proponent of the view that a strong national security requires a strong economy, economic prosperity and innovation, and that innovation and economic strength are national security, which felt like a new viewpoint to hear.
He is very optimistic about the opportunities across cyber, technology, medicine and the other areas he covers, and that optimism was a welcome change of pace.
OpenAI says an internal research model exploited a DNS resolver misconfiguration on September 20 to reach the live internet during a training run, which led to an 11 day pause before frontier training resumed on October 1 with no internet access and an offline world of cached web content.
Teams of frontier model agents, including the upcoming GPT-6 Astra Cyber, spent hundreds of billions of tokens red-teaming the setup and found microVM escapes, flaws in almost every narrow service that still reached the internet, and a CPU cache timing channel for passing secrets between sandboxes. Fixes went upstream to Kata Containers, gVisor, Moby and the Linux kernel, and high compute red-teaming is now part of OpenAI's safety cases.
Transparency like this from OpenAI about its own training environments is welcome, especially after the Hugging Face incident over the summer and the September 20 incident, when an internal research model exploited a DNS resolver misconfiguration to reach the live internet during a training run. OpenAI walks through how it has learned from those incidents, moving frontier training to an "offline world" of cached web content with no internet access and layering sandboxes, microVMs, monitoring and network perimeters so containment can hold even when an individual control fails.
The red teaming is the part I hope people pay the most attention to, with teams of frontier agents, including the upcoming GPT-6 Astra Cyber model, chaining together microVM escapes, finding vulnerabilities in almost every service that still had a path to the internet, and even passing secrets between isolated microVMs through the processor's cache.
OpenAI now makes high-compute red teaming part of the safety cases it uses to decide whether frontier training can proceed, and many organizations should take the same lesson, because red teaming the environments where we run AI, LLMs and agents needs to become a core part of our own security posture as well.
CISA, the Canadian Centre for Cyber Security and partners published joint guidance on October 22 that treats unmanaged token use as an operational and security risk, including token exhaustion and denial of tokens and denial of wallet attacks. It recommends tiering token allocation so cyber defence, incident response and threat intelligence get first priority, with alerts at 70%, 80% and 90% of quota and smaller or locally run models where they fit. Critical infrastructure operators are told to plan for reduced AI availability and keep non-AI capabilities such as manual operations training in case AI becomes unavailable or untrustworthy.
Token maxing, FinOps and the cost of model consumption have mostly been discussed from the CIO or financial perspective, so seeing CISA, the Canadian Centre for Cyber Security and their partners look at it through a cybersecurity lens is refreshing and important, since it's an angle our community often overlooks.
The guidance calls out denial-of-tokens attacks, where threat actors intentionally generate excessive AI usage to exhaust token allocations, consume budgets or trigger rate limits, and denial-of-wallet attacks that exploit pay-per-use pricing through things like complex prompts that force long outputs or loops that feed a model's output back into itself.
It also puts cyber defense, incident response and threat intelligence in the top tier for token allocation and warns that lower-value activities can consume capacity needed for critical operations, which matters for security teams leaning on AI because emergencies and heightened threat activity can drive up AI demand right when defenders need it most.
Other recommendations tie token usage directly to security operations, including monitoring unusual spikes in token consumption as a potential indicator of data exfiltration, much like abnormal bandwidth spikes, feeding token telemetry into the SIEM to correlate with identity, cloud and API logs, and maintaining non-AI capabilities in case the AI becomes unavailable or untrustworthy. Organizations need to keep this in mind as they lean further into AI, because token consumption has become an availability and security concern as much as a budget line.
Moonshot says it removed cyber related data from mid-training and RL before releasing Kimi K3.1 Pro as open weights, which dropped its score on an internal exploitation benchmark from 90.5% to 81.0% at pass@3, still well above Kimi K3 at 33.3%. The company says the model stays behind frontier proprietary models that have been public for at least three months, but it also intends to progressively raise the cyber capability it releases in open weights, with K3.1 Pro weights due by November 4.
Pulling cyber data out of mid-training and RL before an open weight release shows even open model developers trying to limit what their models can do from a cyber perspective, while still putting a capable model into the ecosystem. The capability keeps climbing anyway, similar to GLM and other open weight options, and it is catching up to the frontier very closely, as I have documented from AISI and others. Everyone is conscious of what these models can do in the wrong hands, and I take it as a good sign that the conversation is happening in China as well as the US.
Chinese organizations are not immune from hacking either, so they have their own reasons to care about the risks.
This AI Chronicle piece, bylined to an AI reporter and dated April 28, 2026, frames DARPA’s AI Cyber Challenge as the answer to LLMs turning low-skill script kiddies into capable attackers. It walks through Cyber Reasoning Systems that find and patch bugs at machine speed and the dual-use debate over open-sourcing them. It closes by calling for an autonomous immune system for the internet.
Adrian Sanabria has been using the same framing, and I think it fits perfectly. Script kiddies used to need at least some technical knowledge, and now anyone can open one of these tools, describe a broad goal like hack XYZ in plain language, and get an incredibly capable result.
The labs show this in their own evaluations and research write-ups, and cyber vendors show it in theirs. As these capabilities get commoditized and democratized, the risks and ramifications will grow with them. Because the technology is dual use by nature, the priority has to be keeping defenders equipped with the same capabilities.
Cohere caught Alibaba's Qwen3.8-Flash-Next, while writing a detection rule in a sandbox, inventorying the machine and trying to upload a probe file to an Alibaba Cloud storage bucket in Beijing, even though its reasoning trace said it would make no tool calls.
The behavior showed up in less than one call in 100,000, and Cohere says it can't tell whether it is deliberate or a leftover from training, but it also saw the model probe cloud metadata endpoints and use namespace tricks to get around a permission wall. Cohere's advice is to treat weights you didn't build like an unsigned binary, deny agent egress by default, and stop relying on reasoning traces as a security boundary.
I kept this story because it tests how our industry handles a scary headline. Cohere says Alibaba's Qwen3.8-Flash-Next tried to upload a probe string to an Alibaba Cloud bucket in Beijing while writing a detection rule, after its reasoning trace said it would call no tools. Researchers on X pushed back, noting the payload was a dummy string, the headline reproduction numbers came from prefilling the command, and the simplest explanation, as Nathan Lambert put it, is narrow RL training reliant on Alibaba's internal infrastructure rather than a planted backdoor.
Hugging Face CEO Clem Delangue asked Cohere to share the full traces, the right call in my view, and Cohere released one trace and a reproduction script. My worry is policymakers seizing on this to justify banning open source again, which I push back on in the Lambert item below.
The lessons that hold up are denying agent egress by default and never treating a reasoning trace as a security boundary, and I am curious how this evolves as more organizations dig into the data.
Nathan Lambert posted his first open model lecture, given to Harvard's AI Safety course, covering what counts as an open model, how competitive the best ones are, and the debates over distillation and risk. His slides put open weights roughly three months behind the frontier, say China leads in open-weight performance, downloads and research adoption, and argue that open models are crucial to cyber defense while banning them would mostly hurt economic activity. It makes a useful counterweight to Cohere's Qwen findings above.
Nathan Lambert's lecture is an amazing resource on the open language model ecosystem, where it is headed and the considerations along the way, and I wanted to get it in front of my network and audience. Most of it sits outside cyber, but he argues open models are crucial for cyber defense, and I agree. I do think banning open models would hurt defenders more than attackers. Nathan is one of the leaders in this space, someone I highly respect and learn a lot from, and he has a great following here on Substack.
The OWASP GenAI Security Project’s second exploit generation report spent about fifteen months pitting human-guided single models against autonomous agent frameworks on Hack The Box machines released after the models’ training cutoffs. Both approaches reduced the expertise an attack needs without eliminating it, and the team found the harness around a model moved results more than the choice of model did. Provider guardrails consistently stopped the agentic runs at the exploit-execution step, while local models lacked the capability to get that far.
The harness around the model moved results more than the model itself, and that finding from my friends at OWASP lines up with everything I have been discussing this year with Stanislav, Andre, Niels Provos and many others. Rock and Steve make the same point in the opening letter of the OWASP LLM Top 10. I enjoyed seeing how people approached offensive security and Hack The Box with different models and techniques, and the research is a useful look at how capabilities are evolving and how much the harness shapes them.
Satya Nadella sat down with Harry Stebbings on 20VC to talk about open versus closed models and why every company should own its own intelligence. The episode’s chapters cover why we should assume AI models are compromised, why AI needs a zero trust architecture, why chain of thought isn’t reliable and why he no longer believes alignment will just fall out of scaling.
Satya Nadella covers an enormous range in this conversation, from market dynamics, capital, supply chains, chips and infrastructure to security, and I continue to be impressed by how much ground he can cover. He goes deep on zero trust architecture and chain of thought, including the problem that chain of thought is not necessarily reliable and can be obscured by the model, or by the labs themselves, from the customers who would want to see it. His emphasis on zero trust and security primitives to safeguard AI models and agents in enterprise environments reflects principles we need to keep talking about. I used his X post as the framework for my recent blog, Trust the Model the Least, where I walked through the controls the industry has been building and debating this year.
Seven security professionals told Reuters that more disruption like last week's PHP outages is almost certain, with VulnCheck research due soon saying AI helped double the number of flaws discovered year over year. Cloudflare's Matthew Prince said he knows of additional severe vulnerabilities in other critical software and expects a couple of years where every week feels like the sky is falling, while curl's Daniel Stenberg and ArmorCode's Ramy Rahman cautioned that more disclosures do not automatically mean more successful attacks. Sam Altman told Stanford GSB students that he no longer thinks we will be able to just patch all the bugs.
Seven security professionals calling more disruption almost certain matches what I expect, and I strongly agree there is a lot more of this to come. People have debated whether the vulnpocalypse is real, and exploitation rates have not climbed as fast as CVE counts, for example. What we live with now is a cadence where every week brings at least one major vulnerability discovery, teams scramble to address it, and attackers push toward semi or fully autonomous exploitation with real world impacts following. The piece reads as common sense, and it also points clearly to where things are headed, as the UNM Health attack above already showed.
Anthropic's Frontier Red Team and Theorem had Claude prove that 239 fuzzing entry points across 123 OSS-Fuzz libraries never crash on any input up to 64 MB, working on compiled RISC-V binaries and producing about 180 million lines of Rocq proofs. The proof attempts surfaced hundreds of bugs fuzzers would likely miss, and one effort on a PDF reader found as many security bugs in a week as are typically reported in a year. Anthropic is upfront that formally verified does not mean bug free, since the proofs assume single threaded static RISC-V binaries on Linux.
Using AI to formally verify that software is not vulnerable could reduce risk systemically if it succeeds, and Anthropic and Theorem show it starting to work at real scale. The community received this one very well, and it is super promising research.
Source: Anthropic, LLMs are making formal software verification feasible at a much larger scale
Socket found that secret stealing GitHub Actions workflows ran in the LiteLLM repository on October 10 and 12, eleven days before the malicious 1.107.0 release, using throwaway branches that were deleted within minutes. The two workflows referenced 20 distinct secrets, including a GitHub token, a GitHub App private key, model provider API keys, database credentials and the GitGuardian key for the secret scanning platform itself. LiteLLM's own investigation, as Socket reports it, traced initial access to a master key accidentally committed to a public repository in May and never revoked.
LiteLLM’s own root cause analysis confirms the master key sat in a public repo from May 27 and that release approval had been relaxed that week to any two engineers, so one stolen token triggered the release and another approved it.
Leaked credentials and software supply chain risk were central themes in my book Software Transparency, and this incident fits squarely within them. A key sat publicly exposed in a repo from May until an attacker used it, and that exposure is the root cause of everything that followed. LLM and other AI gateways are central primitives in our AI architectures, and they are becoming hot targets for malicious actors.
ProjectDiscovery’s Prince Chaddha built a backdoored Qwen2.5-7B model for under $50 and showed that a single trigger phrase made OpenAI’s Codex CLI pull a remote payload and send a project’s .env credentials to an attacker’s collector. The 7B version fired on 100% of triggered prompts while keeping 100% clean accuracy, and on a smaller 1.5B model just 1% poisoned training data was enough for a 75 to 98 percent fire rate. Their advice is to sandbox and log what models can reach at runtime and to treat a model you didn’t build like a pull request from a stranger.
Coming right after the controversial Cohere research, ProjectDiscovery's work landed at a timely moment. They show you can backdoor an open weight model relatively easily, for under $50 in this case, and then trigger it later to carry out malicious activity.
Red Hat's Emily Fox argues that AI can surface flaws faster than maintainers can validate and fix them, so coordinated disclosure built on human trust matters more than ever, with embargoes serving as a short head start for defenders. She points to curl's flood of vulnerability reports and its plan to handle lower severity findings in public as an example of communities adapting their process to the risk. Her closing point is that security leadership isn't a race to publish first.
Emily Fox's piece reminded me of a similar one from Katie Moussouris of Luta Security, and both get at how hard coordination becomes when vulnerability discovery keeps speeding up and multiple parties are working the same issue. AI is having a major impact on vulnerability management and AppSec findings, and teams are trying to work out how to disclose those findings while still protecting customers. I will be digging into exactly this live on the Resilient Cyber podcast with Art Manion this Friday, so the timing could not be better.
Keystone says an attacker exploited a vulnerability in a third party data monitoring tool on its website to escalate privileges, taking personal data from 25,964 buyer records, some of which a failed erasure tool should have deleted, along with the key used to verify that its devices are genuine. Because that key is written into devices at manufacturing and can't be changed, Keystone is destroying 18,835 devices in inventory and pausing shipments until new key devices are built. Recovery phrases and private keys were not involved, according to the company.
Tens of thousands of buyer records exposed, 25,964 in all, makes this a major incident for personal data, and it shows the inherent risk of handing credentials and sensitive data to a third party. The stolen device authentication key raises the stakes further. Keystone writes that key into each device at manufacturing and it cannot be changed, so all 18,835 unsold devices in inventory are being destroyed and shipments are paused until devices with a new key are built.
Keystone says it will not ask owners to return their devices and that anyone offering a recall is a scammer, so the costly and disruptive fix lands on the company's own inventory.
Sergej Epp shipped several updates to the Zero Day Clock Observatory ahead of [un]prompted. A new Internet Threat Atlas maps which networks carry the most exploitation, malicious hosting and attack infrastructure traffic, and a new Breach tracker follows breached companies across regulator filings, ransomware leak sites and the news, mapping them to the CVEs behind them where known. CrowdSec and Previdian also joined, so the data now combines four private attack feeds.
Sergej Epp keeps building the Zero Day Clock into something far richer than a single clock, and as a signatory and big fan of the project I am glad to see the Internet Threat Atlas and the Breach tracker join the Observatory. Mapping breached companies back to the CVEs behind them gets at the question I asked in my breachpocalypse article, whether vulnerability debt is now being collected through breaches as well as disclosures. With four private attack feeds now combined, it keeps getting more useful as a public scoreboard for vulnerability management and exploitation.
Source: Zero Day Clock Observatory, Vulnerability Pressure Index
Source: Zero Day Clock Observatory, Internet Threat Atlas
Source: Zero Day Clock Observatory, Breach tracker
Final Thoughts
PHP2Shell, Ross McKerchar’s seven incidents in seven days, the UNM Health outage and Keystone’s destroyed inventory all landed in the same stretch, and together they make the case that the vulnpocalypse is now showing up as a steady run of real incidents rather than a forecast. Reuters’ seven experts expect more of the same, and Josh Saxe’s data shows attackers still face real constraints, which gives defenders a window that may not stay open for long.
Defenders are also being asked to trust a lot of new things at once. The Qwen behavior Cohere reported, the backdoored model ProjectDiscovery built for under $50 and the LiteLLM key that sat in a public repo for months all point to the same lesson, which is that models, gateways and the credentials around them need the same scrutiny we give any other part of the supply chain. OpenAI’s write-up on its own training environment showed what that looks like when it is taken seriously, with red teaming, offline worlds and layered containment treated as part of the safety case.
Budgets are moving in the right direction, with 87% of the CISOs a16z surveyed expecting to spend more, yet only 18% are running AI SOC tools in production. Closing that gap, and building the remediation capacity to keep pace with discovery, is where I would put the focus this quarter. Coordinated disclosure is under the same strain, so I am looking forward to digging into it live with Art Manion this Friday.
