Some cybersecurity commentators have dubbed last month “Black October”.
Critical PHP vulnerabilities, a critical GitLab flaw, compromised developer packages and an AI-developed Linux kernel exploit demonstrated to give root access to a vulnerable server.
Different technologies. Different weaknesses. One recurring problem.
The window between discovering a vulnerability and someone exploiting it is shrinking.
AI is also making vulnerabilities far easier to find, so more are surfacing and faster than ever before.
Our AI-Armed Adversaries white paper argued that annual penetration testing was no longer sufficient on its own.
We’re seeing more frequent vulnerability scanning across the systems we maintain, with remediation work increasingly happening throughout the year rather than being concentrated around annual penetration tests or urgent security alerts.
We’re regularly updating vulnerable third-party components, fixing weaknesses in application code, removing embedded credentials and tightening authentication controls.
Identifying vulnerabilities is only half the job. Someone still has to understand the software, make the changes, test them and deploy them safely. In business-critical systems, a security fix that breaks essential processes and workflows can create an entirely new problem.
Secure development has always been part of how we work. Even well-engineered software needs ongoing attention as new vulnerabilities are discovered.
If you haven’t looked beneath the surface of your critical applications recently, it might be worth asking what’s accumulated there.
Happy to help you take a look.
