Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: Five CVSS 10.0 or 9.8 vulnerabilities moved into active exploitation within 72 hours in FireCompass’s weekly report, while 644,000+ React2Shell-exposed domains and chained SonicWall flaws showed how quickly patch windows collapse into real compromise. The operational lesson is that quarterly remediation rhythms no longer match exploitation tempo, so continuous exposure validation and privilege-path testing are becoming essential.
NHIMG editorial — based on content published by FireCompass: Weekly Report: New Hacking Techniques and Critical CVEs 10 Dec – 17 Dec 2025
By the numbers:
- Five CVSS 10.0 or 9.8 vulnerabilities entered active exploitation within 72 hours of disclosure.
Questions worth separating out
Q: What breaks when organisations cannot patch exploited systems fast enough?
A: When patching lags behind active exploitation, the problem shifts from vulnerability management to containment failure.
Q: Why do partial patches still leave organisations exposed to compromise?
A: A partial patch often removes the original exploit path but leaves adjacent authorization or privilege boundaries intact.
Q: How should security teams handle stolen tokens after an incident?
A: Treat stolen tokens as active credentials, not artefacts.
Practitioner guidance
- Shorten the exposure-to-remediation loop Create a continuous validation process for critical internet-facing assets so disclosure, exploit detection, and remediation are measured in hours, not weekly patch windows.
- Test post-patch privilege boundaries After any hotfix or emergency patch, run targeted checks for authorization bypass, privileged endpoint access, and role-based control failures.
- Treat tokens and secrets as live attack surface Audit OAuth tokens, API keys, GitHub tokens, and automation credentials for memory exposure, workflow reuse, and long-lived validity.
What's in the full report
FireCompass's full report covers the operational detail this post intentionally leaves for the source:
- Step-by-step exploitation chains for React2Shell, SonicWall SMA 1000, GitLab, and other critical CVEs.
- Detailed scan and prioritisation logic for active exploitation, including CISA KEV and threat-intelligence correlation.
- Red team validation methods for privilege escalation, token harvesting, and workflow abuse.
- A remediation roadmap with environment-specific findings that implementation teams can use directly.
👉 Read FireCompass's weekly report on active exploitation and critical CVEs →
Critical exploitation velocity is outpacing patch management, what now?
Explore further
06/09/2026 5:19 pm
Exploitation speed is now a governance problem, not just a vulnerability problem. When disclosure-to-exploit windows collapse to hours or days, the old assumption that teams can patch first and investigate later no longer holds. Continuous validation, prioritisation, and containment become the real control plane. For practitioners, that means patch SLAs must be paired with live exposure measurement.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do patch, IAM, and NHI teams coordinate when exploitation is already underway?
A: They should operate as one response chain. Vulnerability teams validate exposure, IAM and PAM teams revoke standing paths and privileged access, and NHI teams rotate secrets, tokens, and automation credentials that may have been harvested. Coordination matters because attackers often move from the initial flaw to identity abuse in the same incident.
👉 Read our full editorial: Critical CVEs are outrunning quarterly patch cycles
