ThreatsDay Roundup: AI Accelerates Zero-Days, Critical Systems Face Long Patch Delays, and Fraud Networks Busted
This week's ThreatsDay bulletin highlights the accelerating pace of zero-day discovery due to AI, the persistent problem of slow patching for critical systems, and the disruption of a $4.5 million global fraud network.
The cybersecurity landscape is rapidly evolving, with artificial intelligence playing a dual role in both defense and offense. The UK's National Cyber Security Centre (NCSC) has issued a stark warning: the widespread availability of AI-powered cyber tools has "almost certainly" led to a significant increase in the discovery of zero-day vulnerabilities. While defensive AI tools can accelerate patching, the NCSC cautions that without proper configuration, many systems remain vulnerable to attackers leveraging AI to find and exploit weaknesses. This acceleration necessitates an evolution in internal patching and testing processes to keep pace with the heightened discovery rate.
Compounding this challenge is the persistent issue of slow patching for critical systems. An extensive analysis of nearly 400,000 disclosed CVEs between 1999 and September 2026 reveals that the median time to patch a vulnerability exceeds a year for network appliances. While Windows workstations see median patch times of about two weeks, this stretches to over a month for Windows Servers, more than 10 weeks for Linux Servers and macOS applications, and significantly longer for network appliances. This widening gap provides a substantial window for threat actors, particularly on critical systems that remain exposed for extended periods. Microsoft notes that attackers disproportionately target flaws enabling system takeover, such as remote code execution, privilege escalation, and authentication bypass.
In a significant law enforcement success, authorities have dismantled a global investment fraud scheme, arresting seven individuals and causing estimated losses of at least $4.5 million. The "crime-as-a-service" operation, allegedly run by a company with ties to Cyprus and Israel, provided cybercrime groups with fraudulent trading websites and call centers. These centers, operating from Albania, Kosovo, and North Macedonia, were tasked with tricking victims worldwide into transferring their savings. The operation involved over 100 seized servers and extensive evidence collection during coordinated actions.
These fraudulent platforms lured victims with promises of substantial, quick returns from cryptocurrency and foreign currency trading. Operators would display illusory gains to encourage larger investments, then employ delaying tactics to prevent withdrawals. Behind the facade of legitimate platforms, "brokers" used fictitious profits and psychological pressure to extract more money. Personal data collected was subsequently sold to other criminal groups, perpetuating the cycle of deception and financial exploitation.
In a move to incentivize robust security research, Google has enhanced its Cloud Vulnerability Reward Program (VRP). The company is now offering a top-tier reward of $250,000 for high-impact architectural security flaws, specifically "Root-in-Cloud" bugs. These include critical issues like tenant-isolation bypasses and complex cross-service logic flaws that grant attackers full administrative control over arbitrary Google Cloud organizations. To qualify for this premier reward, researchers must demonstrate complete administrative control, equivalent to the 'roles/owner' permission, over arbitrary Google Cloud organizations or projects without prior access.
Furthermore, valid vulnerability reports demonstrating remote code execution (RCE) in Google's underlying production infrastructure (Borg) or achieving "root-in-prod" will automatically be evaluated for "root-in-cloud" eligibility by the Google Cloud VRP panel. This initiative underscores Google's commitment to identifying and rectifying the most severe security vulnerabilities within its cloud environment.
Microsoft is also taking steps to protect users from deceptive online practices. Its Edge browser will now automatically disable notifications from websites that push scam or scareware notifications, such as fake virus warnings or security alerts. This feature, rolled out with Edge 156, leverages Microsoft Defender SmartScreen and the Scareware blocker. When a scam is detected through a notification, Edge will automatically disable notifications from the offending site, enhancing user protection against malicious pop-ups and misleading alerts.