IDC’s Harris famous that Patchstack’s telemetry illustrated the brand new actuality, with attacker reconnaissance occurring inside 5 hours of the patch, and full exploitation inside a few day. “The window between disclosure and exploitation has collapsed to the purpose that imply time to take advantage of for vital vulnerabilities is now unfavorable in some instances, that means exploit code seems earlier than or instantly after a patch ships,” he mentioned. “This WordPress bug tracks that sample intently: Patchstack recorded the primary probing site visitors underneath 5 hours after WordPress 7.1.2 was launched, and site visitors quantity elevated roughly tenfold inside a day as attackers moved from scanning to precise payload supply.”
Aman Mahapatra, chief technique officer for New York Metropolis-based expertise consulting agency Tribeca Softech, agreed.
“The quantity that ought to anchor this story just isn’t the 9.2 CVSS rating, however it’s the hole between patch and exploit. With this vulnerability, that hole was successfully zero,” he mentioned. “WordPress shipped 7.1.2 on September 22, and Patchstack blocked the primary exploitation try at 11:49 UTC the identical day, utilizing payloads that matched the precise encoding the patch was written to repair. Attackers didn’t uncover this bug. They learn the repair. Publishing a patch is now functionally publishing an exploit information, and any enterprise nonetheless working a remediation cycle measured in weeks is working on a timeline that stopped current a while in the past.”
