Five days, ten exploited bugs, almost none of them touched a core app. A week attackers spent walking in through everything else.

THE WEEK IN ONE SENTENCE

Attackers spent the week walking in through everything except your front door. The headline-grabbing bugs were not zero-days in the flagship application your security program is built to protect. They were in the VPN concentrator at the perimeter, the file-transfer server nobody remembers owning, the e-commerce plugin three vendors deep, the browser on every desk, the switch in every rack, and the open-source package your developers pulled without reading. And once an attacker was in, the rest of the week was a catalogue of how to climb: privilege escalation to SYSTEM, a container escape onto the host, a worm replicating through a build pipeline.

This is not a coincidence of one busy week. It is what a modern attack surface actually looks like. The core application is usually the most-tested, most-monitored, most-hardened thing an organization owns. The edge and the supply chain are not. That asymmetry is the whole game, and last week was a clean demonstration of it.

THE WEEK, DAY BY DAY

Monday opened on third-party software. A critical remote code execution flaw in a Magento caching plugin was under active exploitation, and SolarWinds Serv-U, a managed file-transfer server, returned to CISA's exploited list with a denial-of-service bug. Neither was a core platform; both were the software bolted onto one.

Tuesday escalated on every axis. Check Point's VPN authentication bypass, tied to a Qilin ransomware affiliate, let attackers in without a password. The Miasma worm spread through npm and into Microsoft's Azure GitHub organization, executing the moment a developer opened an affected repository in their editor. And a working public exploit appeared for a Linux kernel bug that escapes containers and reaches root on the host.

Wednesday was Patch Tuesday, and a record one, with more than two hundred fixes. The standouts were an Exchange webmail flaw exploited since May that finally got a real patch, a wormable Windows kernel bug that researchers immediately began reverse-engineering, and three more zero-days from the ongoing Nightmare Eclipse wave, which we covered in depth separately.

Thursday closed quieter but no less relevant: a Chromium browser zero-day under active exploitation, affecting every Chromium-based browser including Edge and Opera, and an Arista switch flaw that processes tunnel traffic it was never configured to accept. The desk and the rack, both exploited, both on the same federal deadline.

THE WAYS IN

Five of the week's items were, in one form or another, a way through the perimeter, and not one of them was the core app.

The Check Point bug is the sharpest example. A logic flaw in certificate handling on deployments still running the deprecated IKEv1 protocol let an unauthenticated attacker open a VPN session with no valid credentials, and it was already linked to a Qilin ransomware affiliate. A VPN is supposed to be the controlled way in. When the controlled way in stops checking credentials, it becomes the fastest way in. Serv-U, a managed file-transfer product, is the kind of internet-facing box that quietly runs for years until a denial-of-service flaw lands it back on CISA's exploited list, and file-transfer software has a long history as a ransomware entry point. Magento's flaw lived in a caching plugin, not Magento itself, which is the point: e-commerce risk routinely hides in the extensions, not the platform. The Chromium zero-day affected not just Chrome but Edge, Opera, and every Chromium-based app, the single most widely deployed piece of software in most companies. And Arista's switch flaw is the quiet one, a device that accepts tunnel traffic it was never configured to accept, the sort of thing nobody is watching because switches are not where anyone looks.

THE WAYS THROUGH, AND UP

If the first half of the week was about getting in, the second half was about what happens next, and it was arguably the more important story. Initial access is a commodity. What turns a foothold into a breach is the climb, and the week was full of it.

What turns a foothold into a breach is the climb, and the week was full of it.

Notice how little of this is about breaking down a wall. Miasma did not exploit a vulnerability in the classic sense; it abused trust in the dependency graph. The Nightmare Eclipse bugs do not get an attacker onto a machine, they take an attacker who is already on the machine and make them SYSTEM. The Linux exploit assumes a foothold and turns it into ownership of the host. This is the part of an intrusion that decides whether a contained incident becomes a company-wide event, and it is consistently the least-tested part of most security programs.

THE META-STORY: THE WINDOW IS CLOSING FASTER THAN YOU PATCH

Two threads ran underneath the week. The first is scale. Microsoft's June Patch Tuesday was the largest on record, fixing more than two hundred flaws in a single day. No security team triages two hundred fixes evenly; the honest task is to find the few that an attacker will reach for first, which is exactly the job the daily debrief exists to do. The second thread is speed. Across the Nightmare Eclipse wave, researchers observed real attackers weaponizing each public proof-of-concept within days of its release. We wrote about that wave in depth this week in our piece on the disclosure-to-exploitation window, and the short version is uncomfortable: a monthly patch cycle is structurally too slow to win a race that is now measured in days.

Put scale and speed together and the implication is clear. You cannot patch your way to safety on a calendar when the supply of weaponizable bugs is rising and the time to weaponize is falling. Patching remains necessary. It is simply no longer sufficient on its own, and a strategy that rests entirely on it is a strategy that is always a few days behind the exploit.

It is worth being honest about the direction of travel, too. The volume of disclosed vulnerabilities has been climbing for years, and the tooling used to find and weaponize them, including AI-assisted research, is getting faster on both the offensive and defensive sides. A record Patch Tuesday is not likely to be an outlier that we look back on as unusual. It is more likely a preview of the normal cadence to come. That makes the controls that do not depend on having already patched, detection, segmentation, least privilege, and a fast path from alert to containment, the part of the program most worth investing in, because they are the part that keeps working when the next wave arrives before its fixes do.

IF WE WERE RUNNING THIS WEEK AGAINST YOU

Here is the uncomfortable part. You do not need all ten of these bugs to end up somewhere very bad. You need a handful of them, in the right order, and the week handed an attacker a clean chain.

We would not start at your hardened core. We would start at the Check Point VPN, opening a session with no password, because the week proved we might not need one. That puts us on the inside as a low-privileged user, which on its own is not catastrophic. Then we reach for the climb. A Nightmare Eclipse privilege-escalation bug, the kind with a public proof-of-concept already circulating, takes that ordinary user to SYSTEM on the box. From SYSTEM, we go after the thing that is supposed to catch us, degrading or blinding the endpoint sensor so the noisy part of the operation happens in the dark. If your environment runs containers, the Linux escape gets us off our single compromised workload and onto the host underneath it, which on a shared node is a very large step. None of those moves is exotic. Every one of them was publicly available last week.

That is the entire argument for testing the chain rather than the components. Each of those bugs, viewed alone, generates a ticket with a severity score and a patch deadline. Viewed together, they are an intrusion. Attackers think in chains. Vulnerability programs that grade bugs one at a time, in isolation, are reading a story one disconnected sentence at a time and missing the plot.

WHY THE EDGE KEEPS WINNING

This shape is not random, and it is not going away, because the reasons behind it are structural. Edge appliances like VPNs and file-transfer servers often run older code and deprecated protocols, the IKEv1 in the Check Point case being a perfect example, and they sit directly on the internet where every flaw is reachable. Third-party plugins and extensions live outside your own development lifecycle, so the security review you apply to your code never touches them, which is why a Magento store gets compromised through a caching add-on rather than Magento. The software supply chain runs entirely on trust: a dependency is assumed safe because it was yesterday, and a worm like Miasma turns that assumption into a delivery mechanism. Browsers are simultaneously the most-used and most-targeted software in any company, an enormous attack surface that updates on its own schedule and that users carry everywhere. And network gear is the blind spot by tradition, the box nobody logs into, monitored far less than the endpoints sitting next to it.

Add those together and the edge is not winning by accident. It is winning because it combines maximum exposure with minimum scrutiny. That is the opposite of your core application, and attackers have noticed the difference even where defenders have not.

WHAT TO DO WITH THIS WEEK