Blog argues rapid disclosures leave defenders unable to keep up
Original title: This is not sustainable
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
Jan Schaumann argues that the current pace of severe vulnerability disclosures is unsustainable for understaffed defenders. Using one week of cases, he says assessment of attack surface, vendored trust stores, and package rollout—not writing the patch—is the bottleneck. He criticizes broken embargoes, marketing-driven exploit posts, and AI companies claiming credit for findings, and says AI does not remove those operational tasks.
Unconfirmed: The “over 70% of websites” figure is widely quoted but never attributed, and discovery-credit claims are the author’s account.
- Examples include PwnEscape (CVE-2026-99999), an eMudhra compromise, and php2shell.
- php2shell is tied to CVE-2026-109618 and CVE-2026-109619; the “over 70%” figure is unattributed.
- The Node.js Brotli issue is CVE-2026-111497 and, he writes, was fixed in February.
- He says OpenAI claimed discovery after Mozilla noted critical impact in April.
- Victims
- eMudhra
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-99999 | Linux kernel IPv4 checksum metadata can corrupt headers | 9.3 | <1% | PoC ×10 |
From the original article
10 min read at netmeister.org
fundamentally changed, disclosure processes are effectively broken , and patch management same set of ghostbusters—the heroes and company-elders with the appealing lure of quick and confident answers from the bot, and
By netmeister.org via binjip978 · netmeister.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.