News · Academy · November 12, 2026

Academy: patch triage when AI finds bugs faster

Exploits often arrive before the patch. How to decide what to fix first: exposure, the CISA exploited list, and the rules in CISA directive BOD 26-04.

DRIVE 369 DAO · 3 min read

Academy, organisations, lesson 3. You cannot patch everything at once. The skill is choosing what to fix first, and doing the emergency ones in days.

Why the old rhythm is broken

Mandiant's M-Trends 2026 estimates the mean time to exploit at minus 7 days for 2025: exploitation often starts before a patch exists (Google Cloud). VulnCheck found that about 29% of newly exploited vulnerabilities in 2025 were exploited on or before the day the CVE was published (VulnCheck). In the PHP2Shell case, Amazon's honeypots logged the first attempt four days before the fix. Verizon's 2026 report puts exploited vulnerabilities as the number one way in, at 31% of breaches (Verizon).

A model from the US government

On June 10, 2026 CISA issued BOD 26-04, "Prioritizing Security Updates Based on Risk", replacing the older fixed-deadline directives. It sets deadlines from four factors:

1. Exposure: is the asset reachable from the internet?
2. KEV status: is the flaw on the CISA exploited list?
3. Automation: can the exploit be run by a script, at scale?
4. Impact: does it give an attacker control?

Reporting says the strictest case, exposed, listed and automatable, has a deadline of about three days, with forensic triage alongside. The directive binds US federal civilian agencies. Anyone else can borrow the method.

A triage you can start today

1. Know what you have. An up-to-date list of systems and software, tagged by owner and by whether it is reachable from the internet. Without it nothing else works.
2. Subscribe to the exploited list. The CISA catalogue has CSV and JSON feeds. Anything on it that you run goes to the top.
3. Fix exposed first. A flaw on a public web server outranks one on a laptop behind a firewall.
4. Have an emergency lane. A named person who may patch outside the normal change window, a rollback plan, and a rule that an exposed, listed flaw is done in days.
5. If you cannot patch, reduce exposure. Put the system behind a login or a firewall, turn the feature off, or take it offline, as CISA advised for PHP.
6. Use virtual patching as a bridge. A firewall rule may buy a day. It is not the fix.
7. After patching, look back. A fix does not remove something planted earlier. See hunting after patching.

How slow are defenders?

Verizon's 2026 report is quoted as finding a median of 43 days to remediate vulnerabilities on the exploited list, up from 32 (secondary reporting; check the full report). Whatever the exact figure, the gap between attackers' days and defenders' weeks is the problem this lesson is about.

How Ghostdrive approaches it

Patch speed matters less to your files if a compromised server cannot read them. Ghostdrive keeps keys on your device and only sealed blocks on servers. We also track exploited vulnerabilities in our own dependencies, and we say so when a dependency is a risk. That limits the damage, and it does not remove the need to patch.

Academy: start here · PHP2Shell three weeks on · Know what you expose