The Shrinking Window Between Patch and Attack

The gap between the day a vendor ships a fix and the day attackers start using the flaw has collapsed, according to research cited in SecurityWeek's weekly roundup. For SAP vulnerabilities patched across 2025 and 2026, the median interval between a security note's publication and the first verified exploitation or public proof-of-concept came to one to three days — measured against 489 days for flaws patched in 2021. The same roundup carries a hardware wallet warning, a seven-figure bill run up on hijacked AI access, and a Harvard breach that has now surfaced in a public lookup service.

SAP's patch-to-exploit gap collapses

Onapsis and Recorded Future compiled the SAP findings, drawing on more than 1.2 million threat intelligence events. The headline figure — one to three days for flaws patched in 2025 and 2026, versus 489 days for those patched in 2021 — describes a median, meaning roughly half of the tracked cases moved even faster.

The researchers also counted SAP CVEs with confirmed in-the-wild exploitation or public proof-of-concept code. That number doubled from 9 to 18 between the end of 2023 and mid-2026. On the criminal side, ransomware and extortion groups appearing in SAP-related content grew from 8 in 2023 to 26 in 2025.

There is a market underneath this. The study tracked underground listings for SAP access with prices ranging from $500 to $30,000 — a spread wide enough to suggest sellers differentiate by privilege level, environment, or both.

LLMJacking becomes a resale business

Mandiant's investigation into what the industry calls LLMJacking described attackers taking over a company's access to AI models and running up fraudulent bills. In the cases Mandiant examined, charges exceeded $100,000 in a day, and at some organizations reached as much as $1 million in total.

The way in was not exotic. Stolen or exposed cloud credentials and API keys accounted for most initial access. In one intrusion, the attackers exploited a LiteLLM vulnerability tracked as CVE-2026-40217 to upgrade ordinary keys into full administrative credentials — turning limited access into unchecked access.

Google Threat Intelligence Group documented a second layer: hijacked access being resold through operations it calls LLM Mixers. One of them, the Jet Night token routing service, is believed by Google to use stolen keys to offer unlimited plans with claimed frontier model access for around $60 a month.

An implant claim Trezor has not verified

Trezor is advising customers who bought hardware wallets from CryptoBilis since March 2026 to move their funds to a newly created wallet with a new seed. The warning follows a buyer's report of finding an implant inside a Trezor Safe 5 purchased from the reseller, a former Southeast Asian distributor that also sold Ledger devices previously found to have been tampered with.

As described in the report, an added circuit board carrying a cellular module and antenna captures the recovery phrase as it appears on screen and transmits it over a mobile network whenever the device is connected. Trezor has not verified the finding. No stolen funds have been reported.

The recommendation itself is the operative part for anyone affected: generate a fresh wallet and a new seed rather than reuse the one the device may have exposed.

Chainalysis widens its breach disclosure

Chainalysis expanded what it has said publicly about its breach. The company said it discovered on November 2 that names, usernames, password hashes and live tokens for all its users had been exposed — after initially reporting that only non-sensitive data was accessed.

Since then it has taken several products offline, including its KYT transaction monitoring service, after detecting abnormal activity. Chainalysis is contacting customers whose KYT accounts show signs of unauthorized access. The widened disclosure moves the incident from a limited exposure to one touching credentials across the user base.

Fake event pages and device code phishing

Push Security documented a phishing campaign built on counterfeit registration pages for OpenAI, SpaceX and Anthropic events. The lures offer rewards such as three months of ChatGPT Pro or Grok Heavy, aimed at getting marketing employees to sign in with work accounts.

The Microsoft option launches a device code phishing flow run through the Kali365 phishing-as-a-service platform. Push links the operator to earlier fake Zoom event pages with medium-high confidence. The campaign relies on Google and Zapier short links, Cloudflare challenges, and domains swapped out every few weeks to stay ahead of blocklists.

Google moves agent sandboxing to a neutral home

Google is donating Agent Substrate and gVisor to the Cloud Native Computing Foundation as Sandbox projects. Agent Substrate is an open source orchestration layer on top of Kubernetes for running large numbers of isolated AI agent sessions; when an agent goes idle, it saves state to storage and can restore it in under 500 milliseconds.

gVisor handles system calls in user space, keeping untrusted, AI-generated code from interacting directly with the host kernel. Google's stated rationale is that CNCF stewardship gives the community a shared, vendor-neutral base for agent infrastructure that runs on any Kubernetes cluster meeting conformance standards.

Anthropic tightens Claude Enterprise controls

Anthropic rolled out additional security and administration capabilities for Claude Enterprise. A security center, in beta, checks an organization's configuration for chat, Cowork and Claude Code against settings Anthropic recommends.

Inference hooks, now generally available, route prompts and tool calls into an organization's existing data loss prevention and security tools for inspection. A centralized console, also in beta, lets companies manage single sign-on, SCIM and other settings across all their Claude organizations from one place.

Greeter: thousands of 'hello' messages

Era researchers detailed Greeter, a Chinese-language exploitation framework that sent thousands of chat messages reading only "hello" at Flowise honeypots while abusing an old code injection flaw, CVE-2024-58351, to execute commands. Behind those messages, the framework mapped the host, queried cloud metadata services, hunted for SSH keys and other credentials, attempted persistence, and tested whether it could run payloads from memory.

Era counted 4,372 Flowise instances exposed online. Among those whose version it could identify, 703 lacked authentication and 46 appeared to share the vulnerable setup used in its honeypots.

Harvard records land in HIBP

Have I Been Pwned has loaded roughly 851,000 unique email addresses from Harvard University's November 2025 breach, an incident later tied to a ShinyHunters extortion bid. The records come from alumni and fundraising systems and contain detailed profiles of donors, alumni and parents, plus some faculty, staff and students — names, contact details, birth dates and places, employers, ethnicities, marital statuses and donation histories.

A Synology fix left unapplied

Synology warned that attackers are abusing a vulnerability fixed in December 2024 against devices still running outdated DSM releases, with the aim of encrypting data and extorting victims. The company did not identify the specific flaw beyond pointing to its Synology-SA-24:20 advisory. Its guidance is to update DSM immediately and enable automatic updates.

Nomad Bridge suspect in US court

Alexander Gurevich, a 49-year-old Israeli national now known as Alexander Block, appeared in a US court for the first time on October 30, a day after Israel extradited him. He faces charges that he exploited the Nomad Bridge smart contract in August 2022 to take virtual currency worth roughly $2.89 million.

According to the indictment, he swapped the stolen WBTC and WETH for other cryptocurrencies and spread them across multiple addresses to obscure their origin. The money laundering charge alone carries a maximum of 20 years in prison.

What this means for defenders

The SAP numbers are the ones worth sitting with. A median of one to three days between a security note and working exploitation suggests that patch cycles measured in weeks are no longer a realistic target for business-critical ERP systems — and that the organizations most exposed may be those treating a vendor note as an internal ticket rather than an incident clock.

The LLMJacking cases point at a different gap. If a stolen API key can be upgraded to admin through a single dependency flaw, and can then generate $100,000 in a day of fraudulent inference, then credential hygiene and spend anomaly detection on AI services become the same control rather than two separate programs.

The Trezor advisory is a reminder that supply chain risk for hardware wallets extends to who sold the box. And the Chainalysis disclosure shows how an initial account of an incident can narrow the picture — a full accounting of what was exposed is worth waiting for before drawing conclusions.