Last year, Luxembourg’s entire mobile and fixed telecoms network collapsed. Every carrier. Every customer. National scale. The cause, finally surfacing now, was a single unexplained zero-day in Huawei gear, and the vendor still hasn’t publicly acknowledged the flaw. This is what the cybersecurity industry’s growing patch gap actually looks like when it lands on critical infrastructure.

Verizon’s 2026 DBIR makes the math official: vulnerability exploitation has overtaken credential abuse as the top initial access vector, now responsible for 31% of breaches. Median time-to-patch climbed from 32 days to 43 days year over year. That’s a 34% slowdown while attackers got faster. The race is no longer close.

Cybersecurity patching slowed. Exploits sped up.

The numbers from the Verizon report, enriched by Tenable telemetry, are bleak. CISA’s Known Exploited Vulnerabilities catalog grew nearly 50% in 2025. Organizations successfully remediated only 26% of KEV entries. Development tools, hypervisors, and remote monitoring platforms posted the worst remediation rates in the dataset, with more than half of affected assets left unpatched.

Median time-to-patch increased from 32 days to 43 days. Attackers typically need hours.

AI is about to make this worse. Anthropic’s Claude Mythos and similar autonomous code-auditing systems can identify vulnerabilities at unprecedented speed. The defensive case for these tools is real, but they cut both ways. Once an AI agent can find an exploitable bug in your stack faster than your patch crew can deploy the fix from last quarter’s bulletin, your firewall and SIEM are wallpaper.

The ChromaDB max-severity flaw disclosed this week is the canary. ChromaDB powers vector databases for thousands of AI applications, and the FastAPI variant lets an unauthenticated attacker run arbitrary code on any exposed server. Production AI stacks built in 2025 are sitting on years-old design assumptions about who gets to talk to internal services. Most are not segmented. Most are not behind authenticated reverse proxies. Most will not get patched within 43 days.

Unpatched gear runs the country, until it doesn’t

Luxembourg got the headlines, but the pattern is global. The country’s telecom regulator confirmed a Huawei zero-day caused the national outage, and there’s still no public CVE, no acknowledgement from the vendor, and no public root cause. A second occurrence remains possible because the flaw remains undocumented. That is the operational reality of depending on vendors who treat disclosure as optional.

This is where the brute-force model of cyber security falls apart. You cannot out-patch a system whose vendor refuses to publish a fix. You cannot threat-protection your way out of a zero-day that arrived on infrastructure procurement decisions made five years ago. The choice point was the contract, not the SOC.

The Trapdoor Android ad fraud operation reveals the other side of the gap. 455 malicious apps generating 659 million daily bid requests. The apps run on devices nobody patches because nobody owns the patching cycle. End users don’t update. Carriers don’t push. Manufacturers abandon support after 18 months. The result is a permanent population of exploitable endpoints feeding criminal monetization infrastructure indefinitely.

When patches don’t ship, don’t apply, or don’t matter, what’s left? Defense in depth. Not as a slogan. As the only thing standing between a known-exploited bug and a breach.

Close the gap with controls, not faster patching

Stop treating patch SLAs as your primary control. Start treating them as one of several. Here’s where defenders can actually move the needle this quarter:

• Exposure-rank, don’t patch-rank. An old CVE on an internet-facing host with weak auth is more dangerous than yesterday’s critical on an isolated subnet. Drop the dashboard that sorts by CVSS and build one that sorts by reachability plus blast radius.
• Segment east-west, ruthlessly. Most successful exploitation chains depend on lateral movement after the initial pop. Hypervisors, dev tools, and RMM platforms keep ending up at the top of “unremediated” lists. Treat each as a network zone unto itself.
• Verify patches actually applied. KB5089549’s install failures last quarter were a reminder that your patch report and your patch reality often disagree. Run independent verification against the running system, not the deployment platform’s status field.
• Egress control on AI infrastructure. If a ChromaDB instance does not need to make outbound calls, don’t let it. The same principle applies to model-serving endpoints and vector stores. Threat detection on north-south traffic catches post-exploitation behavior that any signature-based check will miss.
• Behavioral baselines on identity. Even when vulnerability exploitation is the entry vector, credentials remain the pivot. Token usage patterns, sign-in anomalies, and service principal behavior should drive your incident response queue.
• Security hardening at procurement. Luxembourg’s pain started with a vendor selection. Bake disclosure SLAs, patch cadence, and source-code escrow language into contracts. The cheapest gear is rarely the cheapest gear.
• Brute-force protections on what’s still exposed. Anything still living on the internet with a login prompt needs rate limits, lockouts, and geo-fencing. Vulnerability exploitation is the top vector, but credential spray follows it everywhere.

The Verizon data is unambiguous on one point: the traditional vulnerability-centric model is failing. The volume is now genuinely unmanageable, and the speed asymmetry favors attackers permanently. Exposure management, behavioral detection, and a layered model of cyber security have shifted from optional accessories on top of patching to the primary control surface.

Luxembourg’s outage is what happens when the perimeter assumption holds and everything else has decayed. Most environments are one zero-day away from a similar fate. The defenders that survive the next two years will be the ones who already stopped pretending patch velocity was the answer.

Sources

• Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector
• Key findings from the Verizon DBIR 2026
• Huawei zero-day attack behind last year’s crash of Luxembourg’s entire telecoms network
• Max-severity flaw in ChromaDB for AI apps allows server hijacking
• Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests