Every incident response playbook has the same assumption baked into it: find the hole, patch the hole, compromise over. That assumption is doing a lot of quiet work in how organizations think about cybersecurity, and this week gave us three separate stories that should make you nervous about leaning on it. A patch-resistant AI agent flaw, a Secure Boot bypass that’s been signed and valid for thirteen years, and a botnet that reboots devices just to outlive its own removal. Different systems, same lesson: the moment you stop treating “patched” as synonymous with “safe” is the moment your security program actually grows up.

The Bug That Survives Its Own Fix

Start with RufRoot, the name researchers gave to CVE-2026-59726, a maximum-severity flaw in Ruflo, an open-source agent meta-harness that sits in front of tools like Claude Code and Codex. The CVSS score is a clean 10.0, and the vulnerability class is the one every security engineer dreads: unauthenticated remote code execution, no login required, no social engineering needed. An attacker just talks to the exposed service and takes it over.

What makes it worth writing about isn’t the score. It’s the mechanism. Dark Reading’s reporting on the flaw describes it as patch-resistant because the initial compromise can corrupt memory state that outlives the software update. You push the fix, the vulnerable code path closes, and the AI agent keeps behaving badly anyway, because the thing that got corrupted wasn’t the code. It was the state the code was trusted to operate on. That’s a fundamentally different problem than a missing input check, and it’s one that traditional patch-and-verify workflows aren’t built to catch.

If your organization has deployed agentic AI tooling anywhere near production, this is the kind of finding that should trigger a fresh look at your threat detection coverage for those hosts specifically. A patched version number tells you nothing about whether the running instance is clean.

Thirteen Years Is Not a Typo

Now compare that to a much older, much slower failure. Bruce Schneier flagged research from ESET showing that Microsoft’s Secure Boot, the UEFI-level protection meant to stop firmware-level infections, has had a serious bypass available for thirteen of its fourteen years of existence. The researchers identified eleven signed firmware images, so-called shims used to extend Secure Boot support to Linux and utility software, that were known to be defective going back as far as 2013. Microsoft controls the signing process for these shims. It never revoked the broken ones.

The bypass technique itself is described as simple enough for a novice to pull off. That’s the part that should sting. This isn’t an exotic cryptographic attack requiring nation-state resources. It’s a known-bad, publicly available, still-signed component sitting in the trust chain of millions of devices, and the fix was always within reach: revoke the signature. Nobody did it, for over a decade, across a huge swath of the install base.

Secure Boot is supposed to be the last line of defense in depth before you’re trusting firmware blindly. When the last line has a documented hole this old, every layer built on top of it, your OS hardening, your endpoint detection, your firewall rules, is resting on a foundation that was never actually solid.

Why Revocation Gets Skipped

Revoking a signed shim isn’t free. It can break boot processes for legitimate users still running old but functional configurations, which is exactly the kind of support headache vendors avoid. That tradeoff, breakage now versus theoretical exploitation later, is a business decision dressed up as a technical one, and it’s the same tradeoff that keeps countless “known issue, low priority” tickets open in your own backlog right now.

Reboot as a Feature, Not a Failure

The third data point is smaller in scope but tells the same story from another angle. Nozomi Networks Labs identified a new Mirai-derived IoT botnet, dubbed Tengu, that forces an infected Linux device to reboot the moment its main malicious process gets killed. Kill the process, the device restarts, the persistence mechanism gets another shot at relaunching. The malware entered through the oldest trick in the book, Telnet credential brute-force, and it was caught not by a known signature but by a machine-learning system flagging behavior that didn’t match anything on file.

Killing the process used to be step one of remediation. Now it’s the trigger for round two. That’s a small design choice with a big implication: attackers are increasingly building for the assumption that defenders will find and interrupt them, and engineering around exactly that moment.

What Actual Remediation Looks Like

None of this means patching is pointless. It means patching is the floor, not the ceiling. If you manage infrastructure that touches any of these categories, agentic AI tooling, UEFI/firmware trust chains, or internet-facing Linux devices with weak credential hygiene, here’s a more honest remediation sequence:

1. Verify state, not just version. After patching, confirm the running process or device is actually behaving correctly, not just that the binary changed. For AI agent hosts, that means checking memory and session state, not just the deployed build number.
2. Audit your trust chain for zombie signatures. Check whether your Secure Boot configuration still trusts shims or certificates that have known issues, even old ones. Revocation lists exist for a reason; use them.
3. Assume persistence survives a kill signal. Build incident response procedures around full reboot-and-reimage for compromised IoT and embedded Linux devices, not just process termination.
4. Close the brute-force door before it opens. Disable Telnet, enforce strong credentials, and rate-limit or lock out repeated authentication failures on every exposed management interface.
5. Treat AI agent infrastructure as production infrastructure. Apply the same security hardening standards, authentication requirements, and monitoring you’d demand of a customer-facing API, not the looser standards teams often give to “internal tooling.”

The common failure across all three stories isn’t a missing patch. It’s a gap between what a fix is assumed to accomplish and what it actually accomplishes. Closing that gap is threat-protection work as much as any firewall rule or detection signature.

Frequently Asked Questions

Does applying a security patch guarantee a system is no longer compromised?

Not always. As the RufRoot case shows, a patch can close the vulnerable code path while leaving corrupted memory or session state intact, so compromised behavior can continue after the fix is deployed. Verification of runtime state matters as much as version checks.

What is Secure Boot and why does a bypass matter so much?

Secure Boot is a UEFI-level protection that verifies firmware and boot components haven’t been tampered with before an operating system loads. A bypass at this layer undermines every security control built on top of it, since the OS and endpoint tools are trusting a foundation that may already be compromised.

How can organizations defend against botnets like Tengu that survive removal attempts?

Standard process termination isn’t enough for devices built with reboot-based persistence. Defenders should plan for full reimaging of compromised IoT and embedded Linux devices, combined with closing the initial access point, typically weak or default credentials on exposed services like Telnet.

Sources

• Patch-Resistant ‘RufRoot’ Flaw Can Unleash Malicious AI Agent Swarms
• Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
• Long-Lived Vulnerability in Microsoft Secure Boot
• Tengu botnet reboots Linux devices to survive removal