A virus that exploits antivirus software, a connected object that opens the door to the corporate network, a third-party web component that serves as an exfiltration relay: recent threats no longer target an isolated perimeter. They traverse the end-to-end trust chain. Understanding the mechanisms behind these attacks allows for better interpretation of cybersecurity news and anticipation of the patches to prioritize.
Zero-day on defense tools: when antivirus becomes the vulnerability
A zero-day refers to a vulnerability exploited before a patch is available. The term comes from the fact that the vendor has zero days’ notice to protect its users.
In 2026, Microsoft Defender was subject to a zero-day named BlueHammer, allowing for local privilege escalation. Ransomware groups exploited it before the patch was published. The paradox is straightforward: the tool meant to protect the workstation becomes the attack vector.
This type of scenario complicates the prioritization of patches for companies. Traditionally, security teams prioritize vulnerabilities on services exposed to the internet. When the vulnerability affects a security component already deployed on every workstation, the attack surface is the entire fleet. It is possible to discover the latest news on Viruslab to follow these zero-day alerts as they are published.
KEV Catalog and BOD 26-04 directive: the remediation framework tightens
The CISA (U.S. Cybersecurity Agency) maintains a catalog called KEV (Known Exploited Vulnerabilities). This catalog lists vulnerabilities that are confirmed to be actively exploited. Each entry comes with a mandatory remediation deadline for federal agencies.
The BOD 26-04 directive, published in 2026, reinforced this obligation by specifically targeting assets exposed on the internet. The change is operational: it shifts from general recommendations to a measurable constraint, with an imposed correction timeline.
For European companies, this catalog serves as an indirect reference. ANSSI in France recommends monitoring the KEV and integrating it into vulnerability management processes, even without a direct legal obligation. The activity report from Cybermalveillance.gouv.fr has also pointed out a significant increase in assistance requests, confirming that cyberattacks are intensifying in the territory.
Why KEV changes the prioritization of patches
Without a reference catalog, a security team ranks vulnerabilities by CVSS score (technical severity). The problem: a high score does not necessarily mean active exploitation. KEV reverses the logic. A moderate vulnerability that is actively exploited takes precedence over a theoretical critical vulnerability.
This approach requires cross-referencing two streams of information: the vendor’s bulletin (Microsoft, Cisco, etc.) and the KEV list updated by CISA. SMEs without a dedicated team can rely on vulnerability management tools that directly integrate this catalog.
IoT devices and web components: the blind spots of the trust chain
Recent attacks are no longer limited to servers or workstations. Two categories of assets remain regularly under-patched: connected objects (IoT) and third-party web components (JavaScript libraries, npm/yarn package managers).
An IoT device, whether it’s a surveillance camera, an industrial sensor, or a network printer, often operates with firmware that is rarely updated. Its operating system is minimal, and its authentication mechanisms are sometimes non-existent. An unsegmented IoT device on the network offers lateral access to the entire infrastructure.
On the web side, critical vulnerabilities in npm and yarn have facilitated dependency injection attacks. The principle: an attacker publishes a malicious package whose name resembles a legitimate library. The developer mistakenly installs it, and the malicious code executes in the production environment.
Prioritizing patches across three simultaneous areas
The challenge for companies is to address these three fronts (infrastructure, web, IoT) with limited resources. A realistic prioritization grid relies on three intersecting criteria:
- The network exposure of the asset: a service accessible from the internet is patched before an isolated internal device
- The presence in the KEV catalog or an equivalent European list: confirmed active exploitation triggers a patch within a few days, not weeks
- The capacity for segmentation: if an IoT device cannot be updated quickly, isolating it on a dedicated VLAN reduces the risk of lateral propagation
This risk-based approach replaces the method based purely on technical scores. It requires an up-to-date inventory of assets, which remains the weak point for many municipalities and SMEs.
Ransomware and data exfiltration: attack techniques converge
Ransomware groups now combine encryption and exfiltration. The classic scheme (encrypting files, demanding a ransom) is accompanied by a threat of publishing the stolen data. This double extortion increases pressure on victims, especially municipalities that manage personal data of their constituents.
The use of artificial intelligence by attackers accelerates the adaptation of malware. Documented cases show that generative AI tools are used to automatically modify the code of malicious software to bypass detection signatures. The malware mutates faster than signature databases can be updated.
This phenomenon also affects exposed APIs. A recent case showed that an API from an AI provider could be hijacked to exfiltrate data. The legitimate service then serves as an exit channel, making detection by traditional firewalls very difficult since the traffic resembles normal usage.
Protecting data beyond the network perimeter
Perimeter protection alone is no longer sufficient. Companies handling sensitive data must monitor outgoing traffic as much as incoming traffic. Encrypting data at rest and in transit, combined with behavioral detection of abnormal access, provides a more suitable foundation against current threats.
- Monitor unusual API requests in volume or destination
- Apply the principle of least privilege on each service account
- Regularly test the restoration of backups to validate their integrity against a ransomware scenario
The threat landscape in 2026 is characterized by this convergence: the same group exploits a zero-day on a defense tool, pivots to a poorly segmented IoT device, and then exfiltrates via a legitimate API. The response involves a comprehensive inventory of assets, prioritization based on actual exploitation, and network segmentation that limits propagation even when the first barrier fails.