Cyber Brief: Patch Delays, ClickFix Malware, and PAN-OS Exploits

Today's stories share a common thread that will be familiar to many security teams: the gap between knowing about a risk and closing it. Whether that is a known vulnerability sitting unpatched for months, a trusted software component being weaponised to deliver malware, or a widely used network appliance being actively targeted by ransomware operators, the pattern is consistent. Attackers are exploiting delays, trust, and complexity — and UK organisations need to understand where those gaps exist in their own environments.

Exploited vulnerabilities take a median of 87 days to patch, Moody's finds

New research published by Moody's and reported by Infosecurity Magazine has found that known exploited vulnerabilities take a median of 87 days to be remediated — roughly three months from the point at which active exploitation is confirmed. The analysis examined vulnerabilities listed in authoritative threat intelligence sources and found that even when exploitation is publicly known, patching timelines remain significantly extended across organisations of all sizes. The research highlights that the window of exposure is not a brief technical inconvenience but a sustained period of elevated risk that attackers are actively taking advantage of.

For UK businesses, this finding has direct operational relevance. Many organisations operate with lean IT and security teams, complex legacy environments, or change management processes that slow down the deployment of patches — particularly in production systems where downtime carries commercial cost. The 87-day median is not a reflection of negligence; it reflects the real-world friction involved in testing, scheduling and deploying updates at scale. However, it also means that for any given exploited vulnerability, the average organisation remains exposed for nearly three months after the risk is publicly understood.

Why it matters

For UK organisations, this is a prompt to review how vulnerability prioritisation is handled — specifically whether known exploited vulnerabilities are being fast-tracked through change management processes rather than queued alongside routine updates. Understanding your median patch time for critical and exploited vulnerabilities is a useful baseline metric for any security team to establish and report on.

Source: Infosecurity Magazine

ROMULUS ClickFix platform used to deliver LegionLoader and other malware

Cybersecurity researchers at Forescout Research — Vedere Labs have published details of a malware delivery platform called ROMULUS, as reported by The Hacker News. ROMULUS operates as a ClickFix-style delivery service, using convincing fake landing pages to trick users into manually running malicious commands on their own machines. The platform has been observed distributing LegionLoader, a malware loader capable of deploying information stealers, browser credential harvesters and additional payloads. The ClickFix technique is notable because it bypasses many traditional endpoint controls by relying on the user to execute the malicious command themselves, rather than delivering a file that security tools might intercept.

ClickFix-style attacks have become increasingly prevalent across the threat landscape because they exploit user trust and familiarity rather than technical vulnerabilities. The fake pages often impersonate legitimate software update prompts, CAPTCHA verification steps or browser error messages — scenarios that many users encounter regularly and may not immediately question. For UK organisations, the risk is particularly relevant in environments where users have local administrator rights or where security awareness training has not kept pace with evolving social engineering techniques.

Why it matters

For UK businesses, this is a prompt to review whether security awareness training covers ClickFix-style lures specifically, and whether users understand that legitimate software or websites will never ask them to open a command prompt and paste in instructions. Restricting local administrator rights where operationally feasible remains one of the most effective controls against this class of attack.

Source: The Hacker News

Drupal warns of fast exploitation risk for critical remote code execution flaw

SecurityWeek reports that Drupal has issued a warning about a critical remote code execution vulnerability affecting its core platform, specifically the Entity List and Field UI modules. The Drupal security team has flagged that exploit paths exist when certain contributed modules are in use, and has warned that exploitation could occur rapidly following public disclosure. The vulnerability affects organisations running Drupal-based websites and applications, and the advisory urges administrators to apply available patches without delay. Drupal is widely used across UK public sector organisations, higher education institutions, charities and commercial businesses for content management and web publishing.

Remote code execution vulnerabilities in content management systems are particularly serious because they can allow an attacker to take full control of the underlying server, exfiltrate data, deploy malware or use the compromised system as a foothold for further attacks within the organisation's network. The Drupal team's explicit warning about fast exploitation risk reflects a pattern seen with previous CMS vulnerabilities, where proof-of-concept exploit code circulates quickly after disclosure and automated scanning begins almost immediately. Organisations that do not patch promptly can find themselves compromised within days of a vulnerability becoming public.

Why it matters

For UK organisations running Drupal-based websites or applications, this is an immediate prompt to check which version of Drupal core is in use, confirm whether the Entity List or Field UI modules are active, and apply the available security update as a priority. If patching cannot be completed immediately, reviewing whether contributed modules that create exploit paths can be temporarily disabled is a sensible interim step.

Source: SecurityWeek

Ransomware groups actively exploiting PAN-OS vulnerability CVE-2026-0257

Palo Alto Networks' Unit 42 threat intelligence team has published an updated threat brief confirming that ransomware operators are actively exploiting CVE-2026-0257, a vulnerability in PAN-OS, the operating system that powers Palo Alto Networks firewalls and network security appliances. Two ransomware groups have been identified as exploiting the vulnerability: Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Both groups have established track records of targeting UK organisations across sectors including healthcare, education and professional services. The Unit 42 advisory was updated on 19 October 2026, indicating that exploitation activity is ongoing and evolving.

PAN-OS appliances are widely deployed across UK enterprise environments as perimeter security controls, making this vulnerability particularly significant. When a network security device is itself compromised, attackers can gain a privileged position within the network — potentially bypassing the very controls that are designed to detect and prevent intrusion. The involvement of two active ransomware groups signals that this vulnerability has moved beyond opportunistic scanning and is being used in targeted intrusion campaigns. Organisations that have not yet patched CVE-2026-0257 should treat this as a high-priority remediation task.

Why it matters

For UK organisations using Palo Alto Networks firewalls or other PAN-OS-based appliances, this is a direct prompt to confirm whether CVE-2026-0257 has been patched and to review firewall logs for any indicators of compromise consistent with the activity described in the Unit 42 advisory. Given the involvement of known ransomware operators, incident response readiness and backup integrity should also be reviewed alongside the technical patching work.

Source: Palo Alto Unit 42

Today's Key Actions

• Review your organisation's vulnerability management process to confirm that known exploited vulnerabilities are being fast-tracked through patching and change management, separate from routine update cycles. Establish or review your median patch time for critical vulnerabilities as a reportable security metric.
• Assess whether security awareness training covers ClickFix-style social engineering lures, and remind users that no legitimate service will ask them to open a command prompt and run pasted instructions. Review local administrator rights policies and restrict them where operationally feasible.
• If your organisation runs Drupal-based websites or applications, check the current version of Drupal core and apply the available security patch for the Entity List and Field UI module vulnerability as a priority. Confirm whether contributed modules that create exploit paths are in active use.
• If your organisation uses Palo Alto Networks PAN-OS appliances, confirm whether CVE-2026-0257 has been patched and review firewall logs for indicators of compromise. Given the active involvement of ransomware operators, also verify that backups are current, tested and isolated from the network.
• Confirm that clear ownership exists for each of these areas — vulnerability management, user awareness, web platform security and network appliance patching — so that today's actions can be assigned, tracked and reported on effectively.

Secarma Insight

Today's stories are a useful reminder that the majority of successful attacks do not rely on novel techniques or zero-day exploits — they rely on the gap between awareness and action. Organisations that invest in clear ownership, structured patch prioritisation and regular security awareness training are consistently better placed to manage these risks than those that respond reactively. Good security practice is not about eliminating all risk overnight; it is about systematically reducing the window of exposure and ensuring that when a known threat emerges, the right people know what to do and have the authority to do it. The fundamentals — patch management, user education, access controls and tested backups — remain the most reliable foundation for resilience.