The Patch Window Has Collapsed. Defenders Need to Change Now

On July 31, N-able detected a threat actor exploiting a previously unknown vulnerability in N-central. By August 1, the company had published guidance. Hotfix 1 arrived on August 2. Continued monitoring found a related attack path, so Hotfix 2 followed on August 6. That is already a difficult timeline for any IT or security team, and then comes the part that matters even more.The attackers were not only getting into the N-central server. According to N-able’s incident update, they used the RMM platform’s remote-access capability to reach managed devices and registered Cloudflare tunnel services for persistence. N-able warned customers that applying Hotfix 2 closed the entry point but did not remove an attacker who may already be inside.That incident is the collapsing patch window in its most honest form. The vulnerability was unknown. Exploitation was already happening. The first fix was not the last fix, and the compromised product was itself a management plane with authority over…