Three problems are no longer separate. They are converging into one.
Microsoft shipped 1,235 security fixes in November. That is the second month in a row exceeding 1,000. Patch Tuesday has stopped being a Tuesday and started being a way of life. At that velocity, patch testing becomes patch triage. You test the ones you think will break things and hope the ones you defer do not. Some will.
At the same time, hackers are not waiting for patching cycles. They exploit aged flaws. Hackread reported that hackers are actively exploiting a decade-old OpenSSH vulnerability to bypass Linux logins. The flaw is old enough that many teams assume it is handled. It is not. Cisco BroadWorks shows the same pattern: CISA flagged the vulnerability as actively exploited in attacks, meaning the exploitation is in the wild, not theoretical. N-able released hotfixes for zero-day vulnerabilities in its own product this week. The window between discovery and active attack has collapsed.
But the third problem is where the threat landscape has moved. This week, three separate incidents point to a shift from exploiting the perimeter to compromising the trusted channel inside it.
AI coding agents leaked thousands of secrets directly to GitHub. These were not exfiltrated by an attacker who stole credentials. The agent itself, running as a developer tool within trusted infrastructure, made the upload. Bleeping Computer reported the incident. A developer trusted the tool with repository access. The tool did what it was designed to do, upload to a repository, and in doing so exposed API keys, database credentials, and deployment tokens that nobody expected to be at risk. The agent operated within normal developer workflows. It broke no rules. It just leaked everything.
Railway's breach cost the company $740,000 in fraudulent charges to AI services. That is not fraud in the traditional sense. That is a breach that gave attackers access to cloud accounts where they could spin up training workloads at scale. The attacker did not need to steal data. They needed to exhaust budget. Bleeping Computer covered the incident. The cost of cloud infrastructure abuse dwarfs the cost of many traditional data thefts.
This week, Bleeping Computer also reported that hackers used AntiFox AI agents in AWS credential-theft attacks. That is the attack working the other way: the attacker brings their own AI to extract credentials from your cloud environment. The agents are not defending. They are stealing.
And then there is Maersk. The shipping company confirmed a data breach with WhiteArmor ransomware demanding $5 million. That is a company whose systems are critical to supply chain visibility. Every container, every route, every port integration. The breach happened not because Maersk lacked patches but because attackers found a way in that patches do not close. Bleeping Computer reported that hackers are exploiting trusted AWS access to breach multiple cloud environments. They are not breaking in. They are using credentials that look legitimate. They are using the trust layer.
Nitori, a Japanese furniture retailer, had 37.6 million customer records stolen. That is roughly the population of Canada. The attacker did not need new exploits. They needed to find the door that was left unlocked long enough to copy everything.
Poland shut down its government services platform, ePUAP, after a cyberattack. This is not a small system. This is how citizens apply for permits, pay taxes, and interact with the state. The shutdown itself is a denial of service. The data inside was the secondary objective.
The convergence is this: patch volume is impossible to manage at this scale. Aged exploits still work because you cannot patch everything. But the real attacks are not waiting for you to fail at patching. They are using the channels you have already trusted. They are using AI to amplify the attack surface. They are using cloud infrastructure as a weapon. They are using credentials that look legitimate because they are.
The old security model assumed a perimeter. You hardened the edges, patched the known flaws, and monitored the traffic. That model is broken. Not because it was wrong. Because the attack surface has moved inside.
A CISO cannot patch 1,235 flaws in 30 days across an enterprise. The math does not work. The time does not exist. So the question is not whether you will leave some flaws unpatched. The question is whether you know which ones matter, which ones are actively exploited, and which ones are in code paths you do not actually use.
For the ones you cannot patch, assume they are open. If hackers find the decade-old OpenSSH flaw worth exploiting now, they will find the six-month-old one worth exploiting later. Build your architecture on the assumption that some credentials will be compromised. That means not storing long-lived tokens in cloud environments. That means short-lived, revokable credentials everywhere. That means knowing exactly which services can do what with which credentials, and why.
AI coding agents are faster and more capable than humans. They are also tools you do not fully understand. If a coding agent can leak secrets to GitHub, it can leak them elsewhere too. The risk is not the agent. The risk is that you have given it permissions you cannot audit and workflows you do not fully see. If you use AI in development, assume it will find the easiest path to its objective. That path might go through your secrets.
Cloud is not the perimeter. It is the new inside. Assume that if an attacker gets credentials, they will use them to spin up workloads, run training jobs, or extract data. The cost of compute is no longer your problem when an attacker is paying for it with your credentials. Credential detection and revocation have to be faster than they are now. That means real-time monitoring of cloud access, not logs you review the next day.
The patch problem will not solve itself. The vulnerability volume is structural now, not temporary. You need to know your asset inventory exactly: what runs where, what patches are critical, and what cannot wait. You need to prioritize by active exploitation, not by severity score. CISA's list of known exploited vulnerabilities is the source of truth. If it is not on that list, it is less urgent than something that is.
This week, your job is simple. Audit your credential storage and rotation. Check what your AI tools have access to and what they do with that access. Prioritize the patches that are actively exploited, not the ones with the highest CVE scores. And assume that some attacker is already inside, using credentials that look legitimate. Build your detection around that assumption.
The perimeter is gone. Work inside it now.