Look at the exploited bugs in this week's news and count how many were brand new. Not many. The thing getting people hurt right now isn't the zero-day. It's the gap between "the vendor fixed it" and "we installed the fix."
Exhibit A: Synology NAS Ransomware
On October 29, Synology said it had seen attackers "exploiting a vulnerability patched in December 2024" to encrypt data on NAS devices running outdated DSM, and pointed owners to its advisory Synology-SA-24:20. Users on Reddit have been reporting the ransomware, called C3RB3R, which renames files with a .L0CK3D extension.
One honest caveat: the sources don't fully agree on the door. Synology points to the December 2024 fix. Chinese security firm 360 attributed the incidents it handled to two newer flaws from Synology's September 2026 advisory (SA-26:13). Nobody has shown these are the same victims, and there's no evidence of an attack on fully updated DSM. Both explanations end in the same place: the devices weren't current.
Synology's advice is simple: update DSM now and turn on automatic updates.
Exhibit B: Cisco SD-WAN and KeyDrift
Cisco patched CVE-2026-20127, a maximum severity auth bypass in Catalyst SD-WAN Controller and Manager, in February. In late October, Cisco Talos documented a new group, UAT-11473, still exploiting it to plant KeyDrift, malware built to quietly steal IPsec key material from SD-WAN control-plane traffic. Targets: space and satellite, defense and aerospace, and policy research. Eight months after the patch. (I covered the bigger Volt Typhoon picture around that bug last week.)
Exhibit C: Siemens IoT2050
Today's other post: a CVSS 10 Node-RED flaw in a Siemens industrial gateway, fixed in August, exploited by late October.
The Pattern
Three very different devices: a home and small business NAS, an enterprise SD-WAN controller, a factory gateway. Same story. They're all appliances. They all sit somewhere reachable. And they're all the kind of thing that doesn't get updated on the same rhythm as laptops, because nobody owns them, because updating means a reboot nobody wants, or because "it's been running fine."
Attackers have figured out that patch diffing plus a scan of the internet is cheaper than finding a zero-day. Once the advisory is public, every unpatched box is a known target with a published map.
Usual disclosure: I work at Zscaler, which sells a cloud alternative to a lot of internet-facing appliances, so weigh my bias. Every vendor ships bugs, mine included. But the architecture point stands on its own: the fewer boxes you have listening on the internet, the fewer you have to win the patch race on. And for the ones you keep, exposure matters as much as version number.
What To Do
- Synology owners: update DSM today, turn on auto-update, and check Synology's ransomware prevention checklist. If the NAS is reachable from the internet (QuickConnect, port forwards, DSM login page), close that unless you truly need it.
- Keep backups off the thing you're backing up. A NAS that holds the only copy of your backups is a single point of failure. Snapshots plus an offline or offsite copy.
- Build an appliance inventory. NAS, VPN, SD-WAN, firewalls, OT gateways, management consoles. Who owns each one, what version it's on, and whether it's internet-facing.
- Measure patch age, not just patch status. "How long has the fix been available and we didn't install it?" is the number that predicts trouble.
- Treat the CISA KEV list as an outage-level priority for anything you run.
- Hide management interfaces. If it doesn't need to be reachable from the internet, make it unreachable.
Bottom Line
The fix existed. In every one of these cases, the fix existed. The vulnerability that actually got exploited was the time between the advisory and the update. Shrink that, and take as many boxes off the internet as you can, and most of this week's headlines don't apply to you.
Sources: Synology statement on C3RB3R, Synology-SA-24:20, The Hacker News, Gridinsoft on the Synology and 360 accounts, BleepingComputer on KeyDrift, and Cisco Talos, UAT-11473 and KeyDrift