Now that an attacker can use an LLM to weaponize a bug the minute it's found, taking 12 days to patch ‘is essentially a suicide note for your network,’ says an expert.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

A critical remote code execution vulnerability (CVE-2026-34197) in Apache ActiveMQ, discovered by Horizon3.ai researchers using Anthropic's Claude AI in roughly 10 minutes, remains unpatched on over 6,500 internet-exposed instances nearly two weeks after disclosure. The flaw affects ActiveMQ versions before 5.19.4 and 6.0–6.2.3, and has existed for 13 years. CISA has added it to its Known Exploited Vulnerabilities catalog. Security experts warn that slow manual patching cycles are untenable in an era where AI can weaponize bugs immediately upon discovery, urging organizations to adopt automated patching, maintain a software bill of materials (SBOM) using standards like CycloneDX, and treat patching as a survival requirement rather than routine maintenance.

Thousands of Apache ActiveMQ instances still unpatched, weeks after an actively exploited hole discovered