Latest / Tech Talks With Kinsoft / Last Week in Tech - The Biggest Patch Tuesday Ever, a 10.0 With No Patch to Apply, and Oracle's $664 Billion Round Trip
Transcript
- 0:00Imagine a burglar walks up to your house, right?
- 0:03They don't pick the lock. They don't throw a
- 0:06brick through a window. They just wait. Exactly.
- 0:08They just wait for your smart doorbell to automatically
- 0:10send you a notification. And the mere act of
- 0:13your doorbell generating that alert causes your
- 0:15front door to just fly wide open. You never even
- 0:18pressed a button. It's a really visceral image.
- 0:22But it honestly perfectly captures the reality
- 0:25of the digital landscape right now. The very
- 0:28defenses we invest in. are becoming the doorways.
- 0:31And we're going to get into the specific mechanics
- 0:34of exactly how that is happening in today's deep
- 0:36dive. We're unpacking a single just densely packed
- 0:40source today. It's a mid -September 2026 industry
- 0:43update from Kinsoft called Last Week in Tech.
- 0:46Right. And our mission here is to extract the
- 0:48critical, you know, the need to knows for anyone
- 0:50who relies on digital infrastructure, which,
- 0:52let's be honest, that is every single one of
- 0:55us. Yeah. We are looking at a tech world that
- 0:58is currently buckling under extreme stress. I
- 1:00mean, from attackers finding mind -bendingly
- 1:04clever ways to slip past our perimeters to the
- 1:07sheer crushing weight of the money being poured
- 1:10into artificial intelligence right now. And if
- 1:12you are listening to this on your commute, maybe
- 1:14you're an IT director or maybe you run an e -commerce
- 1:16brand or you're just trying to understand where
- 1:18the Internet is headed. These hidden mechanics,
- 1:21they dictate your daily friction points. Absolutely.
- 1:23These aren't abstract concepts. These vulnerabilities,
- 1:26these financial shifts, they're the reason you
- 1:29might have to, I don't know, authorize weekend
- 1:31overtime for your team or even rewrite your entire
- 1:33hardware budget mid -quarter. Okay, let's unpack
- 1:36this. Starting with that doorbell analogy and
- 1:39how it applies to online retail. an online store
- 1:42on Magento or Adobe Commerce. The source material
- 1:45essentially issues a red alert. A massive red
- 1:48alert, yeah. In early September, attackers started
- 1:50exploiting a zero -day vulnerability dubbed Style
- 1:53Smuggler. And I want to make sure I understand
- 1:55the sheer severity of this because it has a CVSS
- 1:58score of 10 .0. That's the common vulnerability
- 2:00scoring system. And 10 is the absolute maximum,
- 2:04meaning it requires zero authentication and an
- 2:07attacker can execute code remotely. But what
- 2:10I don't get is how does it trigger without anyone
- 2:12actually clicking a malicious link? The mechanism
- 2:15is genuinely brilliant in a highly malicious
- 2:17way. Typically, an attacker tries to force malicious
- 2:21code through an input field, like a login box.
- 2:24Like typing code into a password field. Exactly.
- 2:27But here. They completely bypass that. They poison
- 2:30a standard log file that Magento naturally writes
- 2:33to just to keep track of its own activity. And
- 2:36they plant PHP code inside of it. Then they just
- 2:39trigger a completely mundane automated function.
- 2:42Specifically, it's a payment transaction failed
- 2:44reminder email. Wait, so let me make sure I have
- 2:46this straight. The email doesn't even need to
- 2:48be opened by an employee? Nope. Just the act
- 2:50of the systems thinking about rendering that
- 2:52normal message triggers the hack. Yes, exactly.
- 2:55When Magento simply attempts to assemble that
- 2:57email, it pulls from that poisoned log file and
- 3:01the malicious code executes. It's zero click
- 3:03in the purest sense. Nobody clicks a link. Nobody
- 3:06opens an attachment. Wow. And what drops into
- 3:08your system after that automated door opens is
- 3:11a highly sophisticated 1 .9 megabyte payload.
- 3:16And it's written in Rust. Which is super fast,
- 3:19right? Yeah. Rust is a programming language known
- 3:21for being incredibly fast and notoriously hard
- 3:24to reverse engineer. This program disguises itself
- 3:28as a normal Linux background task. It hides in
- 3:30a hidden directory above what's called the web
- 3:32root. Meaning what exactly? Basically, it stores
- 3:35itself outside the folder where your actual website
- 3:37files live. So your typical security scans. They
- 3:40completely miss it. Oh, wow. And then it sets
- 3:42up a scheduled job to resurrect itself every
- 3:44five minutes. Yeah. The source notes one store
- 3:46where this resurrection job was added over 1
- 3:48,700 times. An admin would delete it and it would
- 3:51just regenerate in less than a second. It's relentless.
- 3:53Yeah. But the most alarming detail for anyone
- 3:56managing these stores isn't just the profistence.
- 3:59It's the fact that patching the software was
- 4:01entirely irrelevant to stopping the current infections.
- 4:04See, I saw that in the notes and assumed it was
- 4:06a typo. How can a fully updated store still be
- 4:10compromised? Because the vulnerability allowed
- 4:12attackers to plant their persistence mechanisms
- 4:15deep in the operating system before the patch
- 4:17was even available. Oh, I see. Yeah, stores running
- 4:20version 2 .4 .6, patch 15, which is the most
- 4:23current patch level they were hit, even a store
- 4:25on the newer version 2 .4 .8 running a paid commercial
- 4:29protection product got compromised. So patching
- 4:31does nothing if they're already in. Exactly.
- 4:33If your store was online and exposed between
- 4:36September 4th and September 7th, you need a full
- 4:38compromise assessment, not just a software update.
- 4:41You literally have to assume they are already
- 4:43inside. So you have to burn it all down, basically.
- 4:46Pretty much. You have to flush user sessions,
- 4:48rotate encryption keys, change admin passwords,
- 4:51everything, and be warned about the detection
- 4:53trap here. What's the trap? If your security
- 4:56team just searches for the exact text string
- 4:59that the initial security reports published,
- 5:01they will fail to find the malware. Because the
- 5:03attackers changed the fingerprint. Exactly. The
- 5:05infections quickly moved to a different system
- 5:07log directory. And that static marker string
- 5:10changed within 24 hours. You have to hunt for
- 5:14the behavior of the malware, like a hidden process
- 5:16constantly restarting, not just scan for a static
- 5:20line of code. And this Magento flaw is just,
- 5:23it's one piece of a much larger crisis happening
- 5:26at the edge of corporate networks right now.
- 5:27Oh, yeah. It's everywhere. The source points
- 5:29out that the American Catalog of Exploited Vulnerabilities
- 5:32added 10 different edge device entries in just
- 5:35three days. We're talking about a massive flaw
- 5:38in Cisco Secure Firewall Management Center giving
- 5:41attackers root access. Yep. Flaws in Citrix Netscaler,
- 5:45Fortinet, and this wild microtrick vulnerability
- 5:47taking over microtrick routers via SSH without
- 5:50any authentication at all. I mean, why are the
- 5:53devices meant to protect us suddenly the most
- 5:55vulnerable things on the network? It is the cruelest
- 5:58irony in modern cybersecurity, really. For years,
- 6:01the fundamental rule of defense has been to reduce
- 6:04your attack surface. You know, shut down open
- 6:07ports, turn off unnecessary services. Right.
- 6:10But with a firewall manager or a VPN gateway
- 6:13or a load balancer, you cannot reduce their attack
- 6:17surface because the attack surface is the product.
- 6:19Right. They have to face outward. They are designed
- 6:21to stand at the absolute edge of your network
- 6:24and face the public internet 24 -7. And because
- 6:28these devices are getting exploited before the
- 6:30vulnerabilities are even publicly disclosed,
- 6:32the fact that you applied a patch today tells
- 6:35you absolutely nothing about whether someone
- 6:37already walked through that door last week. So
- 6:39the strategy has to change. The new mandatory
- 6:41rule for IT strategy is patch, then hunt. But
- 6:45fixing the software that faces the outside world
- 6:47only solves half the problem. If attackers slip
- 6:50past that perimeter firewall, what are they walking
- 6:53into? Because this week, they are walking into
- 6:56a Windows environment that requires nearly a
- 6:58thousand separate bandages. It's really bad.
- 7:01Let's look at Microsoft's historic September
- 7:032026 patch Tuesday. The volume of updates here
- 7:07is staggering. It is a massive payload. I mean,
- 7:09the running total for Windows vulnerabilities
- 7:11in 2026 is now roughly 2 ,760. Which is insane.
- 7:17Let's put that into perspective. The previous
- 7:19record year for vulnerabilities was 2020, which
- 7:21had 12 ,245. We have more than doubled the worst
- 7:25year on record, and we still have a quarter of
- 7:27the year left. Mixed into those hundreds of patches
- 7:29are two actively exploited zero days. They're
- 7:32both Windows privilege escalation flaws carrying
- 7:35a CVSS score of 7 .8. Right. I have to push back
- 7:39here, or at least ask for some clarity on how
- 7:41security teams prioritize these things, because
- 7:43we just spent 10 minutes treating a 10 .0 CVSS
- 7:45score from Magento like a five alarm fire. Why
- 7:48is a 7 .8 being treated with the same extreme
- 7:51urgency by these security researchers? Like,
- 7:53what does privilege escalation actually mean
- 7:55in plain English for a business owner? What's
- 7:57fascinating here is that the raw severity score
- 7:59can sometimes mask the real world operational
- 8:03danger. A 10 .0 is the flaw that gets the attacker
- 8:06into the building. But a 7 .8 privilege escalation
- 8:10flaw is what they use once they are already inside.
- 8:13Think of it like a corporate badge system. A
- 8:16phishing email might get an attacker a visitor
- 8:18badge, giving them access to the lobby. Right.
- 8:21They're in, but they can't do much. Exactly.
- 8:23But a privilege escalation flaw is a glitch in
- 8:26your badging software that lets that visitor
- 8:28walk up to a kiosk and instantly reprint their
- 8:31ID to say CEO. Suddenly they have access to the
- 8:34server room, the executive suites, everything.
- 8:36Okay, that makes total sense. It's the mechanism
- 8:38that takes a minor contained breach, like, say,
- 8:41a single compromised laptop in HR, and turns
- 8:44it into a company -wide ransomware catastrophe.
- 8:46Precisely. It gives them system control. And
- 8:49while IT teams are triaging that massive list
- 8:51of patches, the source highlights two others
- 8:54that demand immediate attention. What are those?
- 8:56First, an exchange server flaw with an 8 .1 score.
- 9:00This triggers remote code execution simply by
- 9:03a user receiving a malicious Visio diagram attachment
- 9:06in an email. Wow, just receiving it. Yeah. Second,
- 9:09a 9 .8 score flaw in the Windows DNS server,
- 9:13which researchers are calling the spiritual successor
- 9:15to the infamous cigarette vulnerability. DNS
- 9:18is basically the phone book of the Internet,
- 9:19right? It translates website names into IP addresses.
- 9:22Yes. And if you run an Internet -facing Windows
- 9:25DNS server, a flaw like this acts like a corrupted
- 9:28switchboard operator. An attacker can hijack
- 9:31that server and misdirect all your internal and
- 9:34external network traffic wherever they want.
- 9:36So you think you're going to your bank, but you're
- 9:37actually going to their fake site. Exactly. That
- 9:40is a drop everything and fix it moment. But there
- 9:43is a massive warning from the source material
- 9:45regarding this specific patch Tuesday. You absolutely
- 9:48must test these updates in a sandbox environment
- 9:50before deploying them to your live servers. Yeah,
- 9:53I read this part and genuinely felt bad for system
- 9:56administrators. The September Windows server
- 9:59update actually causes a deadlock between the
- 10:02remote desktop protocol and the local session
- 10:05manager. I know that sounds super dense, but
- 10:08what is the actual mechanism happening there?
- 10:10It's essentially a software traffic jam that
- 10:13can't be resolved. Think of it like two security
- 10:16guards at a single narrow door who both refuse
- 10:19to move until the other one steps aside. So they
- 10:22just stand there forever. Exactly. Nothing can
- 10:24pass. When this deadlock happens, it completely
- 10:27breaks remote desktop services across your entire
- 10:30environment. Meaning, if an IT director pushes
- 10:32this update blindly just to secure the network,
- 10:35they accidentally lock their own IT team out
- 10:38of the very servers they are trying to manage
- 10:40remotely. Exactly. You secure the building by
- 10:42supergluing all the locks shut with your team
- 10:45on the outside. That's terrifying. You really
- 10:47cannot afford to skip the testing phase, even
- 10:50when the pressure to patch a thousand vulnerabilities
- 10:52is this high. Right. Well, if your software is
- 10:55this brittle, you'd hope your hardware provides
- 10:57a solid foundation, or at least that your company
- 11:00can afford to keep it updated so you can run
- 11:01all these new security protocols. But the hardware
- 11:04reality check that just hit corporate IT departments
- 11:07following Apple's latest event completely rewrites
- 11:10that budget math. It was a massive hardware drop,
- 11:12sure. But the real story for enterprises is hidden
- 11:16in what didn't happen. The event was undeniably
- 11:18flashy. I mean, we finally got the foldable iPhone
- 11:21Duo opening up to a 7 .8 -inch screen. Pricing
- 11:25starting at $1 ,999 and scaling all the way up
- 11:29to $3 ,199. Which is a lot for a phone. A whole
- 11:32lot. Plus, they rolled out the iPhone 18 Pro
- 11:35and Pro Max featuring that new 2 -nanometer A20
- 11:38Pro chip alongside a whole suite of new watches
- 11:41and AirPods. It's just an incredible amount of
- 11:43new tech. If we connect this to the bigger picture,
- 11:45though. Those ultra -premium specs are creating
- 11:47a logistical nightmare for corporate device fleet
- 11:49managers. How so? The critical omission in that
- 11:52lineup is that there is no standard iPhone 18
- 11:54in this release cycle. Apple has delayed the
- 11:56more affordable baseline models to spring 2027.
- 12:00So how does a six -month delay on a standard
- 12:02phone upend a corporate IT budget? Well, imagine
- 12:05you're an IT director for a mid -sized company,
- 12:08maybe 1 ,000 employees. You budgeted $800 per
- 12:12device for a mid -tier hardware refresh this
- 12:14quarter. Your employees' current phones are aging
- 12:18out of their security support windows, which,
- 12:21as we just discussed with all these flaws, is
- 12:23incredibly dangerous right now. You definitely
- 12:26want supported devices. Exactly. But because
- 12:28the standard model is delayed, your assumptions
- 12:31just got destroyed. Your options right now start
- 12:34exclusively at the pro -pricing tiers, which
- 12:36might be $1 ,200. You are suddenly looking at
- 12:39a $400 ,000 deficit in a quarterly budget you
- 12:42finalized months ago. Wow. So you either have
- 12:44to go to the CFO and beg for half a million dollars
- 12:46of unplanned capital expenditure, or you force
- 12:49your employees to run vulnerable aging hardware
- 12:52for another six to eight months and just pray
- 12:53you don't fail a compliance audit. That is the
- 12:56exact corner thousands of businesses have just
- 12:58been painted into. It's a huge problem. I mean,
- 13:00a $400 ,000 hardware deficit is enough to get
- 13:03an IT director fired. But when we zoom out to
- 13:06the macroeconomic scale of the tech industry
- 13:09right now, that kind of money is literally a
- 13:11rounding error compared to what is being spent
- 13:14to build the infrastructure for artificial intelligence.
- 13:16Oh, entirely. It's not even a drop in the bucket.
- 13:18I was looking at Oracle's Q1 FY2027 financials
- 13:23in the source material, and the stock market's
- 13:25reaction made zero sense to me. They posted $19
- 13:28.3 billion in total revenue. Their infrastructure
- 13:32cloud revenue was up 121%. When the numbers dropped,
- 13:35the stock surged almost 8 % during the day. But
- 13:38then it completely plummeted and closed 2 % down.
- 13:41What spooked the market so badly? It was a single
- 13:44line item that revealed the staggering, almost
- 13:47unimaginable scale. scale of the AI infrastructure
- 13:49boom, and more importantly, the terrifying risk
- 13:51holding it up. OK, what was the line item? The
- 13:54market initially cheered because Oracle revealed
- 13:56a backlog, the remaining performance obligations
- 13:58of $664 billion. $664 billion. Yeah. With a B.
- 14:04Yes. Heavily driven by $30 billion in new AI
- 14:07cloud contracts signed in just one quarter. alongside
- 14:10the delivery of 300 ,000 GPUs. But the market
- 14:13reversed course violently because they realized
- 14:15the extreme counterparty concentration risk.
- 14:18Meaning who they're doing business with. Right.
- 14:20Roughly half of that massive $664 billion backlog
- 14:24is tied to a single entity, OpenAI. Wait, so
- 14:28Oracle is basically betting the entire farm on
- 14:31one horse. It raises a vital question about whose
- 14:34balance sheet is actually underwriting these
- 14:36massive physical data centers. Look at the mismatch
- 14:38in scale here. OpenAI's estimated annualized
- 14:41revenue was around $12 billion. Okay. Yet they
- 14:44are making infrastructure commitments in the
- 14:46hundreds of billions of dollars. Meanwhile, to
- 14:48fund building these physical data centers to
- 14:50house all those GPUs for OpenAI, Oracle sold
- 14:53$20 billion in stock. They are currently running
- 14:56a negative free cash flow of $5 .4 billion, and
- 14:59they are guiding a net cash outlay of roughly
- 15:01$70 billion for the year. So Oracle is spending
- 15:04tens of billions in actual present -day cash
- 15:07to pour concrete and buy servers based on a half
- 15:11-trillion -dollar IOU from a startup that only
- 15:14generates $12 billion a year in revenue. You've
- 15:17just identified exactly why the stock dropped.
- 15:19If OpenAI's subscriber growth slows down, or
- 15:23if the next generation of their models doesn't
- 15:25deliver the expected commercial leap, Oracle
- 15:27is left holding the bag on tens of billions of
- 15:29dollars of highly specialized depreciating Physical
- 15:33hardware. That is, I mean, that's insane. It
- 15:35is the ultimate lesson in supplier concentration
- 15:37risk. And this top -end infrastructure spending
- 15:40looks even more precarious when you contrast
- 15:42it with the reality of what's happening at the
- 15:44bottom end of the AI market. On one hand, you
- 15:46have Anthropic reportedly signing compute agreements
- 15:48worth up to $517 billion over an 11 -month period.
- 15:53consuming 14 .8 gigawatts of power. Which is
- 15:56astronomical. Right. To put that in perspective,
- 15:5814 gigawatts could power a small country. But
- 16:01on the exact same week, a Chinese AI company
- 16:03named DeepSeek releases their V4 .1 flash model.
- 16:06And the economics of that DeepSeek release fundamentally
- 16:09challenged the multi -billion dollar thesis.
- 16:11So the source notes it has open weights and an
- 16:13MIT license. Let's translate that for a second.
- 16:15Open weights means the actual brain of the AI,
- 16:18the underlying neural network, can be downloaded
- 16:20by anyone. And the MIT license means... a business
- 16:23can use it commercially with almost no restrictions.
- 16:25Right. It's totally open. And it scores near
- 16:27the absolute top frontier level on coding benchmarks.
- 16:31But the cost to run it, 60 cents per million
- 16:34output tokens, that's 60 cents to generate roughly
- 16:38750 ,000 words. The gap between the top end and
- 16:42the bottom end of the AI market is, it's no longer
- 16:45a gap. It's a chasm. Yeah. The architectural
- 16:48efficiency is happening in the open source community,
- 16:50utilizing techniques like routing queries to
- 16:53smaller, specialized sub -models. Instead of
- 16:55activating a massive trillion parameter brain
- 16:57for every simple question, they're driving cost
- 17:00to zero. Now, there are major caveats, of course.
- 17:03Like, well, if you use a model like DeepSeek.
- 17:05You have to navigate complex data residency laws.
- 17:08If you don't host it yourself, your corporate
- 17:10data is bouncing through an overseas API. And
- 17:13you actually need the internal engineering talent
- 17:15to download those open weights and spin up the
- 17:18servers in -house. True, but if a company does
- 17:21have that talent, the build versus buy math for
- 17:24enterprise AI has totally inverted. I mean, a
- 17:28business processing millions of legal documents
- 17:30or analyzing massive data sets can suddenly do
- 17:33it for absolute pennies using highly capable
- 17:35open models rather than paying the astronomical
- 17:38frontier infrastructure prices demanded by the
- 17:40major labs. Which puts immense existential pressure
- 17:43on those heavily leveraged half trillion dollar
- 17:46infrastructure bets we just talked about with
- 17:47Oracle, OpenAI and Anthropic. The competitive
- 17:51landscape and the fundamental value of a generated
- 17:53word is shifting beneath their feet while they
- 17:56are still busy pouring concrete for their new
- 17:57data centers. So what does this all mean? We've
- 18:00covered a massive amount of ground today, and
- 18:03it really paints a picture of a tech landscape
- 18:04experiencing absolute whiplash. In just a few
- 18:08days, we are dealing with zero -click Magento
- 18:11payloads that completely bypass all software
- 18:14patches. We are staring down historically massive
- 18:17Microsoft updates that act like a digital traffic
- 18:20jam, literally locking IT teams out of their
- 18:22own servers. We have Apple's supply chain logistics
- 18:26quietly forcing corporate fleets into budget
- 18:28-busting hardware. upgrades. And we are watching
- 18:31hundreds of billions of dollars being leveraged
- 18:33on AI infrastructure that relies on the continued,
- 18:35flawless success of a single customer. The throughline
- 18:39connecting all of this is that blind trust is
- 18:41the single biggest vulnerability a business can
- 18:43have today. Whether that is blindly trusting
- 18:45that a software patch perfectly protects your
- 18:48network perimeter without you actually hunting
- 18:50for the intrusion, or blindly trusting an automated
- 18:53operating system update won't break your internal
- 18:56architecture. or blindly trusting that massive
- 18:59AI suppliers have the financial gravity to underwrite
- 19:02the future of your company's technology stack.
- 19:05The digital perimeter isn't just crumbling. The
- 19:08foundation it sits on is actively shifting. You
- 19:10have to verify everything. You have to assume
- 19:12breach as a baseline operating state and deeply
- 19:15understand the mechanics of the tools you rely
- 19:17on. Which leaves you with one final thought to
- 19:20ponder as we wrap up. We mentioned DeepSeek offering
- 19:22near frontier AI capabilities for just 60 cents
- 19:26a million tokens, while giants are committing
- 19:28hundreds of billions of dollars to physical hardware.
- 19:31It raises a massive question about the macroeconomic
- 19:33reality of tech right now. If the actual commercial
- 19:36value generated by these AI models is being aggressively
- 19:39commoditized and replicated by open source alternatives
- 19:43for literal pennies, are we staring directly
- 19:46at the imminent burst of an AI hardware bubble?
- 19:49Because right now, the astronomical cost of building
- 19:52the infrastructure seems to be vastly outpacing
- 19:54the revenue those models can ever mathematically
- 19:57hope to generate. A truly sobering thought to
- 19:59end on, and something every tech leader needs
- 20:02to factor into their long -term strategy. Absolutely.
- 20:04Thanks for joining us for this deep dive into
- 20:06the underlying mechanics of our digital world.
- 20:09Keep a close eye on your perimeter, test your
- 20:11patches before you push them, and we will see
- 20:13you next time.