Security Alert: What Should Businesses Do as New Vulnerabilities Keep Emerging?

Just because a system is running normally doesn't mean it is secure.

Recently, many serious security vulnerabilities have been disclosed in operating systems, frameworks, software libraries and widely used technology platforms.

Some of these flaws let attackers run code remotely, take over servers, steal data or bring business operations to a halt. AI and automation tools are also making it faster for attackers to find and exploit vulnerabilities, and easier to do so across many systems at once.

A system can become exposed to new risks even if no one has touched its code. That is why businesses need to review, update and monitor their systems on a regular basis, rather than waiting until something goes wrong.

Recent critical vulnerabilities

None of these flaws were in code that businesses wrote themselves. They were in the platforms their applications are built on. A PHP or Next.js website that has run without problems for years can still be taken over within days of a vulnerability being made public.

1. Security risks businesses should be aware of

Businesses should pay special attention to the following systems:

• Systems that have run for many years with few updates
• Systems with no one responsible for maintenance
• Systems using software that has reached end of support
• Systems whose admin pages are reachable from the Internet
• Systems without monitoring or without backups

2. Seven measures businesses should take

① Inventory and assess your systems

The first step is knowing exactly what you are running:

• List the servers, applications, databases and cloud services in use.
• Record the versions of operating systems, frameworks and key libraries.
• Identify components that have reached end of support.
• Check which services are reachable from the Internet.
• Assign an owner to each system.

② Check for vulnerabilities regularly

• Scan operating systems, server software and application libraries for vulnerabilities.
• Review security settings and follow security notices from vendors.
• Cross-check against the CISA – Known Exploited Vulnerabilities Catalog (data on GitHub) to prioritize vulnerabilities that are already being exploited.
• Assess risk based on how easily a vulnerability can be exploited, how exposed the system is to the Internet and the impact on the business. The CVSS score is only one factor to consider.

③ Patch and update promptly

• Apply patches to operating systems, frameworks and libraries with vulnerabilities.
• Plan the replacement of components that have reached end of support.
• If you have a staging environment, test updates there before applying them to production.
• Check the system again after patching.
• Deal with critical vulnerabilities that are being actively exploited right away. If the vendor has not released a patch yet, you can reduce the risk by restricting access, disabling the affected feature or isolating the system from the network.

Note: Rolling out updates across the board without first assessing their impact can cause outages or compatibility problems.

④ Tighten access control

• Do not expose admin services to the Internet unless necessary.
• Restrict where SSH, databases and admin pages can be accessed from.
• Use a VPN or an equally secure access method.
• Enable multi-factor authentication, especially for admin accounts.
• Grant only the permissions each job needs, and revoke permissions that are no longer used.
• Store API keys, passwords and credentials securely, never in source code.
• Train employees to recognize phishing emails and account takeover tricks.

⑤ Monitor and alert on security events

Watch for warning signs such as unusual logins, unauthorized access, changes to important files, unknown accounts or processes, suspicious network connections and requests that look like attacks.

A SIEM solution (such as Wazuh) or an EDR tool can help. But a tool on its own is not enough: someone has to receive the alerts, analyze them and act on them.

⑥ Back up data and test restoration

• Set up automatic backups at a frequency that matches how important the data is.
• Keep backups separate from the production environment. If possible, use backups that cannot be modified or deleted, or offline backups.
• Restrict access to the backup system.
• Test data restoration regularly and define a recovery procedure for incidents.

Having backups is not the same as being able to recover. You only know a backup works once you have successfully restored from it.

⑦ Build an ongoing security management process

Detect → Assess risk → Prioritize → Fix → Verify → Monitor

Make it clear who tracks vulnerabilities, who assesses their impact, who fixes them, who confirms the fix and who coordinates the response when an incident occurs. For projects still under development, security checks should be built into the CI/CD pipeline.

3. Checklist: Is your business ready for security risks?

How to use this checklist

For any item you cannot tick yet, assess the risk and plan how to address it. Act immediately if any of the following apply: end-of-support software in use, vulnerabilities being actively exploited, admin services exposed to the Internet, no backups or untested restoration, or no one responsible for security.

This checklist is only for a preliminary self-assessment and does not replace an in-depth security audit.

4. Systems that have already been handed over

Many systems keep running for years after handover without any regular maintenance. Over that time, new vulnerabilities come to light, operating systems and frameworks reach end of support, older libraries stop being updated, and settings that once made sense no longer do.

A system that was secure at handover will not necessarily stay secure throughout its operation.

So even if no new features are planned, businesses still need to set aside budget and plan for security maintenance. Responsibilities also need to be clearly agreed between the development vendor, the infrastructure operator and the business that owns the system.

5. Conclusion: Security is ongoing work

No system is ever completely secure. But regularly reviewing vulnerabilities, keeping software up to date, controlling access, monitoring systems and backing up data all lower the risk of an attack and limit the damage if one does happen.

Start with these three priorities:

1. Check: Review your systems and find the vulnerabilities that could affect them.
2. Fix: Handle critical vulnerabilities first, especially those being actively exploited.
3. Maintain: Keep up regular maintenance, updates and monitoring.