TLDR Tech / InfoSec
CERT-In professes 12-hour patching for AI-assisted attacks
India's CERT-In has published new guidance urging defenders to "patch, mitigate, or remove exposure within 12 hours where feasible" for known-exploited bugs on internet-facing or crown-jewel systems, with a 24-hour window for critical (CVSS 9.0+) or exploited flaws on internal systems, framing the compressed timelines as a response to AI-assisted exploitation that shrinks the time adversaries need to weaponize vulnerabilities. The agency cites agentic AI and frontier models like Anthropic's Mythos and OpenAI's GPT-5.5 as accelerants that let attackers move from recon to data theft at machine speed across interconnected supply chains. Practitioners who spoke to The Register argued 12 hours is too short to fully test and deploy a patch but praised the emphasis on temporary mitigations such as isolation, access restriction, or disablement, which turn the deadline into a feasible containment strategy rather than a literal patch-completion clock.
Read the full story