Device-code phishing turns a legitimate login flow into rented access. The durable defense is to shrink who can use it.

The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.

We put a 30% chance on two public FCEB cases proving post-deadline edge exploitation by year-end.

A firewall, VPN, or secure-access gateway can hold much more than vulnerable code. It can mediate trusted sessions, store service-account credentials, expose configuration secrets, and connect external identities to internal systems. Once those artifacts leave the appliance, remediation becomes a trust-recovery problem—not only a software-maintenance task.

A lot of KEV response still collapses into one closure condition: the vulnerable system was patched. That works if exploitation never happened. It is weaker when the asset was exposed, telemetry is incomplete, or the system carries identity, remote-access, payment, or administrative authority.

AI gateways are starting to concentrate credentials, logs, routing, quotas, and policy. That makes them worth watching now.

China-linked operators are turning compromised routers into relay logistics. The defender move is behavior over bad IPs.