URnetwork
•••

Notes on Internet Privacy

Posts and research from the URnetwork team and community.

RSS
News / AnalysisPhilippinesCanadaSouth AfricaUnited StatesNew ZealandUnited KingdomGeorgiaChinaFranceItalyDenmarkGreeceIrelandCyprusSpain

22 Seconds

Mandiant's M-Trends 2026 report, drawing on more than five hundred thousand hours of incident-response work in 2025, places the median time from initial network access to ransomware-affiliate handoff at twenty-two seconds — down from over eight hours in 2022. Roughly a thousandfold acceleration in three years. Today, Monday, May 4, 2026, the U.S. Cybersecurity and Infrastructure Security Agency was reportedly weighing reducing federal Known Exploited Vulnerabilities patch deadlines from two-to-three weeks to three days, citing AI-accelerated exploitation including Anthropic's Mythos Preview and OpenAI's GPT-5.4-Cyber. Today, Progress Software disclosed CVE-2026-4670 in MOVEit Automation — a CVSS 9.8 critical authentication bypass with approximately fourteen hundred publicly exposed instances and more than a dozen tied to U.S. state and local government. Today, Mistral launched Vibe Remote Agents on Mistral Medium 3.5: cloud-side autonomous coding at consumer scale, 128 billion-parameter dense model, 256K context, 77.6 percent on SWE-Bench Verified. Three news events on a single Monday. The cyber attack-economy has industrialized into a tight twenty-two-second pipeline. The federal patch-cadence has not caught up. The architectural counter is the user-controlled primitive stack — open-weight models on user hardware, federated Model Context Protocol with signed packages, FIDO2 hardware authentication, open-firmware hardware, self-hosted services, confidential-computing enclaves, privacy-preserving cryptocurrencies — that does not depend on patch cadence because it does not have the same patch surface.

URnetwork editorialSan Francisco — May 4, 2026

The metric

On Tuesday, March 24, 2026, Google Cloud's Mandiant unit published its M-Trends 2026 report — the annual incident-response benchmark drawing on more than 500,000 hours of incident-response work conducted by Mandiant analysts during calendar year 2025. Among the report's findings, one number stands out:

Twenty-two seconds.

That is the 2025 median time from initial-access-broker (IAB) compromise to ransomware-affiliate handoff. The metric measures the elapsed clock time between the moment an automated tool, exploit, or social-engineering call gives an initial-access broker a foothold in a target network, and the moment a separate operator — the ransomware affiliate — takes over to begin the encryption-and-exfiltration phase.

In 2022, the same metric was over eight hours. In 2023, "several hours." In 2024, approximately eleven minutes. In 2025, twenty-two seconds.

A roughly thousandfold acceleration in three years.

Mandiant's interpretation, per the report's text: the metric reflects "closer collaboration between initial access partners and secondary groups." In commercial-software terms, the IAB-to-affiliate market has industrialized: APIs are stable, formats are standardized, escrow is automated, and the human latency that previously bounded handoff time has been wrung out of the chain. The handoff happens at machine speed because both parties have matured into a productized exchange.

The cyber attack-economy is now a market. Twenty-two seconds is the market clearing time.

Today's three pegs

Three news events on Monday, May 4, 2026, demonstrate the cadence-gap operationally.

One. Reuters scoop, broadly republished today via Insurance Journal and other outlets: the U.S. Cybersecurity and Infrastructure Security Agency is reportedly weighing reducing federal Known Exploited Vulnerabilities patch deadlines from the current two-to-three week ceiling under Binding Operational Directive 22-01 to three days. Acting CISA chief Nick Andersen and National Cyber Director Sean Cairncross are reviewing the proposed change. The driver, per industry analysis: AI-accelerated exploitation including Anthropic's Mythos Preview and OpenAI's GPT-5.4-Cyber compresses the exploit-after-disclosure window from "months" to "hours." Industry quote pool.

Stephen Boyer, founder of Bitsight: "If you're going to protect civil agencies, you're going to have to move faster. We don't have as much of a window."

Kecia Hoyt, Vice President at Flashpoint: "Realistically, three days is simply impossible for some environments."

Nitin Natarajan, former CISA deputy director: "This is a signal to others that says, 'Hey, you need to do this more quickly.'"

CISA itself is operating with reduced capacity, depleted by deep job cuts and a 75-day Department of Homeland Security shutdown. The 3-day proposal is structurally novel; even if adopted, it sits two and a half orders of magnitude above the Mandiant-measured 22-second offensive ceiling.

Two. Progress Software disclosed CVE-2026-4670 in MOVEit Automation — a CVSS 9.8 critical authentication bypass — alongside CVE-2026-5174 (CVSS 7.7 privilege escalation). Affected versions: MOVEit Automation 2025.1.4, 2025.0.8, 2024.1.7, and earlier. Fixed in 2025.1.5, 2025.0.9, 2024.1.8. Approximately 1,400 MOVEit Automation instances are publicly exposed online; more than a dozen are tied to U.S. state and local government. The vulnerabilities were responsibly disclosed by Airbus SecLab researchers Anaïs Gantet, Delphine Gourdou, Quentin Liddell, and Matteo Ricordeau. No active exploitation has been reported at disclosure.

The historical precedent looms. The 2023 MOVEit Transfer flaw — a separate vulnerability in a different Progress Software product, exploited by the Clop ransomware operation — produced 2,100-plus organizational victims and an estimated $12 billion in cumulative losses across Shell, BBC, British Airways, the U.S. Department of Energy, the U.S. Department of Health and Human Services, and many others.

If the 2026 MOVEit Automation flaw enters mass exploitation at 2023 scale, the federal cadence cannot keep pace. The 1,400 exposed instances are concentrated, but each U.S. state-and-local-government instance brokers compliance reporting for systems that are themselves connected to identity, healthcare, payroll, and benefits infrastructure.

Three. Mistral launched Vibe Remote Agents on Mistral Medium 3.5. Cloud-side autonomous coding agents, multiple parallel sessions, command-line and Le Chat front-ends. Le Chat "Work Mode" debuts on the same model. Mistral Medium 3.5: 128 billion-parameter dense model, 256K context, 77.6 percent on SWE-Bench Verified, 91.4 on τ³-Telecom. Modified MIT license; weights downloadable from Hugging Face.

Vibe is the fourth major agentic-coding platform shipped in 2026 — after OpenAI Codex, Anthropic Claude Code, and Google Antigravity. Antigravity launched April 22 with a Pillar Security disclosure of a sandbox-escape RCE on the same day, via prompt injection through the find_by_name Pattern parameter into fd utility flags, bypassing Antigravity Secure Mode.

Capability is shipping at consumer-software cadence. Regulatory response — the Five Eyes' first joint guidance on agentic AI security, released May 1 — is advisory and three days old.

What "recovery denial" means

Mandiant's M-Trends 2026 report names a structural shift in ransomware operator behavior beyond the 22-second metric. Operators have moved beyond dual-threat (encrypt-and-steal) to a third-stage architecture the report calls "recovery denial."

The pattern: after the IAB-to-affiliate handoff, operators systematically target identity services, virtualization management planes, and backup infrastructure. The objective is not data exfiltration alone, nor encryption alone, but to deny the victim organization the ability to restore operations. Identity services compromise blocks user authentication. Virtualization management compromise prevents disaster-recovery failover. Backup infrastructure compromise blocks restoration.

The pattern surfaces operationally in the May 1-4 window.

The cPanel "Sorry" ransomware campaign uses ChaCha20 encryption with an embedded attacker-side RSA-2048 public key. Decryption requires the attacker's RSA-2048 private key. Restoration without payment is not feasible.

The Trellix source-code repository breach on May 2 enables future recovery-denial scenarios by exposing detection-evasion patterns and signature definitions to whoever exfiltrated the source code. Trellix is the cybersecurity firm formed by the 2022 merger of McAfee Enterprise and FireEye, owned by Symphony Technology Group.

The Instructure / Salesforce vector pivots through a third-party SaaS to bypass customer-side recovery planning entirely. Most schools using Instructure Canvas LMS have no contractual visibility into Instructure's Salesforce instance; recovery from a Salesforce-pivot breach requires Instructure's cooperation and Salesforce's permission, neither of which the customer controls.

The Wasabi Protocol deployer-key drain on April 30 used UUPS proxy upgrades to replace vault implementations across four blockchains — Ethereum, Base, Berachain, and Blast — defeating any in-protocol recovery primitive. The deployer EOA, wasabideployer.eth, held the sole ADMIN_ROLE; granted it to an attacker contract; the attacker performed the upgrade; a fake strategyDeposit() call drained the vaults. No timelock. No multisig. The recovery surface was the protocol's own admin key.

The 22-second metric is the access cadence. Recovery denial is the post-access architecture.

The Sorry ransomware floor

The cPanel CVE-2026-41940 case study illustrates the cadence-gap operationally.

The vulnerability — a CVSS 9.8 pre-authentication bypass via CRLF injection — has been actively exploited in the wild since at least February 23, 2026, per KnownHost CEO Daniel Pearson. cPanel patched on April 28. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on April 30 with an unusually short two-day federal patch deadline of May 3.

By Saturday, May 2, the "Sorry" ransomware family was live and mass-exploiting the bug. Censys's May 2 telemetry: 15,448 cPanel/WHM hosts engaged in malicious activity — 79.99 percent of all GreyNoise-tagged malicious hosts that day, up from 146 the day before. By Sunday, May 3, approximately 2,000 instances had been compromised.

By Monday, May 4 — today — the federal patch deadline had lapsed. TechCrunch reported continued exploitation: hackers are still exploiting the cPanel bug to gain control of thousands of websites.

Three independent threat clusters share the same CVE. The "Sorry" ransomware campaign with .sorry file extension and Tox-messenger ransom contact. The Mirai variant nuclear.x86, deployed for cryptominer and DDoS botnet capacity. A nation-state-style espionage campaign tracked by Ctrl-Alt-Intel from IP 95.111.250.175 against .mil.ph, .gov.la, and managed-service providers in the Philippines, Laos, Canada, South Africa, and the United States.

Sixty-four days as zero-day. Two-day federal deadline. Three days of post-deadline exploitation. ~1.5 million cPanel instances exposed online; ~70 million domains potentially affected. The patch cadence is the federal cadence; the exploitation cadence is the criminal-state cadence; they do not converge.

Copy Fail and AI-driven discovery

On Friday, May 1, 2026, CISA added CVE-2026-31431 — "Copy Fail" — to the Known Exploited Vulnerabilities catalog with a federal patch deadline of May 15. The Linux kernel algif_aead/AF_ALG cryptographic-template logic flaw is a 9-year-old bug introduced through in-place crypto changes in 2011, 2015, and 2017. A 732-byte Python proof-of-concept yields root through setuid binaries.

The bug affects every Linux distribution shipped since 2017: Ubuntu (including 24.04 LTS), Amazon Linux 2023, RHEL 10.1, SUSE 16, Debian, Fedora, Arch. Container-affecting: Docker, LXC, and Kubernetes grant containers AF_ALG by default. Mainline kernel fix April 1; first vendor patches landed across Debian / Ubuntu / AlmaLinux around May 1.

Microsoft Defender added signatures Exploit:Linux/CopyFailExpDl.A, Exploit:Python/CopyFail.A, Exploit:Linux/CVE-2026-31431.A the same day. Microsoft Security blog, May 1: "preliminary testing activity that might result most likely in increased threat actor exploitation over the next few days."

Critically: the bug was discovered by Theori using its Xint AI pentesting platform. The same kind of AI-driven vulnerability-discovery capability that Anthropic's Mythos Preview demonstrated April 7 — and that Vidoc Security Lab reproduced on April 14 on eight small open-weight models, one with only 3.6 billion active parameters at $0.11 per million tokens.

AI-driven vulnerability discovery is now a consumer-API commodity. The cost floor of $0.11 per million tokens means small organizations can afford state-grade cyber-discovery infrastructure. The Glasswing controlled-access framework — Anthropic's restricted-access program for Mythos with approximately 40 vetted partners and up to $100 million in usage credits — cannot bound capability when capability commodifies. Theori discovered Copy Fail. Other research groups discovered other bugs in other operating systems and frameworks at similar cost. The discovery cadence has industrialized in parallel with the exploitation cadence.

Five Eyes' first word

On Friday, May 1, 2026, the Five Eyes intelligence partnership — the U.S. Cybersecurity and Infrastructure Security Agency, the U.S. National Security Agency, the Australian Signals Directorate's Australian Cyber Security Centre, the Canadian Centre for Cyber Security, the New Zealand National Cyber Security Centre, and the United Kingdom National Cyber Security Centre — released its first coordinated multi-agency joint guidance on agentic AI security: "Careful Adoption of Agentic AI Services."

Five risk categories named: privilege escalation across agent tools; design and configuration flaws; behavioral risks (prompt injection and goal hijacking); structural risks (multi-agent failures and emergent collusion); accountability gaps.

The guidance text: "Until security practices, evaluation methods and standards mature, organisations should assume that agentic AI systems may behave unexpectedly and plan deployments accordingly, prioritising resilience, reversibility and risk containment over efficiency gains."

Recommendations: zero-trust architecture, defense-in-depth, least privilege, cryptographically secured agent identities, short-lived credentials, encryption in transit and at rest, human approval for high-impact actions, prompt-injection defenses.

Three days after publication, today, Mistral shipped Vibe Remote Agents. The capability cadence is consumer-software-fast. The regulatory cadence is committee-slow.

The supply chain (April 22 - May 1)

The ten-day window from April 22 through May 1 produced six independent supply-chain disclosures.

April 22 (three on a single Wednesday). OX Security disclosed a systemic Anthropic Model Context Protocol design vulnerability across all SDK languages — Python, TypeScript, Java, Rust — affecting approximately 200,000 servers per The Register, with nine of eleven MCP marketplaces poisoned. Pillar Security disclosed an Antigravity sandbox-escape remote code execution in Google's new agentic IDE. The Shai-Hulud Third Coming campaign by TeamPCP dropped a backdoored @bitwarden/[email protected] on npm — live for approximately 1.5 hours — and for the first time on record weaponized .claude/settings.json and .vscode/tasks.json as AI-coding-assistant persistence mechanisms.

April 29 (Mini Shai-Hulud). TeamPCP extended its supply-chain campaign to four SAP-related npm packages: mbt 1.2.48, @cap-js/db-service 2.10.1, @cap-js/postgres 2.2.2, @cap-js/sqlite 2.2.2. Combined approximately 500,000 weekly downloads; live for two to four hours. The malicious preinstall hook fetches an obfuscated Bun binary that harvests local credentials, GitHub and npm tokens, GitHub Actions secrets, AWS/Azure/GCP/Kubernetes/HashiCorp Vault secrets, and browser-stored credentials. Exfiltration is to victim-owned GitHub repositories titled "A Mini Shai-Hulud has Appeared." A Russian-language system check terminates the malware if Russian is detected.

April 30 (PyPI extension). PyTorch Lightning 2.6.2 and 2.6.3 were quarantined 42 minutes after publish.

May 1 (Bitwarden CLI variant). Continued TeamPCP campaign activity.

The TeamPCP campaign's full timeline: it began February 27, 2026, via misconfigured pull_request_target in Aqua Security's Trivy. Compromised the aqua-bot Personal Access Token. Pivoted to trivy-action, setup-trivy, v0.69.4, malicious Docker Hub images. On March 24, used the compromised Trivy action to exfiltrate the LiteLLM PyPI publish token. Published litellm==1.82.7 and 1.82.8 for approximately 40 minutes. By mid-April, approximately 500,000 credentials stolen. Vect ransomware listed its first victim on April 15: "approximately 4 million emails and 700 GB of data."

The defender layer is the developer toolchain. The developer toolchain is the supply chain. The supply chain has been compromised at industrial scale.

Defender-side compromise

On Saturday, May 2, 2026, Trellix — the cybersecurity firm formed by the 2022 merger of McAfee Enterprise and FireEye, owned by Symphony Technology Group — disclosed unauthorized access to a portion of its source-code repository. No attribution. No customer-data scope confirmed. Trellix statement: "Based on our investigation to date, we have found no evidence that our source code release or distribution process was affected, or that our source code has been exploited."

The cybersecurity-firm-hacked beat is recurring. FireEye in December 2020 (Russian-linked APT; Red Team tooling stolen). Vercel/Context.ai on April 19, 2026 (Lumma Stealer at Context.ai; Google Workspace OAuth pivot). Trellix on May 2, 2026.

The same week, May 1, two former U.S. cybersecurity professionals were sentenced. Ryan Goldberg (40, Georgia, former Sygnia incident-response manager) — four years. Kevin Martin (36, Texas, former DigitalMint negotiator) — four years. The charges: deploying ALPHV/BlackCat ransomware between April and December 2023, taking 20 percent of approximately $1.2 million in Bitcoin ransoms.

Defenders compromised. Defenders prosecuted. The same week.

Canvas, 275 million

On Sunday, May 3, 2026, ShinyHunters listed Instructure on its data-extortion site with a May 6 deadline — three days from now. Claimed scope: 275 million individuals (240 to 275 million records); 3.65 terabytes of data; approximately 9,000 schools globally. Compromised data per Instructure's own disclosure: names, email addresses, student IDs, and user-to-user messages including private student-teacher conversations. Not compromised: passwords, dates of birth, government IDs, financial data. ShinyHunters claims access to Instructure's Salesforce instance.

The Instructure / Canvas Learning Management System breach is the largest single LMS breach ever reported. The vector — third-party SaaS pivot via Salesforce — is the same that produced Rockstar Games (78.6 million records, April 14), Vimeo via Anodot (April 28), Marcus & Millichap (30 million-plus alleged), Amtrak (9.4 million Salesforce records claimed), and McGraw-Hill (13.5 million unique emails released).

The "Salesforce decade" continues. The third-party-SaaS pivot is the recurring vector that bypasses customer-side defense.

The DOJ's $701 million day

On Friday, May 1, 2026, the U.S. Department of Justice announced the takedown of nine Southeast Asian cryptocurrency-fraud compounds. Two hundred seventy-six arrests. $701 million in cryptocurrency restrained. Coordination among the Department of Justice, the Federal Bureau of Investigation, the Dubai Police Department, and the Chinese Ministry of Public Security — a rare instance of U.S.-China cybercrime cooperation.

Operation Level Up, launched January 2024, has notified approximately 9,000 victims of cryptocurrency investment fraud and saved an estimated $562 million by alerting victims before transfers completed. The Southern District of California unsealed criminal complaints in April 2026 against alleged scam-organization managers Awang, Chandra, Mariam, and a fugitive co-defendant of the Sanduo Group and Giant Company organizations; a March 2026 grand-jury indictment named Thet Min Nyi and a fugitive co-defendant on wire-fraud-conspiracy and money-laundering-conspiracy counts.

The FBI San Diego field office announced a State Department reward of up to $10 million for information leading to the Tai Chang scam center, and seized malicious domains used by the compound.

Pig-butchering global losses are estimated at $5 billion to $7 billion annually per industry analyses.

The DOJ's coordination effort is at human-time scale: months of investigation, indictment, and coordination. The cyber attack-economy operates at machine-time scale: 22-second IAB-to-affiliate handoff. Enforcement is structurally retrospective; the cadence gap is structurally prospective. Both matter; neither closes.

The phishing industrial park

Five phishing-as-a-service ecosystems documented across April-May 2026 illustrate the industrial scale of social-engineering tooling.

Cordial Spider (also tracked as BlackFile / CL-CRI-1116 / O-UNC-045 / UNC6671) and Snarky Spider (O-UNC-025 / UNC6661) deploy vishing followed by single-sign-on adversary-in-the-middle attacks against SaaS data-exfiltration targets — SharePoint, HubSpot, Google Workspace, Salesforce. Active since October 2025. Snarky Spider is tied to "The Com." Routing through Mullvad, Oxylabs, NetNut, 9Proxy, Infatica, and NSOCKS residential proxies. Seven-figure extortion demands.

ConsentFix v3, profiled by Push Security: automated Microsoft Azure CLI and Entra ID OAuth abuse; Cloudflare Pages-styled lure; refresh tokens with 90-day lifetimes delivered into the operator's "Specter Portal."

FEMITBOT: Telegram bots plus WebView Mini Applications deliver cryptocurrency scams and Android malware; impersonates Apple, Coca-Cola, Disney, and IBM brand identities; the standard onboarding response is "Welcome to join the FEMITBOT platform."

Bluekit: a phishing-as-a-service kit with more than 40 adversary-in-the-middle templates targeting iCloud, Apple ID, Gmail, Outlook, Yahoo, ProtonMail, GitHub, Twitter, Zoho, and Ledger; voice cloning; anti-bot cloaking.

AccountDumpling: Vietnamese-linked; ~30,000 Facebook business accounts compromised by abusing Google AppSheet as a phishing relay. The phishing emails pass SPF, DKIM, and DMARC authentication checks because they are delivered from Google's own infrastructure. Researcher Shaked Chen of Guardio: "a living operation with real-time operator panels, advanced evasion, continuous evolution and a criminal-commercial loop that quietly feeds on the same accounts it helps steal back."

Each platform addresses a different victim segment with the same productized approach. Industrialized phishing tooling distributed at consumer-software cadence.

Wasabi Protocol's deployer-key floor

On Thursday, April 30, 2026, the Wasabi Protocol perpetuals trading platform was drained for approximately $4.5-5.5 million across Ethereum, Base, Berachain, and Blast. The compromised deployer EOA wasabideployer.eth granted ADMIN_ROLE to an attacker contract; UUPS proxy upgrades replaced the vault implementations on PerpManager and LongPool; a fake strategyDeposit() call triggered the drain via a malicious strategy contract. No timelock and no multisig were configured on the admin role.

The Wasabi exploit is the third in a 2026 series of admin-key compromises. April 1: Drift Protocol drained for $285 million in a six-month DPRK-linked social-engineering operation against multisig signers, exploiting Solana durable-nonce abuse. April 18: Kelp DAO drained for $292 million in a LayerZero rsETH bridge exploit attributed to North Korea's TraderTraitor. April 30: Wasabi Protocol's deployer-EOA route.

Per DefiLlama, April 2026 was the most-hacked month in DeFi history: approximately 28 to 30 incidents totaling more than $635 million in losses; cumulative 2026 DeFi losses now exceed $770 million. Per TRM Labs (April 30), North Korea's TraderTraitor operations alone account for 76 percent of 2026 crypto-hack value with two attacks.

Privileged keys without timelocks defeat all in-protocol recovery. The cadence-gap argument extends to DeFi: by the time the protocol governance can vote on a recovery measure, the funds are bridged, mixed, and laundered.

The architectural counter

If the offensive cadence ceiling is 22 seconds and the proposed defensive floor is 3 days, the gap is structural and cannot be closed by accelerating federal patching alone. The architectural counter is the user-controlled primitive stack that does not depend on patch cadence — because it does not have the same patch surface.

Open-weight models on user hardware. The defender's capability commodifies in parallel with the attacker's. DeepSeek V4 Pro (1.6 trillion parameters, 49 billion active, 1 million-token context, MIT-style license) released April 24. Mistral Medium 3.5 (128 billion dense, 256K context, modified MIT, 77.6 percent SWE-Bench Verified) released April 29; today extended with Vibe Remote Agents. OpenAI Privacy Filter (1.5 billion sparse mixture-of-experts, 50 million active, 96 percent F1 on PII-Masking-300k) released April 22 under Apache 2.0. Llama 3.3, Qwen 3, GPT-OSS. Run on Ollama. Run on user hardware. Vidoc reproduced Mythos-class capability at $0.11 per million tokens; defenders can do the same. Local fine-tuning for organization-specific defense is now operationally feasible.

Federated Model Context Protocol with signed packages and per-organization patch cadence. The Shai-Hulud / Mini Shai-Hulud / TeamPCP campaigns demonstrate that centralized package registries (npm, PyPI, Docker Hub) are the attack surface. Federated MCP with signed packages and per-organization patch cadence routes around the centralized surface. The patch cadence becomes organization-controlled.

End-to-end encryption with user-held keys. Signal, Proton, Tuta, Threema, Matrix with per-device cross-signing. The cryptographic property is that the service operator cannot produce the plaintext regardless of patch surface, regulatory pressure, or supply-chain compromise. What the operator does not hold cannot be compelled.

Federated identity with selective disclosure. eIDAS 2.0 European Union Digital Identity Wallets, with the December 31, 2026 compliance deadline. France Identité, Italy IT Wallet, Denmark, Greece, Ireland, Cyprus, Spain. W3C Verifiable Credentials Data Model v2.0; W3C Decentralized Identifiers v1.1. Prove specific claims without revealing underlying documents.

Peer-to-peer transport. URnetwork residential-node relay. Tor Browser 15.0.11 with Snowflake / obfs4 / meek pluggable transports. Shadowsocks, V2Ray, Trojan, NaïveProxy. WireGuard at 94 percent consumer-VPN deployment standard. Defeats commercial-VPN-detection signatures and carrier-mediated state-internet tier systems.

FIDO2 hardware authentication. YubiKey, Nitrokey, SoloKey. Hardware keys replace SMS-based multi-factor authentication, which the SS7/Diameter Citizen Lab corpus has demonstrated is operationally penetrated. The credential is on the user's hardware; SIMjacker, vishing, and AiTM phishing cannot reach it.

Open-firmware hardware. GrapheneOS on compatible Pixel devices — approximately 400,000 active users. Motorola partnership announced March 2026 ends Pixel exclusivity for 2027 lineup. LineageOS on other Android hardware. OpenWRT on routers.

Self-hosted services. Matrix homeserver replaces Discord or Slack. Nextcloud replaces Google Drive or Microsoft OneDrive. Forgejo or Gitea replaces GitHub. Jitsi replaces Zoom. Mailcow replaces commercial-operator email. Ollama with LangChain, LlamaIndex, and federated MCP replaces commercial-API AI inference. The blast radius of vendor-side compromise — Trellix, Vercel/Context.ai, Anodot/Salesforce, Instructure — is bounded.

Confidential-computing enclaves. Azure Confidential Computing, AWS Nitro Enclaves, Google Cloud Confidential Computing, Enveil, Opaque. Plus federated-analysis frameworks: DataSHIELD, Vantage6, OHDSI, Flower, PySyft. Compute on encrypted data; operator does not see plaintext.

Privacy-preserving cryptocurrencies. Bitcoin Core 27.0 with BIP324 v2 encrypted P2P transport (default) and BIP352 Silent Payments (merged early 2026). Monero FCMP++ on testnet since October 3, 2025; cryptographic key audit running May 11-22; mainnet hard-fork tentatively mid-2026; anonymity set leaping from 16 to approximately 152-158 million outputs. Zcash with shielded-by-default. Outside the operator-policed stablecoin pathway that Tether's $344 million USDT freeze and OFAC's first-ever direct designation of Central Bank of Iran-linked addresses on-chain (Operation Economic Fury) demonstrate as a sanctions-compliance instrument.

Each layer ships today. None depends on patch cadence because none has a vendor-patch surface in the same shape.

Three clocks

June 12, 2026. Section 702 of the Foreign Intelligence Surveillance Act sunset. The 45-day clock from the April 30 clean extension. Today is Day 4. Forty-one days remain. The fifth procedural extension is procedurally available; the structural reform — Massie-Boebert H.R. 8470, Lee-Wyden Government Surveillance Reform Act, Lee-Durbin SAFE Act — has not reached the floor.

Approximately May 15, 2026. The Cotton-Warner declassification commitment for the Foreign Intelligence Surveillance Court's March 17 opinion documenting "serious abuses" in FBI U.S.-person queries via filter tools. Today is Day 4 of the 15-day window. Eleven days remain.

August 2, 2026. The European Union's General-Purpose AI enforcement go-live under the AI Act. Ninety days remain. The Digital Omnibus second trilogue collapsed April 28; the next trilogue under Cypriot Presidency is approximately May 13. The original deadline legally stands.

The clocks are policy-cadence clocks. They run at the cadence of trilogues, declassification reviews, and statutory sunsets. The 22-second clock runs in parallel — at the cadence of the IAB-to-affiliate market.

The user-controlled primitive stack does not run on either clock.

The cadence asymmetry

The Mandiant M-Trends 2026 metric of 22 seconds is the offensive cadence ceiling of the cyber attack-economy. The U.S. Cybersecurity and Infrastructure Security Agency's reportedly proposed 3-day Known Exploited Vulnerabilities patch deadline is the federal defensive cadence floor, if it is adopted. Twenty-two seconds. Three days. A factor of approximately twelve thousand.

The gap is structural. The 3-day proposal acknowledges the AI-accelerated attack reality but cannot bridge to 22-second handoffs. Even an aggressive 1-day federal patch deadline would still sit three orders of magnitude above the attack ceiling.

The federal-patch architecture is a procurement architecture. Procurement requires vendor disclosure, federal verification, distribution to agencies, agency-specific patching, validation, rollback planning. These steps cannot be compressed below operational thresholds set by large heterogeneous environments. Even CISA's most aggressive proposal sits structurally above the attack ceiling.

The user-controlled primitive stack does not have a federal-procurement architecture. End-to-end encryption with user-held keys does not require a vendor patch when the server does not have plaintext. Federated MCP with signed packages closes the npm/PyPI/Docker supply-chain surface. FIDO2 hardware authentication does not require SS7 to be secure. GrapheneOS does not require carrier cooperation. Self-hosted services do not require a SaaS provider's patch cadence to align with the user's risk tolerance.

The user's stack does not compete with the attack-economy on patch-cadence terms. The user's stack competes on architecture-of-deployment terms. At the architecture-of-deployment level, the user's stack already contains the necessary primitives.

The cycle

April 22: three independent AI-supply-chain disclosures on a single Wednesday. April 24: Google announces a $40 billion investment in Anthropic. April 28: cPanel patches CVE-2026-41940. April 29: Mini Shai-Hulud SAP/npm wave. April 30: Wasabi Protocol drained; PyTorch Lightning compromised; CISA adds cPanel CVE-2026-41940. May 1: CISA adds Linux Copy Fail; Five Eyes joint guidance; DOJ announces $701M takedown; Goldberg + Martin sentenced; Instructure breach disclosed. May 2: Trellix source-code breach; cPanel "Sorry" mass-exploitation begins. May 3: ShinyHunters lists Instructure (May 6 deadline; 275M users); cPanel federal patch deadline lapses. Today, May 4: MOVEit Automation CVE-2026-4670 disclosed; Mistral Vibe Remote Agents launched; CISA reportedly weighing 3-day KEV deadline.

The cycle is the news cycle. The 22-second metric is the underlying market clearing time. The cycle does not slow when the regulator considers a 3-day floor, because the cycle is operating at machine speed and the regulator is operating at human speed.

The cyber attack-economy has industrialized into a tight 22-second pipeline. The federal patch-cadence has not caught up. The architectural counter is the user-controlled primitive stack that does not have a patch cadence because it does not have the same patch surface. Open weights ship today. Federated MCP ships today. End-to-end encryption ships today. Federated identity ships today. Peer-to-peer transport ships today. FIDO2 hardware ships today. Open-firmware hardware ships today. Self-hosted services ship today. Confidential-computing enclaves ship today. Privacy-preserving cryptocurrencies ship today.

The architectural alternative was already deployable yesterday. It is deployable today. It will be deployable tomorrow. None of the deployment depends on a 3-day federal patch deadline being adopted. None of the deployment depends on the next trilogue resolving. None of the deployment depends on the FISC March 17 opinion declassification meeting May 15. None of the deployment depends on Section 702 reform reaching the House floor before June 12.

22 seconds is the attack market's clearing time. The user-controlled primitive stack does not have a market clearing time, because it does not have a market.

The cyber cadence catches up. The architectural alternative does not have to.

References

References (selected)

  • Help Net Security, March 24, 2026: "Attackers are handing off access in 22 seconds, Mandiant finds." https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/
  • SecurityWeek, March 24, 2026: "M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds." https://www.securityweek.com/m-trends-2026-initial-access-handoff-shrinks-from-hours-to-22-seconds/
  • Google Cloud Blog, March 24, 2026: "M-Trends 2026: Data, Insights, and Strategies From the Frontlines." https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
  • Insurance Journal / Reuters, May 4, 2026: "CISA Considering Three-Day Patch Deadline." https://www.insurancejournal.com/news/national/2026/05/04/868205.htm
  • BleepingComputer, May 4, 2026: "MOVEit Automation customers warned to patch critical auth bypass flaw." https://www.bleepingcomputer.com/news/security/moveit-automation-customers-warned-to-patch-critical-auth-bypass-flaw/
  • Help Net Security, May 4, 2026: "Critical MOVEit Automation auth-bypass vulnerability fixed (CVE-2026-4670)." https://www.helpnetsecurity.com/2026/05/04/critical-moveit-automation-auth-bypass-vulnerability-fixed-cve-2026-4670/
  • Mistral, May 4, 2026: "Vibe Remote Agents and Mistral Medium 3.5." https://mistral.ai/news/vibe-remote-agents-mistral-medium-3-5
  • CISA, May 1, 2026: "CISA Adds One Known Exploited Vulnerability to Catalog" (Copy Fail). https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog
  • The Hacker News, May 2026: "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV." https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html
  • Microsoft Security Blog, May 1, 2026: "CVE-2026-31431 'Copy Fail' Vulnerability Enables Linux Root Privilege Escalation." https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/
  • TechCrunch, May 4, 2026: "Hackers are still exploiting the cPanel bug to gain control of thousands of websites." https://techcrunch.com/2026/05/04/hackers-are-still-exploiting-the-cpanel-bug-to-gain-control-of-thousands-of-websites/
  • Help Net Security, May 4, 2026: "Multiple threat actors actively exploit cPanel vulnerability (CVE-2026-41940)." https://www.helpnetsecurity.com/2026/05/04/multiple-threat-actors-actively-exploit-cpanel-vulnerability-cve-2026-41940/
  • Censys: "The cPanel Situation Is..." https://censys.com/blog/the-cpanel-situation-is/
  • BleepingComputer: "Critical cPanel flaw mass-exploited in 'Sorry' ransomware attacks." https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
  • CISA: "CISA, U.S. and International Partners Release Guide on Secure Adoption of Agentic AI." https://www.cisa.gov/news-events/news/cisa-us-and-international-partners-release-guide-secure-adoption-agentic-ai
  • The Hacker News, May 2026: "Trellix Confirms Source Code Breach." https://thehackernews.com/2026/05/trellix-confirms-source-code-breach.html
  • BleepingComputer: "Instructure confirms data breach, ShinyHunters claims attack." https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/
  • The Hacker News, May 2026: "Two Cybersecurity Professionals Get 4 Years for ALPHV/BlackCat." https://thehackernews.com/2026/05/two-cybersecurity-professionals-get-4.html
  • DOJ Press Release, May 1, 2026: "Coordinated Takedown of Scam Centers Leads to At Least 276 Arrests." https://www.justice.gov/opa/pr/coordinated-takedown-scam-centers-leads-least-276-arrests-alleged-managers-and-recruiters
  • The Hacker News, May 2026: "Global Crackdown Arrests 276, Shuts 9 Crypto Scam Centers, Seizes $701M." https://thehackernews.com/2026/05/global-crackdown-arrests-276-shuts-9.html
  • The Hacker News, April 2026: "SAP npm Packages Compromised by Mini Shai-Hulud." https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html
  • Wiz: "Mini Shai-Hulud Supply-Chain Attack on SAP npm Packages." https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm
  • Endor Labs: "Shai-Hulud The Third Coming." https://www.endorlabs.com/learn/shai-hulud-the-third-coming
  • The Hacker News: "Cybercrime Groups Using Vishing and SSO." https://thehackernews.com/2026/05/cybercrime-groups-using-vishing-and-sso.html
  • Guardio: "AccountDumpling — Hunting Down the Google-Sent Phishing Wave Compromising 30,000 Facebook Accounts." https://guard.io/labs/accountdumpling-hunting-down-the-google-sent-phishing-wave-compromising-30-000-facebook-accounts
  • BleepingComputer: "Telegram Mini Apps abused for crypto scams, Android malware delivery." https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/
  • CoinDesk, April 30, 2026: "Wasabi Protocol drained for $4.5 million in apparent admin key compromise." https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise
  • Vidoc Security Lab: "We Reproduced Anthropic's Mythos Findings With Public Models." https://blog.vidocsecurity.com/blog/we-reproduced-anthropics-mythos-findings-with-public-models
  • Anthropic, April 7, 2026: "Project Glasswing." https://www.anthropic.com/glasswing
  • Crowdfund Insider, May 2026: "DeFi Hacks Report — April 2026 becomes most-hacked month in crypto history." https://www.crowdfundinsider.com/2026/05/276717-defi-hacks-report-april-2026-becomes-most-hacked-month-in-crypto-history-by-number-of-incidents/
  • TRM Labs, April 30, 2026: "North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks." https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks
  • Bitcoin Optech: BIP324 v2 P2P Transport. https://bitcoinops.org/en/topics/v2-p2p-transport/
  • Bitcoin Optech: Silent Payments. https://bitcoinops.org/en/topics/silent-payments/
  • Department of War, May 1, 2026: "Department of Defense AI Agreements" (today's first edition lead context). https://www.war.gov/News/Releases/Release/Article/4475177/classified-networks-ai-agreements/

Further Discussion

22 Seconds

Twenty-two seconds. That is the 2025 median time, per Google Cloud's Mandiant unit and its M-Trends 2026 report drawing on more than five hundred thousand hours of incident response, between an initial-access broker compromising a target network and a ransomware affiliate taking over for the encryption-and-exfiltration phase. In 2022, the same metric was over **eight hours**. In 2023, "several hours." In 2024, approximately **eleven minutes**. In 2025, twenty-two seconds. A roughly thousandfold acceleration in three years. Mandiant's interpretation: *"closer collaboration between initial access partners and secondary groups."* The cyber attack-economy has industrialized into a productized exchange. Twenty-two seconds is the market clearing time. Today, Monday, May 4, 2026, the U.S. Cybersecurity and Infrastructure Security Agency was reportedly weighing reducing federal Known Exploited Vulnerabilities patch deadlines from the current two-to-three-week ceiling to **three days**. Acting CISA chief Nick Andersen and National Cyber Director Sean Cairncross are reviewing the change. Stephen Boyer, founder of Bitsight: *"If you're going to protect civil agencies, you're going to have to move faster. We don't have as much of a window."* Kecia Hoyt, Vice President of Flashpoint: *"Realistically, three days is simply impossible for some environments."* Nitin Natarajan, former CISA deputy director: *"This is a signal to others that says, 'Hey you need to do this more quickly.'"* Today, Progress Software disclosed CVE-2026-4670 in MOVEit Automation — a CVSS 9.8 critical authentication bypass with approximately fourteen hundred publicly exposed instances and more than a dozen tied to U.S. state and local government. The 2023 MOVEit Transfer flaw — exploited by Clop ransomware — produced approximately twenty-one hundred organizational victims and twelve billion dollars in cumulative losses across Shell, BBC, British Airways, the Department of Energy, the Department of Health and Human Services. The 2026 MOVEit Automation flaw enters its first day of public exposure. Today, Mistral launched Vibe Remote Agents on Mistral Medium 3.5 — cloud-side autonomous coding agents at consumer scale, 128 billion-parameter dense, 256K context, 77.6 percent on SWE-Bench Verified, modified MIT, weights downloadable. Four major agentic-coding platforms shipped in 2026: OpenAI Codex, Anthropic Claude Code, Google Antigravity (April 22, with a Pillar Security sandbox-escape RCE disclosed the same day), Mistral Vibe (today). Capability is shipping at consumer-software cadence. The Five Eyes intelligence partnership released its first joint guidance on agentic AI security on May 1: *"organisations should assume that agentic AI systems may behave unexpectedly and plan deployments accordingly, prioritising resilience, reversibility and risk containment over efficiency gains."* Three days later — today — Mistral shipped Vibe. Per Mandiant, operators have moved beyond dual-threat (encrypt + steal) to a third architecture: **recovery denial.** Operators systematically target identity services, virtualization management planes, and backup infrastructure to deny organizations the ability to restore. The cPanel "Sorry" ransomware campaign uses ChaCha20 with an embedded attacker-side RSA-2048 public key — decryption requires the attacker's private key. The Trellix source-code repository breach on May 2 exposes detection-evasion patterns. The Instructure / Salesforce vector pivots through third-party SaaS to bypass customer-side recovery. The Wasabi Protocol deployer-key drain on April 30 used UUPS proxy upgrades to defeat any in-protocol recovery. The cPanel CVE-2026-41940 case study illustrates the cadence-gap operationally. Exploited in the wild since at least February 23, 2026 — sixty-four days as zero-day. cPanel patched April 28. CISA KEV-listed April 30 with an unusually short two-day federal patch deadline. Federal deadline lapsed May 3. By May 4 — today — TechCrunch reports continued exploitation; approximately two thousand instances compromised in the "Sorry" ransomware campaign; ~1.5 million cPanel instances exposed online; ~70 million domains potentially affected. Three independent threat clusters share the same CVE: "Sorry" ransomware, Mirai variant `nuclear.x86` (cryptominer + DDoS), and a nation-state-style espionage campaign tracked by Ctrl-Alt-Intel from IP 95.111.250.175 against `.mil.ph`, `.gov.la`, and managed-service providers in five countries. The TeamPCP supply-chain campaign began February 27, 2026, via a misconfigured `pull_request_target` in Aqua Security's Trivy. Compromised the `aqua-bot` Personal Access Token. Pivoted to `trivy-action`, `setup-trivy`, malicious Docker Hub images. On March 24, exfiltrated the LiteLLM PyPI publish token. By mid-April, **approximately 500,000 credentials stolen.** Vect ransomware listed first victim April 15: "approximately 4 million emails and 700 GB of data." On April 22, the Shai-Hulud Third Coming campaign weaponized `.claude/settings.json` and `.vscode/tasks.json` as AI-coding-assistant persistence mechanisms — the first known supply-chain attack to weaponize AI-coding-agent configs. April 29-30, Mini Shai-Hulud extended to four SAP-related npm packages and PyTorch Lightning's PyPI release. April 22 produced three independent AI-supply-chain disclosures on a single Wednesday. OX Security: systemic Anthropic Model Context Protocol design vulnerability across Python, TypeScript, Java, Rust SDK languages, affecting 200,000 servers per The Register, with nine of eleven MCP marketplaces poisoned. Pillar Security: Antigravity sandbox-escape RCE via prompt injection through `find_by_name` Pattern arguments. Shai-Hulud Third Coming: backdoored `@bitwarden/[email protected]` weaponizing AI-coding-assistant configs. Defenders compromised. May 2: Trellix source-code repository breach. May 1: two former U.S. cybersecurity professionals — Ryan Goldberg (40, Georgia, former Sygnia incident-response manager) and Kevin Martin (36, Texas, former DigitalMint negotiator) — sentenced to four years each for deploying ALPHV/BlackCat ransomware April-December 2023, taking 20 percent of approximately $1.2 million in Bitcoin ransoms. Defenders compromised; defenders prosecuted; same week. Capability commodified. On April 14, Vidoc Security Lab reproduced Mythos-class cyber-vulnerability findings on eight small open-weight models — including one with only 3.6 billion active parameters at **$0.11 per million tokens**. The cost floor of state-grade cyber-discovery has fallen to consumer-API pricing. Theori discovered the Linux kernel "Copy Fail" CVE-2026-31431 using its Xint AI pentesting platform — disclosed May 1, federal deadline May 15. Microsoft Defender added detection signatures the same day; Microsoft Security blog: *"preliminary testing activity that might result most likely in increased threat actor exploitation over the next few days."* Per DefiLlama, **April 2026 was the most-hacked month in DeFi history**: ~28-30 incidents, $635 million-plus in losses. Per TRM Labs: North Korea's TraderTraitor accounts for **76 percent** of 2026 crypto-hack value with two attacks. The Wasabi Protocol deployer-EOA drain on April 30 was the third in the 2026 admin-key-compromise series after Drift ($285M, April 1, DPRK-linked) and Kelp DAO ($292M, April 18, single-DVN bridge). The DOJ takedown on May 1 — 276 arrests, $701 million in cryptocurrency restrained, nine Southeast Asian compounds dismantled, rare U.S.-China cooperation between DOJ + FBI + Dubai Police + Chinese Ministry of Public Security — operates at human-time scale. Operation Level Up has notified ~9,000 victims and saved an estimated $562 million. The FBI San Diego field office announced a $10 million State Department reward for information on the Tai Chang scam center. Pig-butchering global losses are estimated at five to seven billion dollars annually. Enforcement at human-time scale cannot interdict attacks at machine-time scale. Twenty-two seconds is the market clearing time. Three days is the proposed federal patch floor. The gap is structural and cannot be closed by accelerating federal patching alone. The cyber attack-economy has industrialized. The federal patch-cadence has not caught up. **Key stat:** Mandiant M-Trends 2026 · 22 seconds median IAB-to-affiliate handoff (vs >8 hours in 2022) · CISA 3-day KEV proposal today (May 4) · MOVEit Auto CVE-2026-4670 today (~1,400 instances exposed) · Mistral Vibe Remote Agents launch today · Five Eyes joint agentic-AI guidance May 1 · cPanel CVE-2026-41940 64 days zero-day → 2-day federal deadline → 2,000+ instances compromised in Sorry ransomware · Linux Copy Fail CVE-2026-31431 KEV May 1 (deadline May 15) · Trellix source-code breach May 2 · Instructure/ShinyHunters May 6 deadline 275M users · BlackCat sentencing Goldberg+Martin 4yr each · Wasabi $4.55M deployer-key drain Apr 30 · TeamPCP 500k credentials · Mini Shai-Hulud SAP/npm + PyTorch Lightning · Vidoc reproduces Mythos at $0.11/M · DOJ $701M takedown 276 arrests · April most-hacked month DeFi history $635M+ · DPRK 76% of 2026 hack value. **Urgency:** The cyber cadence has industrialized to twenty-two seconds. Federal patch cadence cannot bridge the gap.

The User-Side Defense

Twenty-two seconds is the offensive cadence ceiling. Three days is the proposed federal defensive cadence floor. The gap is roughly twelve thousand-fold and structural. The architectural counter is the user-controlled primitive stack that does not depend on patch cadence — because it does not have the same patch surface. **Open-weight models on user hardware.** The defender's capability commodifies in parallel with the attacker's. **DeepSeek V4 Pro** (1.6 trillion parameters, 49 billion active, 1 million-token context) released April 24, 2026 under MIT-style licensing, freely downloadable from Hugging Face. **Mistral Medium 3.5** (128 billion dense, 256K context, modified MIT, 77.6 percent SWE-Bench Verified) released April 29; today, May 4, extended with **Vibe Remote Agents**. **OpenAI Privacy Filter** (1.5 billion sparse mixture-of-experts, 50 million active, 96 percent F1 on PII-Masking-300k) released April 22 under Apache 2.0. **Llama 3.3 · Qwen 3 · GPT-OSS.** Run on Ollama. Run on local hardware. Vidoc Security Lab reproduced Mythos-class cyber findings at **$0.11 per million tokens**. The defender can do the same. Local fine-tuning for organization-specific defense is operationally feasible. The cyber-discovery layer commodifies; the defender's response is to assume the offensive capability is in everyone's hands, and to deploy the same capability inside the organization's own perimeter. **Federated Model Context Protocol with signed packages and per-organization patch cadence.** The Shai-Hulud / Mini Shai-Hulud / TeamPCP campaigns demonstrated that centralized package registries — npm, PyPI, Docker Hub — are the attack surface. The April 22 OX Security disclosure of the systemic Anthropic MCP design vulnerability across all SDK languages, affecting approximately 200,000 servers with nine of eleven marketplaces poisoned, demonstrated that centralized agentic-AI registries inherit the same attack surface. Federated MCP with signed packages and per-organization patch cadence routes around the centralized surface. The patch cadence becomes organization-controlled. **End-to-end encryption with user-held keys.** Signal, Proton, Tuta, Threema, Matrix with per-device cross-signing. The cryptographic property is that the service operator cannot produce the plaintext regardless of patch surface, regulatory pressure, supply-chain compromise, or "supply chain risk" designation. What the operator does not hold cannot be compelled — and cannot be denied recovery. **Federated identity with selective disclosure.** eIDAS 2.0 European Union Digital Identity Wallets, with the December 31, 2026 compliance deadline. France Identité, Italy IT Wallet, Denmark, Greece, Ireland, Cyprus, Spain. W3C Verifiable Credentials Data Model v2.0 (first public working draft, April 2026). W3C Decentralized Identifiers v1.1 (Candidate Recommendation Snapshot). Prove "registered employee," "authorized administrator," "verified operator" without revealing the underlying credential. The vishing operators of Cordial Spider and Snarky Spider cannot exfiltrate what is never transmitted. **Peer-to-peer transport.** URnetwork residential-node relay routes traffic through consumer infrastructure rather than carrier-metered paths or commercial-VPN IP pools. Tor Browser 15.0.11 (April 28) with Snowflake / obfs4 / meek pluggable transports. Shadowsocks, V2Ray, Trojan, NaïveProxy. WireGuard at 94 percent consumer-VPN deployment standard. Defeats commercial-VPN-detection signatures and carrier-mediated state-internet tier systems. The patch cadence of the carrier is irrelevant when the transport routes around the carrier. **FIDO2 hardware authentication.** YubiKey, Nitrokey, SoloKey. Hardware keys replace SMS-based multi-factor authentication, which Citizen Lab's "Bad Connection" (Report 192, April 23) — 15,700+ tracking attempts via 019Mobile, Tango Networks, and Sure (Channel Islands) — demonstrates is operationally penetrated. The credential is on the user's hardware. SIMjacker, vishing, AiTM phishing, and the SS7 and Diameter signaling networks cannot reach it. The Cordial / Snarky Spider vishing-to-SSO-AiTM playbook does not bypass FIDO2. **Open-firmware hardware.** GrapheneOS on compatible Pixel devices — approximately 400,000 active users; the Motorola partnership announced March 2026 ends Pixel exclusivity for the 2027 lineup. LineageOS on other Android hardware. OpenWRT on routers. Klipper on 3D printers. The device runs code the user can inspect; the vendor is a participant in a user-controlled stack, not the exclusive trust boundary. Apple's late-March 2026 statement on Lockdown Mode: *"not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device."* **Self-hosted services.** Matrix homeserver replaces Discord or Slack. Nextcloud replaces Google Drive or Microsoft OneDrive. Forgejo or Gitea replaces GitHub. Jitsi replaces Zoom. Mailcow replaces commercial-operator email. Ollama with LangChain, LlamaIndex, and federated MCP replaces commercial-API AI inference. The blast radius of vendor-side compromise — the May 2 Trellix source-code breach, the April 19 Vercel/Context.ai compromise, the recurring ShinyHunters Anodot/Salesforce campaign producing Rockstar (78.6 million records), Vimeo, Marcus & Millichap (30 million-plus alleged), Amtrak (9.4 million), McGraw-Hill (13.5 million), and Instructure (May 6 deadline; 275 million users) — is bounded by user-operated custody. **Confidential-computing enclaves.** Azure Confidential Computing, AWS Nitro Enclaves, Google Cloud Confidential Computing, Enveil, Opaque. Plus federated-analysis frameworks: DataSHIELD, Vantage6, OHDSI, Flower, PySyft. Compute happens on encrypted data; the operator does not see plaintext. For research and shared-compute environments, federated analysis sends the compute to the data rather than the data to the compute. **Privacy-preserving cryptocurrencies.** Bitcoin Core 27.0 ships BIP324 v2 encrypted P2P transport by default — majority of Bitcoin P2P traffic now encrypted. BIP352 Silent Payments merged in early 2026; Cake Wallet, BitBox, and Nunchuk shipped support; new BIPs in 2026 include BIP376 (PSBTv2 Silent Payments tweak fields) and BIP392 (descriptor format). Monero FCMP++ on testnet since October 3, 2025; cryptographic key audit running May 11–22, 2026; mainnet hard-fork tentatively mid-2026; anonymity set leaping from 16 to approximately 152 to 158 million outputs. Zcash with shielded-by-default. Outside the operator-policed stablecoin pathway. The Wasabi Protocol deployer-key drain demonstrates that admin-key compromise defeats in-protocol recovery; user-controlled BTC-with-BIP324 + Silent Payments on hardware wallets has no admin key to compromise. Each layer ships today. The deployment is operational work. Hours for an individual to switch messenger and enable hardware-key 2FA. An afternoon to enroll in an identity wallet. A weekend for an open-firmware reflash. A quarter of engineering time for a mid-sized organization to migrate to self-hosted inference and federated MCP. The benefit is structural. The 22-second offensive cadence does not reach the user-controlled primitive stack at the same surface. The cPanel "Sorry" ransomware cannot encrypt a self-hosted Nextcloud instance whose owner controls the encryption keys. The Anodot/Salesforce ShinyHunters pivot cannot reach a Matrix homeserver whose owner does not export user-to-user messages to a third-party SaaS. The MOVEit Automation auth bypass cannot exfiltrate from a Forgejo instance whose owner has not deployed MOVEit. The Cordial Spider vishing playbook cannot extract credentials that are FIDO2-bound to user hardware. The TeamPCP `.claude/settings.json` weaponization cannot persist on a developer environment whose AI coding assistant runs on Ollama with a per-organization signed-package federated MCP. The CISA 3-day KEV proposal addresses the wrong cadence. The federal patch cadence is structurally constrained by procurement architecture: vendor disclosure, federal verification, distribution, agency-specific patching, validation, rollback planning. Even an aggressive 1-day floor sits three orders of magnitude above the 22-second attack ceiling. The patch cadence is downstream of vendor. The user-controlled primitive stack is upstream of vendor. Three clocks run. **June 12, 2026** — Section 702 sunset; today is Day 4 of the 45-day window; forty-one days remain. **Approximately May 15, 2026** — the FISC March 17 declassification deadline; today is Day 4 of the 15-day window; eleven days remain. **August 2, 2026** — EU AI Act GPAI go-live; ninety days remain; the Digital Omnibus second trilogue collapsed April 28; the next trilogue under Cypriot Presidency is approximately May 13. The clocks are policy-cadence clocks. The 22-second clock is the attack-economy market clearing time. The user-controlled primitive stack does not run on either clock. The architectural alternative was deployable yesterday. It is deployable today. None of the deployment depends on a 3-day federal patch deadline being adopted. None of the deployment depends on the next AI Act trilogue resolving. None of the deployment depends on the FISC opinion declassification meeting May 15. None of the deployment depends on Section 702 reform reaching the House floor before June 12. 22 seconds is the attack market's clearing time. The user-controlled primitive stack does not have a market clearing time, because it does not have a market. The cyber cadence catches up. The architectural alternative does not have to. **Key stat:** Open weights ship today · DeepSeek V4 Pro 1.6T · Mistral Medium 3.5 + Vibe (today) · OpenAI Privacy Filter Apache 2.0 · Vidoc Mythos reproduction $0.11/M · Signal · Proton · Tuta · Threema · Matrix per-device · eIDAS 2.0 Dec 31 2026 · W3C VC v2.0 / DID v1.1 · URnetwork P2P · Tor 15.0.11 + Snowflake/obfs4/meek · Shadowsocks/V2Ray/Trojan · WireGuard 94% · FIDO2 (YubiKey/Nitrokey/SoloKey) · GrapheneOS ~400k · LineageOS · OpenWRT · Lockdown Mode · Matrix homeserver/Nextcloud/Forgejo/Mailcow/Jitsi/Ollama · DataSHIELD/Vantage6/OHDSI/Flower/PySyft · Azure Confidential / AWS Nitro / Enveil / Opaque · Bitcoin Core 27.0 + BIP324 + BIP352 Silent Payments · Monero FCMP++ mainnet HF mid-2026 · Zcash shielded-by-default. **Urgency:** The patch cadence is downstream of vendor. The user-controlled primitive stack is upstream of vendor. Each layer ships today.

Comics

#122 Seconds
#2The User-Side Defense