URnetwork
•••

Notes on Internet Privacy

Posts and research from the URnetwork team and community.

RSS
News / AnalysisUnited StatesRussiaTurkeySouth KoreaChinaFrancePakistanMexico

Thirty-One Percent

Yesterday, May 19, 2026, Verizon published the 2026 Data Breach Investigations Report. The headline finding is a structural shift: for the first time in nineteen years of DBIR publication, exploiting vulnerabilities has overtaken stolen credentials as the number one breach entry point. Thirty-one percent of all breaches in 2025 began with vulnerability exploitation. The patching crisis is now the architectural fact behind the shift. Only twenty-six percent of CISA Known Exploited Vulnerability-catalog critical vulnerabilities were fully remediated in 2025 — down from thirty-eight percent in 2024. The median time-to-patch rose to forty-three days, a thirty-four percent increase. AI is being used by threat actors to accelerate vulnerability weaponization; the exploit-time-to-weaponize window has compressed from months to hours. Third-party supply chain breaches jumped sixty percent year-over-year and now account for forty-eight percent of all breaches. Employee AI tool use surged from fifteen percent to forty-five percent in a single year. AI bot traffic is growing twenty-one percent month-over-month. The DBIR data covers November 1, 2024 through October 31, 2025, drawing on 22,000-plus confirmed breaches and 31,000-plus security incidents across 145 countries. The week of May 12-19 demonstrates the pattern. Microsoft Patch Tuesday on May 12 celebrated a 120-vulnerability month with no disclosed zero-days — and two days later disclosed CVE-2026-42897, an Exchange Outlook Web Access spoofing flaw under active exploitation since day one, added to CISA's KEV catalog May 15 with a federal remediation deadline of May 29. As of today, no permanent patch is available; automatic mitigation applies only to customers with the Exchange EM Service enabled. On May 14-15, the node-ipc npm package — with ten million weekly downloads — was hijacked through an expired-domain account recovery email; the attacker re-registered atlantis-software.net (which had been dormant since January 10, 2025) one week before the attack, triggered an npm password reset, and uploaded three malicious versions exfiltrating ninety categories of developer credentials through DNS TXT queries. On May 17-18, Grafana Labs confirmed that the Coinbase Cartel cybercrime group exploited a `pull_request_target` GitHub Actions misconfiguration to download Grafana's source code. On May 18, NYC Health + Hospitals — the largest United States public health care system — disclosed that 1.8 million patients' fingerprints, palm prints, medical records, geolocation, Social Security numbers, passports, and driver's licenses were exfiltrated through a third-party vendor over an eleven-week window from November 25, 2025 to February 11, 2026. The pattern is consistent. The vendor patch pipeline is structurally trailing the AI-accelerated threat pipeline. The supply chain is the new perimeter. The biometric data exfiltrated by third-party-vendor breach cannot be reissued. The Federal Trade Commission's TAKE IT DOWN Act enforcement entered day two today with the launch of takeitdown.ftc.gov as a federal consumer reporting portal. Section 702 sunsets in twenty-three days; the FISC opinion remains classified. Iran is on day eighty-two of the longest internet shutdown on record. The Monero FCMP++ Trail of Bits audit closes in forty-eight hours. Google and Cloudflare have set 2029 as the target deadline for full post-quantum cryptography migration — Q-Day is approximately 1,229 days away. The FIPS 140-2 sunset is 124 days away. The user-side primitive stack — open clients with user-held keys, open firmware on user-inspectable chips, FIDO2 hardware authentication, censorship-resistant transports, privacy-preserving currency, local-inference AI, federated identity with selective disclosure, self-hosted services, mesh and satellite, cryptographic agility — operates parallel to all of it.

URnetwork editorialSan Francisco — May 20, 2026

The number is thirty-one percent

Yesterday, May 19, 2026, Verizon published the 2026 Data Breach Investigations Report. The DBIR is the cybersecurity industry's longest-running and most-cited annual benchmark dataset. It has been published every year since 2008. It analyzes confirmed breaches and security incidents reported to Verizon's investigative teams and to law enforcement partner agencies worldwide. The 2026 edition draws on more than 22,000 confirmed breaches and more than 31,000 total security incidents from a reporting window of November 1, 2024 through October 31, 2025, across 145 countries.

The headline finding is a structural shift. For the first time in nineteen years of DBIR publication, exploiting vulnerabilities has overtaken stolen credentials as the number one breach entry point. Thirty-one percent of all breaches in the 2025 reporting window began with vulnerability exploitation. Stolen credentials — the previous leader for nineteen consecutive years — drop to number two.

The framing question for the industry is no longer "what did the attacker know about your password?" The framing question is "what did the attacker know about your patches?"

Forty-three days

The patching crisis is the architectural fact behind the shift.

Per the DBIR:

  • Only twenty-six percent of vulnerabilities listed in CISA's Known Exploited Vulnerabilities (KEV) catalog were fully remediated by 2025
  • In 2024 the comparable figure was thirty-eight percent
  • Fifty-eight percent of the catalog was partially remediated; sixteen percent was unaddressed
  • The median time-to-patch a critical vulnerability rose from thirty-two days in 2024 to forty-three days in 2025 — a thirty-four percent increase

The CISA KEV catalog is the federal government's authoritative list of vulnerabilities known to be actively exploited in the wild. CISA adds to it when forensic evidence confirms in-the-wild exploitation. It is, by definition, the highest-priority vulnerability set. The catalog's listing imposes a Binding Operational Directive 22-01 remediation deadline on federal civilian executive branch agencies. The remediation rate has dropped twelve points in a year — and the median time-to-patch has lengthened by eleven days.

The reason is structural. AI is being leveraged by threat actors to accelerate the time between public vulnerability disclosure and operational weaponization. Per the DBIR, the exploit-time-to-weaponize window has compressed from months to hours. AI assists in automating exploit-development, in fuzzing public proofs-of-concept against deployed software, and in scaling reconnaissance across the internet. Defenders are still operating on the old patching cadence — monthly, quarterly, with testing and staged rollouts. The asymmetry is no longer manageable on the old cadence.

The DBIR's framing: "AI is being leveraged by threat actors to accelerate the time to exploit known vulnerabilities, shrinking the window for defense from months to mere hours."

Sixty percent

The second structural finding: third-party supply chain breaches jumped sixty percent year-over-year. They now account for forty-eight percent of all breaches.

The supply chain is the new perimeter.

The pattern: organizations have spent fifteen years hardening their own perimeters — endpoint detection, network segmentation, zero-trust identity, multi-factor authentication. The attacker has shifted to the upstream. The third-party software vendor, the SaaS provider, the CI/CD pipeline, the open-source library, the contract manufacturer — all of these are now the attack surface. Hardening the victim's own perimeter does not help against compromise of an upstream dependency that the victim has authorized to access internal systems.

The week of May 12-19 demonstrates the pattern.

Five demonstration cases

One: Microsoft Patch Tuesday on May 12. Microsoft shipped 120 vulnerability fixes — across Windows, Office, Azure, SharePoint, Hyper-V, Edge, and related products. Seventeen were rated Critical severity. Fourteen of the Critical were remote code execution. None of the 120 was disclosed as a publicly known zero-day at the time of release. Industry observers called it a "calm Patch Tuesday."

Two: CVE-2026-42897 — Exchange OWA, May 14. Two days after Patch Tuesday, Microsoft disclosed a critical Exchange Server Outlook Web Access vulnerability — CVE-2026-42897 — with a CVSS score of 8.1, classified as a spoofing bug rooted in cross-site scripting. The flaw affects on-premise Exchange Server 2016, 2019, and Subscription Edition. (Exchange Online is not impacted.) The attack vector: a specially crafted email opened in OWA, with certain interaction conditions met, executes arbitrary JavaScript in the browser context. Microsoft confirmed active exploitation in the wild from day one. The next day, May 15, CISA added CVE-2026-42897 to its KEV catalog. The Binding Operational Directive 22-01 federal remediation deadline was set at May 29.

As of today, May 20, no permanent patch is available. Microsoft has released an automatic mitigation that applies only to customers with the Exchange EM Service enabled. Customers without EM Service must apply manual mitigation steps. Federal IT operations must comply with the May 29 FCEB deadline using mitigation rather than patching. The pattern is the same as the Palo Alto PAN-OS CVE-2026-0300 case from May 9-13: regulator deadline ahead of vendor patch. The DBIR's "AI shrinking the exploit window from months to hours" applies here. The vendor disclosed-and-actively-exploited-on-day-one cycle is the new operational reality.

Three: node-ipc, May 14-15. On May 14, three malicious versions of the node-ipc npm package — [email protected], [email protected], and [email protected] — were published to the npm registry. node-ipc is a foundational Node.js inter-process communication library with ten million weekly downloads — used across a substantial fraction of Node.js applications worldwide. The original maintainer is Brandon Nozaki Miller (known online as RIAEvangelist).

The attack mechanism is the part that matters. Miller's npm account recovery email was hosted on the domain atlantis-software.net. That domain expired on January 10, 2025. It sat unregistered for approximately sixteen months. On May 7, 2026 — exactly one week before the malicious versions were uploaded — an attacker re-registered the expired domain. Once the domain was in the attacker's control, they triggered a standard npm password reset for Miller's account. The reset email landed in the attacker's now-controlled mailbox. The attacker captured the reset link, set a new password, and gained publish rights to a package downloaded ten million times per week.

The three malicious versions exfiltrated ninety categories of developer credentials, including Amazon Web Services, Google Cloud, and Microsoft Azure cloud credentials; SSH keys; Kubernetes tokens; GitHub CLI configurations; Claude AI settings; Kiro IDE settings; Terraform state; database passwords; environment variables; and shell history. The malware was heavily obfuscated. Exfiltration was via DNS TXT queries to sh.azurestaticprovider.net — a domain designed to look like Azure infrastructure.

The architectural fact: every open-source maintainer with an expired or expiring domain in their account recovery chain is a potential supply chain attack surface. The npm registry does not require mandatory MFA or hardware-key recovery. The Verizon DBIR's "supply chain +60%" finding is operationally what the node-ipc hijack demonstrates: the new perimeter is the third party, and the third party is the recovery-email domain of someone you may never have heard of.

Four: Grafana / Coinbase Cartel, May 17-18. On May 15, the Coinbase Cartel cybercrime group — a syndicate linked to ShinyHunters, Scattered Spider, and Lapsus$ — listed Grafana Labs on its dark-web leak site. On May 17-18, Grafana confirmed the breach. The attack vector was a known-dangerous GitHub Actions pattern: pull_request_target. An attacker forked a public Grafana repository, injected a malicious curl command into the forked code, and the vulnerable pull_request_target workflow ran the injected code in Grafana's trusted CI environment, dumping environment variables and extracting a privileged GitHub token. The token enabled source code download.

Grafana confirmed source code was downloaded. No customer or personal data was accessed. Grafana refused to pay the ransom. The source code is expected to be leaked. The architectural lesson: even open-source-adjacent companies that publish code in the open have supply-chain CI risk through misconfigured workflows.

Five: NYC Health + Hospitals, May 18. NYC Health + Hospitals — the largest public health care system in the United States — disclosed that an unauthorized actor accessed third-party-vendor systems between November 25, 2025 and February 11, 2026, copying records of 1.8 million patients and employees. The exposed data: fingerprints, palm prints, medical records, billing information, precise geolocation, Social Security numbers, passport numbers, and driver's licenses.

The biometric problem is permanent. Unlike SSNs, credit cards, or passwords, fingerprints and palm prints cannot be reissued. The biometric is now in adversarial possession for 1.8 million people for the rest of their lives.

The pattern: third-party vendor access, ten-week dwell time, seven months from initial access to public disclosure. The DBIR's "supply chain +60%, third party 48% of breaches" finding is exactly this category of incident at scale.

The five demonstration cases — Exchange CVE, node-ipc, Grafana, NYC H+H, plus carryover Foxconn — map cleanly onto the three DBIR findings. Vulnerability exploitation is the first entry. The supply chain is the new perimeter. The patching crisis is what makes both worse.

Q-Day at 2029

The DBIR addresses the current patching crisis. The forward-looking patching crisis is Q-Day — the moment a quantum computer can break classical public-key cryptography.

On March 25, 2026, Google published a post-quantum cryptography migration deadline: 2029. The reasoning cited:

  • Continued progress on quantum hardware development (the Willow chip's qubit count, coherence times, and error correction improvements)
  • Quantum error correction research advances
  • Quantum factoring resource estimates — Shor's algorithm-style attacks against RSA and elliptic curve cryptography — that are "running out faster than expected" relative to prior projections

Cloudflare followed in April 2026, matching Google's 2029 target. Cloudflare's phased roadmap:

  • Mid-2026: Post-quantum authentication using ML-DSA for Cloudflare-to-origin connections
  • Mid-2027: Post-quantum authentication for visitor-to-Cloudflare connections via Merkle Tree Certificates
  • Early 2028: Post-quantum in the Cloudflare One SASE suite
  • 2029: Full post-quantum secure network

CNN's May 17 coverage described "a cybersecurity crisis" timeline narrowing from 2030s expectations to 2029 estimates. The Ethereum Foundation responded the same day as Google's announcement (March 25) by launching a Post-Quantum Ethereum resource center, with the goal of securing billions in network value by 2029 through PQC at the protocol level.

The NIST post-quantum cryptography standards have been live since August 2024:

  • ML-KEM (FIPS 203) — Key encapsulation mechanism
  • ML-DSA (FIPS 204) — Digital signature algorithm
  • SLH-DSA (FIPS 205) — Stateless hash-based signature algorithm

The FIPS 140-2 sunset is September 21, 2026 — 124 days from today. The average FIPS 140-3 validation cycle is approximately 542 days at the early-2024 baseline. Pre-emptive post-quantum-secure primitive deployment is the only path through the FIPS sunset.

Signal's Sparse Post-Quantum Ratchet (SPQR), combined with the existing Double Ratchet and PQXDH key agreement, forms the "Triple Ratchet" — Signal's post-quantum hardening against "harvest now, decrypt later" attacks. The threat model: an adversary captures encrypted traffic today and decrypts it after Q-Day. The architectural counter is pre-quantum migration starting now.

The Verizon DBIR finding is about the current patching crisis. The Q-Day timeline is about the next class of vulnerabilities the patching pipeline is even less prepared for. Both pressures converge on the same architectural conclusion: cryptographic agility ahead of need.

Day two of TAKE IT DOWN Act enforcement

Yesterday, Tuesday May 19, 2026, the Federal Trade Commission began enforcing Section 3 of the TAKE IT DOWN Act. The federal mandatory-takedown framework imposes a 48-hour removal window on covered platforms after a valid victim notice. The civil penalty per violation is $53,088 — the FTC's inflation-adjusted maximum. Fifteen platforms received compliance reminder letters from FTC Chairman Andrew Ferguson on May 11: Amazon, Alphabet, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok, and X.

Today, May 20, the FTC launched takeitdown.ftc.gov — a public consumer reporting portal where individuals can report covered platforms that fail to remove prohibited content or fail to provide a removal-request mechanism. The federal takedown enforcement now has a unified intake dashboard.

The civil-liberties critique remains operational. The Electronic Frontier Foundation, the Center for Democracy & Technology, the American Civil Liberties Union, R Street Institute, and the Free Speech Center continue to argue that Section 3's takedown trigger is broader than Section 2's criminal NCII definition; that the 48-hour deadline forces compliance over investigation; that there are no protections against frivolous or bad-faith requests; that lawful satire, journalism, and political speech could be wrongly removed; and that end-to-end-encrypted platforms (Signal, Matrix, Briar, Threema, Tuta, Proton) cannot structurally comply because they cannot scan content.

President Trump's May 19, 2025 signing statement — "I'm going to use that bill for myself too" — remains the operational risk. The FTC chairman is a Trump appointee. The interpretive discretion is unitary executive.

The first conviction under the TAKE IT DOWN Act's criminal section (Section 2) came in April 2026, in a case targeting AI-generated deepfakes. Section 3 — the platform takedown obligation — is what entered enforcement yesterday.

Twenty-three days

Today, May 20, 2026, the Section 702 of FISA sunset is twenty-three days away. June 12.

The FISC March 17, 2026 opinion on FBI Section 702 query practices remains classified. Senator Wyden's 15-day expedited declassification window — negotiated April 30 as condition for the 45-day Section 702 extension — closed approximately May 15 without publication. The Department of Justice has not declassified. The Director of National Intelligence has not declassified. Senator Cotton's objection to unanimous consent passage with the declassification provision held.

The query-side reform debate continues without the court's structural view. The American Prospect's May 11 reporting described "AI supercharging the surveillance state" — automated downstream analytic chains run against the §702 corpus. Congress is reauthorizing surveillance without the FISC's view of FBI query practices.

The June 12 sunset is the next forcing event.

What was running

The federal patching crisis, the federal mandatory-takedown enforcement, and the federal-scale agentic-AI deployment do not pause the global recipient-country layer.

Iran — day eighty-two. Iran's internet blackout enters day 82 today. ~1,968 hours total. The longest internet shutdown on record. Economic cost: ~$250 million per day in direct losses, per Mahdi Ghodsi of the Vienna Institute (wiiw). Cumulative loss: NetBlocks placed it above $1.8 billion at day 48, the last published figure. Online sales fell eighty percent. The Tehran Stock Exchange overall index lost 450,000 points across a four-day window. The Internet Pro IRGC/MCI white-SIM caste tier remains in operational production with three-to-four-hour queue times at SIM-conversion offices in Tehran.

Russia — Telegram block continuing. Russia blocked Telegram on March 17, 2026 — two weeks ahead of the expected April deployment. Ninety-five percent of Telegram connections fail without a VPN. Telegram's April update disguising traffic as normal browser traffic restored access within hours. The Kremlin continues to push MAX — its "sovereign" state-controlled messaging app, which has 107 million registered users but limited actual usage due to surveillance features. Substitution effects: Turkey's BiP, South Korea's KakaoTalk, and China's WeChat together saw +60% user growth in Russia in March 2026.

The April 15 ISP VPN-detection law remains operational at Yandex, VK, Sberbank, Gosuslugi, Ozon, Wildberries, Aviasales, and Russian Railways. The May 1 mobile VPN surcharge was delayed; carriers asked for time to configure billing systems. Per Meduza's April 10 study, 22 of Russia's 30 most popular Android apps now monitor whether VPN is enabled at the application layer. Roskomnadzor's stated 2030 target remains 92 percent VPN blocking effectiveness.

China — Great Unplug continues. The April 2026 physical disconnection of thousands of proxy service servers continues to constrain Chinese internet users' circumvention options. Only TLS-based obfuscation reliably survives.

Niger — day twelve of the international media ban. Twelve days ago, on May 8, Niger's military-controlled Observatoire Nationale de la Communication ordered the suspension of nine international media outlets: France 24, Radio France International, Agence France Presse, TV5 Monde, Jeune Afrique, Mediapart, LSI Africa, TF1 Info, France Afrique Média. The bans remain in effect. Niger is the second-worst jailer of journalists in sub-Saharan Africa per the Committee to Protect Journalists' December 1, 2025 census.

Burkina Faso — day fifteen of the TV5 Monde ban. Reporters Without Borders' May 6 report documented Burkinabé journalist Atiana Serge Oulon's detention in a Ouagadougou villa, where he was beaten with tree branches over weeks.

Pakistan — PECA wave continues. The April 29 Freedom Network report documented continued press freedom contraction. Bail was confirmed by Islamabad district court for journalists Rizwan Ghalzai and Aqil Hussain Bagri under PECA. The Pakistan Press Foundation tracked 233 incidents from January 2025 through April 2026.

Tanzania — Commission of Inquiry report withheld. April 23 report: 518 dead (502 civilians, 16 security, 21 children) during the post-October-29-2025 election violence. Government has not released the full report publicly. X remains suspended in Tanzania.

Mexico — forty-one days to CURP Biométrica. June 30, 2026 deadline. Approximately 127 million mobile phone lines must register against biometric CURP (face, fingerprint, iris) by then or face suspension.

Pavel Durov. May 17, 2026 Paris prosecutor statement: French investigation against Telegram founder not closed. Twelve charges. Judicial control still in force. Russia's February 2026 FSB criminal probe on "aiding terrorism" remains open. Two-country prosecution.

The agentic surface

Microsoft Agent 365 went generally available on May 1, 2026 — $15 per user per month. The "unified control plane for agents" lets IT, security, and business teams observe, govern, and secure AI agents across Microsoft AI platforms and ecosystem partners (with public preview registry sync to AWS Bedrock and Google Cloud).

On May 12, the Microsoft Security Blog announced the Microsoft Security multi-model agentic scanning harness (MDASH) — orchestrating more than 100 specialized AI agents — which scored 88.45 percent on the CyberGym benchmark covering more than 1,500 real-world vulnerabilities. MDASH-led research has already found 16 new vulnerabilities across the Windows networking and authentication stack. Microsoft Defender now monitors AI agents in real time, with webhook-based interception before action execution, asset context mapping per agent (devices, MCP servers, identities, cloud resources), and runtime protection.

Yesterday, Google launched Gemini Spark — the 24/7 cloud-based personal AI agent with always-on access to Gmail, Docs, Sheets, Slides, Canva, OpenTable, and Instacart. The leaked onboarding screen stated Spark "may do things like share your info or make purchases without asking." Available to Google AI Ultra ($100/month) subscribers next week.

The agentic deployment surface across enterprise, SMB, and consumer continues to expand. Per the DBIR, employee AI tool use surged from fifteen percent to forty-five percent in one year — and the 45 percent represents a substantial new data-out flow from organizations to LLM providers.

Two days to the audit close

Today is day ten of the Monero FCMP++ Trail of Bits audit. The audit closes May 22 — forty-eight hours from now.

FCMP++ replaces ring signatures with full-chain membership proofs. The anonymity set expands from sixteen decoys per transaction to the entire UTXO set — more than 150 million transaction outputs. A clean audit clears the path for the consensus upgrade and eliminates the last significant technical objection to Monero's protocol-level privacy claims.

The audit's significance maps onto the Verizon DBIR finding: the centralized vendor patching pipeline cannot keep up with AI-accelerated threats. Monero's protocol-level cryptographic upgrade is the user-custody counterpart — a single audit conclusion either ships the protocol-level privacy upgrade or delays it. The architecture is single-pipeline at the protocol level but user-custody at the wallet level. The DBIR's third-party-supply-chain finding does not apply to Monero in the same way it applies to corporate IT infrastructure — there is no third-party SaaS dependency layer.

Bitcoin BIP324 v2 (encrypted P2P, default-on since Core 27.0) and BIP352 silent payments (in Core 28.0+, with BIP376 and BIP392 added in 2026) operate on parallel logic. Zcash Crosslink Milestone 4 (PoW + BFT finality integrated) operates on parallel logic. All three privacy-preserving currencies are user-custody primitives that do not depend on the third-party patching pipeline.

The user-side primitive stack

The architectural counter to the Verizon DBIR's three findings — vulnerability exploitation at thirty-one percent as the #1 breach entry, supply chain breaches up sixty percent year-over-year (now 48% of total), median time-to-patch forty-three days — plus the Q-Day 2029 timeline, plus the agentic deployment surface, plus the federal mandatory-takedown enforcement, plus the recipient-country state action, is the user-side primitive stack. It does not depend on the centralized vendor patching pipeline.

Open clients with user-held keys. Signal. Tuta. Proton. Threema. Briar 1.5.17 (the March 12, 2026 release runs over Bluetooth, Wi-Fi, and Tor). Cwtch. Session. Matrix homeserver. The architectural property: the platform operator has no plaintext access. End-to-end encryption removes the server-side data-exfiltration surface from the supply-chain attack pathway. The user holds the key.

Open firmware on user-inspectable chips. GrapheneOS (Pixel 6+ with Android 16 in the 2026030501 preview, including April through August 2026 Android Security Bulletins). CalyxOS Android 16 test build 7.2.1.0 released May 4, 2026. /e/OS. LineageOS. OpenWRT. The Citizen Lab "Bad Connection" report of April 23 documented two carrier-side surveillance campaigns invisible to closed-firmware operating systems: STA1 (Diameter-to-SS7 downgrade across nine ghost-operator countries) and STA2 (SIMjacker zero-click via the legacy S@T browser SIM applet). Open firmware exposes cache and notification-database behavior to user inspection.

FIDO2 hardware authentication. On May 7, 2026 — FIDO Alliance World Passkey Day — five billion passkeys had been deployed globally. YubiKey. Nitrokey. SoloKey. Yubico has shipped more than 30 million hardware keys lifetime. The NYC Health + Hospitals breach exposed 1.8 million people's fingerprints and palm prints — biometric identifiers that cannot be reissued. Hardware-bound credentials replace biometrics as the second factor. The second factor lives in the user's pocket, not in the third-party vendor's database.

Censorship-resistant transports. Tor Browser 15.0.13 and 16.0a6 (May 7 emergency releases that fixed critical Linux kernel, Tor Browser, and Tor client vulnerabilities). V2Ray VLESS + Reality. Shadowsocks-2022. Trojan. WireGuard with obfsproxy. URnetwork peer-to-peer overlay. URnetwork's February 19, 2026 MCP server release lets agentic clients establish VPN sessions over the peer-to-peer overlay, abstracting transport from the carrier layer. Iran's Internet Pro tier, Russia's April 15 ISP VPN-detection law, the May 1 mobile surcharge (delayed), China's April Great Unplug, the EU Going Dark / ProtectEU proposal — none of these statutes name the overlay because it does not appear as a public service or registered operator. The user-controlled overlay is statute-invisible.

Privacy-preserving currencies on user-custody primitives. Bitcoin BIP324 v2 (default-on since Core 27.0; the majority of global Bitcoin peer-to-peer traffic is now encrypted). Bitcoin BIP352 silent payments (Core 28.0+, BIP376 + BIP392 added 2026). Monero FCMP++ in active integration — the Trail of Bits audit closes in 48 hours; 150-million-output anonymity set on success. Zcash Crosslink Milestone 4 (Vitalik Buterin's second donation to Shielded Labs February 6 supported the upgrade).

Local-inference AI on user-controlled compute. DeepSeek V4 Pro (April 22, MIT-licensed, 1.6 trillion / 49 billion active parameters, 1-million-token context, 80.6 percent SWE-Bench Verified). DeepSeek V4 Flash (284 billion / 13 billion active). Mistral Medium 3.5 (April 29, 128 billion, 77.6 percent SWE-Bench). Qwen 3.6 Max Preview (April 27, 201 languages). GLM-5.1 (744 billion mixture-of-experts, top-ranked open-source LMArena). OpenAI Privacy Filter (April 22, Apache 2.0, 1.5 billion / 50 million active, browser-runnable via transformers.js + WebGPU). Where there is no third-party log, there is nothing to subpoena AND nothing to repurpose by the cloud-AI provider. Per the DBIR, 45 percent of employees now use AI tools — overwhelmingly cloud-hosted. Local-inference is the architectural counter.

Federated identity with selective disclosure. W3C Verifiable Credentials 2.0 (Recommendation since May 2025; seven specifications). eIDAS 2.0 BBS+ selective disclosure (IETF finalization in progress). Privacy Pass. The Mexican CURP Biométrica deadline of June 30 — 41 days from today, tying 127 million mobile lines to face, fingerprint, and iris biometrics — is the threat model.

Self-hosted services. Matrix homeserver. Forgejo. Mailcow. Jitsi. Nextcloud. Mautic. SuiteCRM. Moodle community. Open edX. Federation bounds the supply-chain blast radius — each homeserver is responsible for its own patching cadence, but cannot be served with a federated takedown obligation against the entire federation. The Grafana / Coinbase Cartel pull_request_target exploitation is yesterday's reminder that even open-source-adjacent infrastructure has supply-chain CI risk; the architectural counter is OpenID Connect-based runner authentication and self-hosted Forgejo or Gitea CI environments.

Mesh and satellite at the carrier layer. Briar (Bluetooth, Wi-Fi, Tor). Bridgefy. Meshtastic. Reticulum. GoTenna PRO. Starlink. Iran's Internet Pro tier, Sudan's Khartoum tower power-out, Russia's 21-oblast pre-Victory-Day cuts, and the Tanzania five-day complete internet blackout that enabled 518-plus deaths during post-October-29-2025 election violence — the carrier-independent layer is the structural counter.

Cryptographic agility ahead of the September 21 FIPS sunset. ML-KEM (FIPS 203). ML-DSA (FIPS 204). SLH-DSA (FIPS 205). Standards live since August 2024. The average FIPS 140-3 validation cycle is approximately 542 days at the early-2024 baseline. Pre-emptive post-quantum-secure primitive deployment is the only path through the FIPS sunset. Signal's Sparse Post-Quantum Ratchet (SPQR), combined with the existing Double Ratchet and PQXDH key agreement, forms the "Triple Ratchet" — Signal's post-quantum hardening against "harvest now, decrypt later" attacks. The Q-Day 2029 target is the forward-looking architectural counter.

Closing

Thirty-one percent.

That is the share of breaches in 2025 that started with vulnerability exploitation. For the first time in nineteen years of Verizon DBIR publication, vulnerability exploitation is the number one breach entry point. The patching crisis is the architectural fact. The median time to patch a critical vulnerability rose to forty-three days in 2025 — a thirty-four percent increase. The remediation rate on CISA's KEV catalog dropped from thirty-eight percent to twenty-six percent. Third-party supply chain breaches jumped sixty percent year-over-year, now accounting for forty-eight percent of all breaches. AI is shrinking the exploit window from months to hours.

The week of May 12-19 demonstrated the pattern. Exchange OWA CVE-2026-42897 disclosed-and-actively-exploited within forty-eight hours of a "calm" Patch Tuesday, with no permanent patch as of today. The node-ipc npm package — ten million weekly downloads — hijacked through an expired-domain account recovery chain. The Grafana / Coinbase Cartel pull_request_target CI compromise. NYC Health + Hospitals' 1.8 million biometric records exfiltrated via third-party vendor.

The Federal Trade Commission's TAKE IT DOWN Act enforcement entered day two today with the launch of takeitdown.ftc.gov. Section 702 sunsets in twenty-three days. Iran is on day eighty-two. Russia's Telegram block continues. Niger's nine-international-media-outlet ban is on day twelve. Mexico's CURP Biométrica deadline is forty-one days away.

The Monero FCMP++ Trail of Bits audit closes in forty-eight hours. Google and Cloudflare have set 2029 as the post-quantum migration deadline. The FIPS 140-2 sunset is 124 days away.

The user-side primitive stack — open clients, open firmware, hardware keys, censorship-resistant transports, privacy-preserving currency, local-inference AI, federated identity, self-hosted services, mesh and satellite, cryptographic agility — does not depend on the centralized vendor patching pipeline.

Thirty-one percent is the report. The stack is the response.

URnetwork is a peer-to-peer overlay for censorship-resistant transport that does not appear in the public-service operator registry of any of the statutes named above. URnetwork's MCP server release of February 19, 2026 lets agentic clients establish VPN sessions over the peer-to-peer overlay, abstracting transport from the carrier layer.

https://ur.io

Further Discussion

Thirty-One Percent

Thirty-one percent. For the first time in nineteen years of Verizon Data Breach Investigations Report publication, vulnerability exploitation has overtaken stolen credentials as the number one breach entry point. The DBIR 2026 — published yesterday, May 19, 2026 — covers November 1, 2024 through October 31, 2025: 22,000-plus confirmed breaches, 31,000-plus security incidents, 145 countries. The headline number is structural. Three findings. **Thirty-one percent.** Vulnerability exploitation now leads. Stolen credentials drop to number two. The reason: AI is being leveraged by threat actors to accelerate the time between public disclosure and operational weaponization. Exploit-time-to-weaponize: months to hours. **Forty-three days.** The median time-to-patch a critical vulnerability rose from thirty-two days in 2024 to forty-three days in 2025 — a thirty-four percent increase. Only twenty-six percent of CISA Known Exploited Vulnerability catalog items were fully remediated by 2025 — down from thirty-eight percent in 2024, a twelve-point drop in a single year. Fifty-eight percent partially remediated. Sixteen percent unaddressed. The vendor patching pipeline is structurally behind. **Sixty percent.** Third-party supply chain breaches jumped sixty percent year-over-year. Now forty-eight percent of all breaches involve a third party. The supply chain is the new perimeter. The week of May 12-19 demonstrates the pattern. May 12: Microsoft Patch Tuesday — 120 vulnerabilities fixed, no disclosed zero-days, called a "calm" Patch Tuesday by industry observers. Forty-eight hours later: Microsoft disclosed **CVE-2026-42897**, an Exchange Outlook Web Access spoofing flaw rooted in cross-site scripting, CVSS 8.1, **actively exploited from day one**. On May 15 CISA added it to the Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch agencies have until May 29 to remediate. **As of today, no permanent patch is available.** Automatic mitigation applies only to customers with the Exchange EM Service enabled. Federal IT operations are mitigating without a vendor patch. May 14: Three malicious versions of the **node-ipc** npm package — 9.1.6, 9.2.3, 12.0.1 — published by an attacker who had hijacked the package's maintenance account through an expired-domain account recovery email. The maintainer's recovery email lived on **atlantis-software.net**. That domain expired January 10, 2025. It sat unregistered for sixteen months. On **May 7, 2026** — one week before the attack — the attacker re-registered the domain. Then triggered an npm password reset. Received the reset email at the now-controlled mailbox. Gained publish rights to a package downloaded **ten million times per week**. Uploaded malicious versions that exfiltrate ninety categories of developer credentials — AWS, Google Cloud, Azure, SSH keys, Kubernetes tokens, GitHub CLI configs, Claude AI settings, Kiro IDE settings, Terraform state, database passwords, environment variables, shell history — via DNS TXT queries to a domain (sh.azurestaticprovider.net) crafted to look like Azure infrastructure. May 17-18: Grafana Labs confirmed the **Coinbase Cartel** cybercrime group exploited a `pull_request_target` GitHub Actions misconfiguration. Attacker forked a public Grafana repository. Injected a malicious `curl` command into the forked code. The vulnerable `pull_request_target` workflow executed it in Grafana's trusted CI environment. Dumped environment variables. Extracted a privileged GitHub token. Downloaded the source code. Grafana refused the ransom. The source code is expected to leak. May 18: NYC Health + Hospitals — the largest US public health care system — disclosed that an unauthorized actor accessed third-party-vendor systems between November 25, 2025 and February 11, 2026, copying records of **1.8 million** patients and employees: fingerprints, palm prints, medical records, geolocation, Social Security numbers, passports, driver's licenses. Biometrics cannot be reissued. The five demonstration cases map onto the DBIR's three findings. The forward-looking finding is Q-Day at 2029. Google March 25 + Cloudflare April 2026: post-quantum cryptography migration deadline 2029. Quantum factoring resource estimates "running out faster than expected." NIST ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) live since August 2024. FIPS 140-2 sunset September 21, 2026 — 124 days from today. The Federal Trade Commission's TAKE IT DOWN Act enforcement entered day two today with the launch of takeitdown.ftc.gov. Section 702 sunsets in twenty-three days. The FISC opinion remains classified. Iran is on day eighty-two. Russia's Telegram block continues. Niger's nine-international-media-outlet ban is on day twelve. Mexico's CURP Biométrica deadline is forty-one days away. The Monero FCMP++ Trail of Bits audit closes in forty-eight hours. Thirty-one percent. Forty-three days. Sixty percent. The DBIR data is published once a year. The pattern is operational every day.

The Forty-Three-Day Window

Forty-three days is the median time it takes to patch a critical vulnerability. That's the Verizon DBIR 2026's measurement of the centralized vendor patching pipeline. In 2024 it was thirty-two days. In 2025 it's forty-three. Up thirty-four percent in a single year. Twenty-six percent of CISA's Known Exploited Vulnerabilities catalog was fully remediated by 2025 — down from thirty-eight percent the year before. AI has shrunk the attacker's exploit-time-to-weaponize from months to hours. Forty-three days is the new architectural lock-in. The defender's clock cannot catch the attacker's clock at the centralized-vendor patching layer. The user-side primitive stack does not depend on the centralized vendor patching layer. **Open clients with user-held keys.** Signal. Tuta. Proton. Threema. Briar 1.5.17 — the March 12, 2026 release runs over Bluetooth, Wi-Fi, and Tor. Cwtch. Session. Matrix homeserver. The platform operator has no plaintext access. No server-side data-exfiltration surface to compromise via supply-chain attack. The user holds the key. The Verizon DBIR's third-party-breach finding (sixty percent up YoY, forty-eight percent of total) does not apply where there is no third-party plaintext. **Open firmware on user-inspectable chips.** GrapheneOS — Pixel 6+ with Android 16 in 2026030501 preview. CalyxOS Android 16 test build 7.2.1.0 released May 4, 2026. /e/OS. LineageOS. OpenWRT. Open-source visibility allows third-party + community audits + faster zero-day discovery than the closed-firmware vendor cycle. The Citizen Lab "Bad Connection" report of April 23 documented two carrier-side surveillance campaigns invisible to closed-firmware operating systems: STA1 (Diameter-to-SS7 downgrade across nine ghost-operator countries) and STA2 (SIMjacker zero-click via the legacy S@T browser SIM applet). **FIDO2 hardware authentication.** Five billion passkeys deployed globally as of May 7, 2026 — FIDO Alliance World Passkey Day. YubiKey. Nitrokey. SoloKey. Yubico has shipped more than 30 million hardware keys lifetime. Hardware-bound credentials replace the biometrics that cannot be reissued (1.8 million people's fingerprints and palm prints now in adversarial possession after the NYC Health + Hospitals breach). The second factor lives in the user's pocket, not in the third-party vendor's database. **Censorship-resistant transports.** Tor Browser 15.0.13 and 16.0a6 (May 7 emergency releases). V2Ray VLESS + Reality. Shadowsocks-2022. Trojan. WireGuard with obfsproxy. **URnetwork peer-to-peer overlay.** URnetwork's February 19, 2026 MCP server release lets agentic clients establish VPN sessions over the peer-to-peer overlay, abstracting transport from the carrier layer. Iran's Internet Pro tier, Russia's April 15 ISP VPN-detection law, China's April Great Unplug, the EU Going Dark / ProtectEU proposal — none of these statutes name the overlay because it does not appear as a public-service operator. The user-controlled overlay is statute-invisible. The single-vendor patching crisis does not apply to a decentralized peer-to-peer overlay. **Privacy-preserving currencies on user-custody primitives.** Bitcoin BIP324 v2 (default-on since Core 27.0; majority of global Bitcoin peer-to-peer traffic encrypted). Bitcoin BIP352 silent payments (Core 28.0+, BIP376 + BIP392 added 2026). Monero FCMP++ — the Trail of Bits audit closes in **48 hours**, replacing ring signatures with full-chain membership proofs whose anonymity set is the entire UTXO set (150+ million transaction outputs). Zcash Crosslink Milestone 4 (Vitalik Buterin's second donation to Shielded Labs February 6 supported the upgrade). The Samourai Wallet co-founder Keonne Rodriguez's May 7 letter from federal prison — Samourai Wallet was prosecuted as the operator of user-custody privacy primitives — is the threat model for what happens when user-custody primitives are criminalized. The protocol is what survives. **Local-inference AI on user-controlled compute.** DeepSeek V4 Pro (April 22, MIT, 1.6 trillion / 49 billion active, 1-million-token context, 80.6 percent SWE-Bench Verified). DeepSeek V4 Flash (284 billion / 13 billion active). Mistral Medium 3.5 (April 29, 128 billion, 77.6 percent SWE-Bench Verified). Qwen 3.6 Max Preview (April 27, 201 languages). GLM-5.1 (744 billion mixture-of-experts, top-ranked open-source LMArena). OpenAI Privacy Filter (April 22, Apache 2.0, browser-runnable via transformers.js + WebGPU). The DBIR finding: employee AI tool use surged from 15 percent to 45 percent in one year. Yesterday's Gemini Spark launch — 24/7 cloud-based personal AI agent with always-on access to Gmail, Docs, Sheets, Slides, Canva, OpenTable, Instacart — is the threat model. Where there is no third-party log, there is nothing to subpoena AND nothing to repurpose by the cloud-AI provider. **Federated identity with selective disclosure.** W3C Verifiable Credentials 2.0 (Recommendation since May 2025). eIDAS 2.0 BBS+ selective disclosure (IETF finalization in progress). Privacy Pass. The Mexican CURP Biométrica deadline of June 30 — 41 days from today, tying 127 million mobile lines to face, fingerprint, and iris biometrics — is the threat model. Don't upload the biometric. **Self-hosted services.** Matrix homeserver. Forgejo. Mailcow. Jitsi. Nextcloud. Mautic. SuiteCRM. Moodle community. Open edX. Federation bounds the supply-chain blast radius. Each homeserver is responsible for its own patching cadence, but federation distributes the third-party-supply-chain risk that the DBIR found grew sixty percent YoY. The Grafana / Coinbase Cartel `pull_request_target` exploitation is the architectural reminder: even open-source-adjacent infrastructure has supply-chain CI risk. The architectural counter is OIDC-based runner authentication and self-hosted Forgejo or Gitea CI environments. **Mesh and satellite at the carrier layer.** Briar (Bluetooth, Wi-Fi, Tor). Bridgefy. Meshtastic. Reticulum. GoTenna PRO. Starlink. The Iran Internet Pro tier, the Sudan Khartoum tower power-out, the Russia 21-oblast pre-Victory-Day cuts, the Tanzania five-day complete internet blackout that enabled 518-plus deaths during post-October-29-2025 election violence — the carrier-independent layer is the structural counter. **Cryptographic agility ahead of the September 21 FIPS sunset and Q-Day 2029.** ML-KEM (FIPS 203). ML-DSA (FIPS 204). SLH-DSA (FIPS 205). Standards live since August 2024. The average FIPS 140-3 validation cycle is approximately 542 days at the early-2024 baseline. Pre-emptive post-quantum-secure primitive deployment is the only path through the FIPS sunset. Google's 2029 quantum migration deadline (March 25, 2026) and Cloudflare's matching commitment (April 2026) frame the next 1,229 days. The harvest-now-decrypt-later threat model is operational today. Signal's Sparse Post-Quantum Ratchet (SPQR), combined with the existing Double Ratchet and PQXDH key agreement, forms the "Triple Ratchet" — Signal's post-quantum hardening. The DBIR's 31 percent finding tells you the patching pipeline cannot keep up. The 43-day median tells you why. The 60 percent supply chain jump tells you the new perimeter. The Q-Day 2029 timeline tells you the next class of vulnerabilities is coming. The user-side primitive stack does not depend on the centralized vendor patching pipeline. Open clients. Open firmware. Hardware keys. Censorship-resistant transports. Privacy-preserving currency. Local-inference AI. Federated identity with selective disclosure. Self-hosted services. Mesh and satellite. Cryptographic agility. Forty-three days is the centralized vendor pipeline's median. The user-side primitive stack runs deployment-independent.

Comics

#1Thirty-One Percent
#2The Forty-Three-Day Window