

Four experts told a congressional panel that this week was worse than last week, then spent three hours declining to forecast next week beyond a question mark, which they asked to have underlined.


Four experts told a congressional panel that this week was worse than last week, then spent three hours declining to forecast next week beyond a question mark, which they asked to have underlined.
WASHINGTON, D.C. — A panel of four leading cybersecurity experts testified Tuesday that this week was worse than last week, but declined to rule out that it would be remembered as one of the better weeks of the year once next week happens.
The hearing, convened to "establish a clear picture of the current threat landscape," lasted six hours and produced one whiteboard. Witnesses spent the morning agreeing that last week was bad, the early afternoon establishing that this week was worse, and the remaining three hours declining to say anything about next week beyond a question mark, which a committee aide underlined twice in red at the panel's request.
"I want to be very precise for the record," said Dr. Ellen Varga, a former federal incident response lead now at a policy institute. "Last week we had a zero-day in a VPN appliance, a ransomware attack on a hospital network and a password manager that leaked its own passwords. This week we had all three again, plus the VPN appliance's patch, which was also a zero-day."
Asked by the committee chair whether the trend was improving, Varga said it was "stable," in the sense that it had been getting worse at a consistent rate since roughly 1988.
Fellow witness Dr. Martin Hollis, who spent most of the testimony with a hand over his eyes, told the committee he had prepared written remarks on this week's incidents but that they were out of date by the time he reached the building. "I submitted them Monday," he said. "By Tuesday morning two of the vendors in my footnotes had been breached, and one of them was the vendor I'd recommended as the fix."
"People ask me if next week will be worse," said Hollis. "I tell them that every week for twenty years has been the worst week in cybersecurity history, and I have yet to be wrong. Next week is a strong contender."
The panel was briefly optimistic around 2:15 p.m., when a staffer noted that no major incident had been disclosed in nearly forty minutes. The mood ended at 2:19, when the staffer's own agency disclosed one.
Committee members pressed the witnesses for actionable recommendations. The panel unanimously recommended patching, multi-factor authentication and "not clicking the link," the same three recommendations offered at the previous hearing, the hearing before that, and every hearing since the committee was founded. Witness Raymond Kell said his team had trained a model on twenty years of incident data to forecast next week, and that it had returned "worse" with 97% confidence shortly before being compromised itself.
Industry groups welcomed the testimony. A trade association representing more than 400 security vendors called the findings "deeply concerning" and noted that each of its members already offers a platform that addresses whatever happens next week, "including the parts that haven't been invented yet."
The committee voted 11–2 to schedule a follow-up hearing next week to determine how bad next week was. The two dissenting members said they would rather not know.
At press time, the whiteboard had been entered into the record as the most accurate threat intelligence report of the year.

The editorial team at The Exploit - bringing you the most absurd cybersecurity news before it's patched.
Like a vitamin you ingest with your eyes. The best cybersecurity parody, delivered.





