The Kit Is Ready. The Zero-Days Are Already Gone.

# The Kit Is Ready. The Zero-Days Are Already Gone. The BlueMoon kit has a certain elegance to it that should make every CISO in town feel a bit sick, and normally (and this is where the money is), zero-day exploits are precious things. Nation-states guard them or they fetch seven figures in the darker parts of the web; you don't just "kit" them into a package for the general public. Yet here we are on Friday, 11 September 2026, and BlueMoon is pairing Windows flaws with Google Chrome zero-days to slip into systems before any telemetry alert hits the console. It isn't just that these holes exist (they always do), but that someone actually weaponised them into a working delivery system. The exploit market has reached an industrial level of efficiency that moves faster than we can write policy papers about it, and when you pair a browser exploit with an OS-level flaw, you aren't just knocking on the door. You're replacing the lock and walking through the wall. Then things get tedious. Most disclosure rules rely on the idea of a "reasonable" window for patching once a bug is known. But when a commercial kit arrives before the vendor even writes an advisory, that concept of reasonableness just vanishes. I think we'll see plenty of insurance claims this next quarter. Insurers will argue that failing to spot the intrusion was negligence, while victims will say they couldn't patch a hole they didn't know existed. It's a classic paperwork stalemate. Some might say double zero-day kits are too rare to be a systemic threat (a statistical anomaly, if you like). That's a comforting thought for people who enjoy comfort, but it ignores the last three years. We saw this before with those AI agents hitting PaperCut instances, where 440 instances were hit across just under 400 organisations. The bottleneck isn't finding the hole anymore; it's automating the entry; blueMoon is just the high-end version of that logic. Then there's the JFrog Artifactory mess, and it's a masterclass in how "secure" supply chain tools become the very way they are destroyed. The attackers didn't find one bug; they chained several vulnerabilities to get admin control and plant backdoors. For those who don't read technical write-ups at noon, Artifactory is basically a warehouse for software components; you trust it to hold your "golden" versions of code. Once an attacker has admin rights, they aren't just stealing data; they're poisoning the well, and the second-order effect is staggering. Every developer or automated pipeline that pulled a binary from a compromised JFrog instance might have taken in a backdoor. This doesn't just hit the company running the server; it ripples down to every customer using software built from those binaries. Our current obsession with "Software Bill of Materials" (SBOMs) feels almost quaint now. An SBOM tells you what's in your software, but not if the warehouse where the ingredients were kept was run by a criminal syndicate for three weeks. The common pushback is that JFrog and similar vendors have rigorous audits that an average company can't match. True, but audits are just snapshots, and they rarely account for "vulnerability chaining," which is basically taking three medium-severity bugs and stacking them like Lego bricks to create one critical failure. We treat these tools as vaults and forget they're just complex software written by humans who occasionally forget to validate an input. Want a more traditional infrastructure failure? Look at the NetScaler ADC and Gateway appliances. CVE-2026-19490 is being exploited in the wild right now for authentication bypass. CISA has stepped in, which always triggers a scramble across federal agencies and contractors to patch before the audit window shuts. It's a familiar rhythm. A hole is found, it's seen in the wild, CISA adds it to the Known Exploited Vulnerabilities list, and every IT manager in North America spends their Friday wondering why a reboot takes four hours. The volume of this stuff is becoming a blur. This week alone, over 370 data breach stories hit the wire. Today alone there are 59 new reports. When failure is this common, it isn't an "incident" anymore; it's just a baseline cost of doing business; the tech sector (the most targeted this week with 314 total stories) is essentially paying a permanent "complexity tax". I remember a similar pattern from years ago, though on a smaller scale. Back then we focused on the single exploit. Now we have an "exploitation ecosystem, and between BlueMoon's kit and the AI agents used against PaperCut, attackers aren't just hunting for holes; they're building factories to find and fill them. The regulators are lagging behind, as usual. In Oslo and Brussels, people are still talking about "adequate technical and organisational measures. It's a phrase meant to mean everything and nothing; it lets regulators fine companies after a breach (like that recent $15 million DaVita ransomware settlement) without actually defining what "adequate" looks like before the attack happens. It's convenient for them; they collect fines based on the outcome instead of the process. For the people actually managing servers, it's an impossible standard. You're expected to defend against zero-day kits that combine browser and OS flaws while using tools like Artifactory that can be chained into admin access. Which brings us to the real question: at what point does the cost of defense exceed the value of the asset? We price in the risk of a breach, but we aren't pricing in total systemic trust collapse in our build pipelines. If you can't trust your browser or your Artifactory server, you're running your business on a set of hopeful assumptions. I suspect the next shift won't be a better firewall, but a move toward "disposable infrastructure" where nothing lasts long enough to be useful to an attacker. Until then, we can just update our SBOMs and watch the CISA alerts roll in. For now, I'll be watching the disclosure clocks for NetScaler victims, and most will likely miss their 72-hour GDPR reporting window (a lovely little windfall for regulators come next year).