AI Makes Attackers Faster, So Patching Must Keep Up: What MODA's 72-Hour Expectations Mean for Vulnerability and Data Protection

AI is helping attackers exploit known vulnerabilities faster, so businesses need to reorganize patching, access control and incident reporting around a 72-hour window.

On November 11, 2026, Taiwan's Ministry of Digital Affairs (MODA) said it had received reports from more than 10 companies hit by attacks or personal data leaks, and that preliminary investigation linked most of them to AI-driven attacks. The Administration for Digital Industries also set out five actions for e-commerce platforms and IT service providers, several of them with a 72-hour deadline. For small and mid-sized businesses this is not just a big-platform problem: any website, membership system or back-end API that holds customer data sits on the same attack path.

What these attacks look like: fast, aimed at personal data, built on known flaws

The short version: attackers are mostly not using brand-new techniques. They are using AI to exploit vulnerabilities that are already public, faster.

According to Central News Agency (CNA), Minister of Digital Affairs Lin Yi-ching said five or six of the reporting companies are relatively large. The attacks are very fast, use AI tools to tailor methods to different vulnerabilities, and target personal data, which is often resold to fraud rings. He noted that direct financial losses are relatively small; the larger damage is indirect losses and harm to brand reputation.

Administration for Cyber Security Director General Tsai Fu-lung explained that attackers exploit known high-risk vulnerabilities in software such as PHP, Node.js and GitLab, then use high-privilege APIs to pull personal data in bulk. He advised companies to patch quickly and tighten system access control, and said platform operators, which hold large amounts of brand customers' data, are expected to face stricter security requirements.

Patch windows are shrinking, and "we'll update next month" is too late

The short version: the time from disclosure to real-world exploitation is now measured in days, not weeks.

Rapid7's Global Threat Landscape Report, released in March 2026, found that exploited high and critical-severity vulnerabilities rose 105%, from 71 in 2024 to 146 in 2025. The median time from publication to inclusion in the US CISA Known Exploited Vulnerabilities (KEV) catalog fell from 8.5 days to 5.0 days, and the mean fell from 61.0 days to 28.5 days. In the words of Rapid7 chief scientist Raj Samani, "Exploitation timelines are increasingly measured in days rather than weeks."

A recent example is PHP. On October 21, 2026, the PHP project released security updates fixing two remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each with a CVSS v4.0 base score of 9.2. TWCERT/CC said every PHP environment that handles web requests is affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier no longer receive official updates (a minimal source-code patch is provided separately), and PHP 8.2 reaches end of life on December 31, 2026.

TWCERT/CC also reminded organizations to check PHP-based content management systems such as WordPress, Drupal, Joomla and Magento, and, if a website is maintained by an outside vendor, to confirm the PHP version and patch status with that vendor. If an update cannot be applied right away, consider isolating the public-facing system from the internet or suspending the service, and check whether a backdoor has already been planted.

MODA's five actions, most of them on a 72-hour clock

The short version: regulators now have a clear expectation of how fast companies should act once a problem is found.

According to the Commercial Times, Deputy Director General Huang Ya-ping of the Administration for Digital Industries set out five actions for e-commerce platforms and IT service providers:

When the National Institute of Cyber Security or the cybersecurity authority issues a major warning about a piece of software or equipment, complete updates, patches, feature shutdowns or other protective measures within 72 hours.
Report to the competent authority within 72 hours.
Notify affected individuals within 72 hours, including a warning about possible fraud risks.
If data is leaked, find the cause, fix the vulnerability, disable features or take other effective measures within 72 hours to stop further damage.
Submit a review and improvement plan within one month after the incident, and apply the "data minimization principle" to shrink the attack surface.

CNA also reported Huang as saying that, under the rules, digital businesses that suffer a personal data incident should report it to MODA within 72 hours, notify affected customers by email, text message or phone with a way to check details, and submit a review and improvement plan within one month. She added that MODA's administrative inspections are meant to help companies respond, not to punish them.

The government's line of defense: AI against AI, but the basics are still on you

The short version: the government will supply threat intelligence and tools, but inventory, patching and backups are still the company's job.

At the 2026 Taiwan Cybersecurity Incident Response Annual Conference on November 3, Deputy Minister Yang Chia-ling announced that MODA had formed an advanced AI cybersecurity risk response task force, so ministries and critical infrastructure regulators can share information quickly. Short-term measures include inventorying critical systems, reducing external exposure, considering retiring legacy systems, publishing patching guidance and scanning key systems with AI tools.

On November 11, Lin said the government has obtained AI models from four companies, Anthropic, OpenAI, Google and Microsoft, to help ministries scan for vulnerabilities, and plans to help private companies access such tools. Companies can also join TWCERT/CC's threat intelligence sharing for free.

At the November 3 conference, Tsai was blunt: the priority is getting the basics right, meaning less exposure and reliable backup and redundancy. Lin also said on November 11 that companies should protect themselves first and find vulnerabilities before attackers do, rather than waiting for government orders.

Why high-privilege APIs matter so much here

The short version: a single over-privileged API can turn one vulnerability into a bulk data leak.

The attack path Tsai described is to get in through a vulnerability, then pull data in bulk through a high-privilege API. If a back-end API uses one shared high-privilege account to access the whole member database, with no limit on records per query or call frequency, an attacker who gets in needs almost no extra steps to carry the data away.

That is why the Administration for Digital Industries wrote the data minimization principle into its five actions: the less data you keep and the fewer fields an API can see, the less damage the same vulnerability can do. Rapid7's report adds that 43.9% of its incident response investigations in 2025 involved valid accounts with missing or lax multi-factor authentication, so accounts and permissions are an entry point too.

Recommendations for businesses

The short version: rehearsing what you can actually do within 72 hours matters more than buying new tools.

List every public-facing system with its language and framework versions (PHP, Node.js, GitLab and so on). Prioritize upgrades for PHP 8.1 and earlier, and schedule PHP 8.2 upgrades before year-end.
Confirm patch deadlines in your contracts with outsourced maintenance vendors, so that updating or temporarily disabling a feature within 72 hours of a major warning is an executable process, not something negotiated after the fact.
Review permissions on back-end and public APIs: remove shared high-privilege accounts, limit records per response and call frequency, and enable multi-factor authentication for admin accounts.
Check whether you really need to keep all member and order data, and delete or mask unnecessary fields under the data minimization principle.
Prepare templates for personal data incident reports and customer notifications in advance, and join TWCERT/CC threat intelligence sharing so warnings reach the right person immediately.

JIE HENG Information is ISO/IEC 27001:2022 certified and provides enterprise process system integration as well as security operations for government and campus systems. Whoever maintains your systems, the 72-hour expectation is a good reason to revisit your maintenance contract and patching process.