Why vulnerabilities are like buses

Summary

The NCSC outlines a growing pattern where a high-profile, mass-exploited vulnerability in a product is frequently followed by additional critical flaws in the same product being found and exploited. Organisations often rush to apply emergency patches for the initial issue, only to face further exploitation when subsequent vulnerabilities are discovered. The blog explains why this happens and offers practical steps organisations can take to better protect freshly patched software from future attacks.

Key Points

Once a single vulnerability is found and exploited, adversaries and researchers are incentivised to look deeper at the same product, often revealing more flaws.
Responding teams usually focus on rapid, out-of-band patches for the immediate issue rather than deep remediation, leaving other weaknesses in place.
Attackers can move faster than vendors to find and weaponise follow-up vulnerabilities after an initial exploitation becomes public.
Reducing attack surface (disabling unused interfaces, hiding admin panels, removing legacy components) helps protect systems between patches.
Network restrictions, review of authentication/authorisation, and ensuring systems remain patchable are key defensive measures.
Use real-world cases to test and improve monitoring so you can detect suspicious activity on patched systems sooner.
High-pressure patch events can be leveraged to secure senior buy-in and funding for longer-term security improvements.

Why should I read this?

Short version: if you rush in, patch one flaw and think you’re done — think again. This piece is a quick heads-up from NCSC on why more bugs often follow a big exploit and what to do about it. Read it to avoid being surprised by the next ‘bus’ and to get simple, practical steps you can act on straight away.

Author

Punchy take from David C (Technical Director for Platforms Research, NCSC). The advice is pragmatic and directly relevant to those who manage internet‑facing services — treat it as operational guidance, not just theory.

Context and relevance

This guidance is particularly useful for security teams, IT managers and SMEs running public‑facing software. It ties into wider trends in vulnerability research and mass exploitation (for example, issues like ProxyShell and Log4j) and underlines the need for both rapid patching and proactive hardening. Use this as a checklist during and after emergency patch activity to reduce your exposure to follow-up exploits.

Source

Source: https://www.ncsc.gov.uk/blog-post/why-vulnerabilities-are-like-buses