Three days to patch, and the third one lands on a Saturday

Yesterday, Friday 14 August, two deadlines from CISA's known exploited vulnerabilities catalog expired. Today is Saturday, it is 15 August, and it is a non-substitutable public holiday across Spain. Nobody engineered the coincidence, but it describes fairly well how the security calendar works: the clock is set by whoever publishes the advisory, and whoever has to answer is on holiday.

What changed on 10 June

That day CISA published directive BOD 26-04, which threw out the old single deadline and replaced it with four variables: whether the asset is exposed to the internet, whether the flaw is in the known exploited vulnerabilities catalog, whether the attack can be automated, and whether it grants total or partial control of the system. Depending on the combination there are five possible outcomes: three days with mandatory forensic triage, three days without it, fourteen, sixty, or waiting for the next upgrade cycle. The directive is blunt about why it squeezes: AI is shortening the time between a flaw being published and someone turning it into an attack that works.

We downloaded the catalog's JSON file on 15 August —version 2026.08.14, published yesterday at 16:34 UTC, with 1,665 entries— and counted. Of the 48 vulnerabilities added since 10 June, 42 carry a three-day deadline and the other six, fourteen days. Earlier in 2026, before that date, the most common tier was 14 days with 55 entries, followed by 21 days with 44. The 21-day tier has not appeared in a single new entry since June.

It binds US federal civilian agencies and nobody else, as we said yesterday. But as somebody else's calendar it beats almost any vendor bulletin: it is the public list of what is being exploited right now, written by people with real telemetry.

The clock starts in office hours and expires when nobody is there

This is where the counting gets interesting. Of the 181 entries added to the catalog in 2026, not one was published on a Saturday or a Sunday. The spread is textbook office hours: 52 on Tuesdays, 37 on Mondays, 33 on Wednesdays, 33 on Thursdays and 26 on Fridays. Nobody adds a flaw on a Sunday afternoon.

Deadlines, on the other hand, are calendar days. So you only have to add three to the publication date to see where those 42 short-tier advisories land:

August has twelve due dates in the catalog. Two fall on a Saturday: the 1st (Cisco's firewall manager, the FMC) and the 8th (JetBrains TeamCity). Two more expired yesterday, Friday the 14th: the ASA flaw we wrote about yesterday and the Metabase one. The last, the Windows AFD driver, is due on the 25th. Nobody is claiming attackers consult the Spanish public holiday calendar. The data says something else, and it is harder to argue with: whoever publishes works Monday to Friday; whoever answers has to be there on Sunday.

What the survey measures, and what it does not

There is a study doing the rounds these days that deserves a careful read. Semperis commissioned Censuswide to survey 1,500 IT and security professionals across ten countries, Spain among them, and published it in November 2025. The headline is that 52% of those who said they had been attacked place the attack on a weekend or holiday. The second figure is the one that actually stings: 78% of companies cut their security operations centre staffing by at least half on those days, and 6% leave it with nobody at all.

It is a self-reported survey: it measures what people remember and what people do, not a time series of real attacks. That more attacks happen on Sundays is a reading the survey does not support; what it does support is that on Sundays you respond with fewer people, which is a different problem and quite bad enough. And there is a third figure that explains the other two better than any analysis: among the reasons for cutting on-call cover, 62% say work-life balance, 47% say the business is closed, and 29% say they did not think they would be attacked.

In August detection is not what fails: the signature is

The EDR agent does not go on holiday. The alert fires on 15 August exactly as it does on 15 March, and it reaches whoever it should if the alerting is well designed —we wrote about that when we covered which alert deserves to wake somebody up—. What breaks in August is what comes after the alert, and it is always the same scene: there is a compromised machine, there is an obvious action, and the person who can authorise it has their phone on a bedside table 400 kilometres away.

At three in the morning nobody asks how to isolate a server. They ask whether they are allowed to:

That last one is what really decides how long an incident lasts. If the answer is not written down beforehand, the default answer is to watch: nobody disconnects somebody else's production at three in the morning without a piece of paper behind them. And while that paper is being hunted down, the encryption is on its second server.

The containment mandate, in writing

It is half a page and it prevents most of the damage. You do not need a forty-page continuity plan; you need these four things settled before August:

What you can actually get done this week

Four things that fit into one August afternoon, with half the team away:

The cross-check from point 3, for anyone who wants to copy it as is. It lists everything with a due date from here on:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[]
      | select(.dueDate >= "2026-08-15")
      | "\(.dueDate)  \(.cveID)  \(.vendorProject) \(.product)"' | sort

Put into a weekly cron against the vendor list you actually run, it is half an hour of work and it removes your dependency on finding out through LinkedIn. The useful thing is to treat it as one more input to the on-call rota: if something shows up that is in the inventory, a ticket gets opened.

What we do not touch in August

The other side of this matters just as much, and it cuts against the habit of using the quiet weeks for the big jobs. August is no month to swap the network core or migrate the directory, and not because the change is riskier: rolling back takes people, and in August the person who knows how to undo it is at the beach. A change you cannot undo is a bet.

The same goes for backups. Restoring in August is exactly as slow as in March, except the person who knows what order to bring things up in may be unreachable. We covered it with this year's report figures: restoring is not recovering, and the difference between those two words is measured in available people.

When you do not need 24x7 cover

We sell that service, so read this with an eyebrow raised, and even so: some companies do not need it. If your business can sit idle from 1 to 31 August without losing money, breaching a contract or a single customer noticing, paying for permanent cover is throwing money away. Four-hour response in business hours is more than enough.

All we ask is that it gets written down: "we accept being out of service until 1 September", signed by whoever is in charge. That is a perfectly legitimate decision. What is not legitimate is failing to make it and calling that a plan. Writing that sentence is harder than it looks, and that is where the service level actually needed shows up.

The short version

What you can settle this afternoon is half a page: what your on-call engineer can do without asking, who they call when they cannot, and what they do if nobody picks up. If reading that does not bring a name to mind, that is the gap, and no product fills it.

Sources (consulted on 15 August 2026): added dates, due dates and entry counts — CISA KEV catalog, JSON file version 2026.08.14 (1,665 entries). The weekday and deadline-tier counts are our own, computed over that file: anyone can reproduce them with the command above. Prioritisation criteria and the three, fourteen and sixty day tiers — directive BOD 26-04 (10 June 2026) and Tenable's analysis of it. Attack and staffing figures for weekends and holidays — Semperis' 2025 Ransomware Holiday Risk Report with Censuswide (1,500 IT and security professionals across ten countries, published 24 November 2025); it is a self-reported survey and should be read as such. 15 August as a non-substitutable public holiday in Spain — resolution of 17 October 2025 published in the BOE. CISA's directive binds US federal agencies; for everyone else it is a priority reference, not a legal obligation.