Patched Isn't the Same as Clean: Why Updates Don't Always Remove Hackers
They installed the patch. The hackers were already inside.
In early October 2026, security researchers reported that attackers exploiting two Citrix NetScaler zero-day vulnerabilities had planted web shells, a type of hidden backdoor, on vulnerable devices. The striking part: those backdoors persisted across firmware updates on more than 1,200 devices whose owners had already applied the available patch.
Those organizations followed the advice every IT professional gives. They patched. And attackers kept their access anyway.
How this happens
A zero-day is a flaw attackers exploit before the vendor has a fix. During that window, criminals scan the internet for vulnerable devices and break in automatically. Many of them don't do anything right away. They leave a backdoor and come back later.
When the patch arrives, it fixes the flaw. It doesn't necessarily look for or remove files an attacker already planted. So the front door gets a new lock, while the intruder is already sitting in the back room with a copy of the key.
Why small businesses should care
You may not run Citrix NetScaler. But nearly every business in Wesley Chapel and Tampa Bay has something similar on the edge of its network: a firewall, a VPN for remote workers, a remote desktop gateway, or a router with remote management turned on.
These edge devices are prime targets because they face the internet around the clock and often have direct access to everything inside. Over the past few weeks alone, actively exploited flaws have been reported in Cisco, Citrix, and Zyxel network equipment.
A smarter approach to patching
Patch management is still the foundation. But it works best as a process, not a single step:
1. Prioritize what faces the internet. Firewalls, VPNs, and remote access tools get patched first, ideally within days of a critical release.
2. After a critical flaw, hunt, don't just update. Check the vendor's guidance for signs of compromise. Look for unknown files, new admin accounts, and unusual configuration changes.
3. Rotate credentials. Change admin passwords and VPN credentials that passed through an affected device. Stolen credentials survive patches too.
4. Watch the logs. Security monitoring that flags strange logins or outbound connections can catch a backdoor in use.
5. Retire unsupported hardware. If a device no longer gets security updates, it can't be fixed at all. Replace it.
What this means for insurance agencies
Rule 69O-128.032 asks Florida licensees to regularly assess and adjust their safeguards. A documented process that includes post-patch verification shows your agency isn't just checking a box. It's also the kind of detail cyber insurers increasingly ask about after a claim.
The takeaway
Keep patching. It matters more than ever. Just remember that the update is the start of the job after a critical vulnerability, not the end of it. The question isn't only "Are we up to date?" It's also "Did anyone get in before we were?"
Main Event Managed Services handles patching, monitoring, and edge device security for small businesses and insurance agencies across Tampa Bay. Learn more at maineventmsp.com.
Sources: DIESEC Top 5, Oct 2, 2026 · CyberOne weekly report, Week 40
