The Secrecy Becomes the System

More than 270 Zimbra servers are sitting compromised right now, according to BleepingComputer's reporting this week, and the attacks are ongoing rather than historical. That number is not an abstraction. It is 270 organisations whose mail systems are, at this moment, in someone else's hands. The reason so many stayed exposed for so long has a name, and SecurityWeek gave it one directly: silent patches don't stop attackers, they blind defenders.

Put the Zimbra breach next to a second story from The Record, in which the UK government is seeking powers to secretly block suppliers it judges risky, and a pattern comes into focus that neither story states on its own. Two different institutions, a software vendor and a national government, have separately arrived at the same instinct: when something is dangerous, the right response is to manage it quietly rather than announce it plainly. The vendor's silence and the government's secrecy are not the same law, but they are the same reflex, and the public ends up carrying the cost of both.

The Zimbra case study

A silent patch is a fix that ships without a public advisory explaining what it repairs. The vendor closes the hole and says nothing, on the theory that quiet is safer than loud, that a published advisory is a map handed to attackers. It sounds reasonable until you notice who else reads changelogs for a living: the same attackers, plus every defender who relies on advisories to know what to check and when. Silence protects the vendor's reputation for having had a bug in the first place. It does not protect the customer who has no idea a patch matters until their server is one of the 270 that BleepingComputer counted.

That is the trade being made, quietly, on the industry's behalf: less embarrassment for suppliers, more risk for everyone downstream who was never told what changed or why. Defenders cannot prioritise a fix they don't know exists. They cannot check whether they are exposed to a flaw that was never described. The 270 servers are not 270 failures of individual security teams. They are 270 instances of the same missing piece of information, multiplied across every organisation that runs Zimbra and trusted the vendor to say something when it mattered.

SecurityWeek's framing is worth sitting with because it refuses the usual excuse. The industry has long treated silence as a form of caution, a way of not tipping off attackers who might read an advisory before defenders act on it. But attackers do not need an advisory to find a flaw they are already exploiting. Defenders do need one to know they are behind. The asymmetry runs entirely one way, and it ran that way for as long as it took to compromise 270 mail servers.

The UK's new instinct

The UK government is now seeking powers to secretly block suppliers it judges risky, according to The Record. Strip away the national security framing and the mechanism is identical to a silent patch: a decision gets made about what's dangerous, and the public is not told the basis for it. No published reasoning, no named supplier, no way for anyone outside the decision room to check the work or ask whether the judgement was sound.

Supporters will say some threats can't be discussed openly without giving attackers, or foreign states, a roadmap, which is exactly the argument vendors use for unpublicised patches. It may even be true in specific cases; there are plausible reasons a government would not want to announce which supplier it distrusts and why. But a government that can block a supplier in secret, with no public record, is asking to be trusted rather than checked, and that is a different thing from being accountable. There is no advisory to read, no reasoning to challenge, no way for a rival supplier, a journalist, or a parliamentary committee to test whether the block was proportionate or simply convenient.

Opacity that works for national security and opacity that works for corporate reputation management are not the same policy, and the stakes are not equivalent. But they train the public to accept the same posture: don't ask, we've handled it. Once that posture becomes normal in one domain, it becomes easier to defend in the next. A government comfortable blocking suppliers without explanation is a government whose officials will find it easier to accept a vendor's silent patch as adequate transparency too, because the standard for what counts as "enough disclosure" has already been lowered by its own practice.

Who actually pays

The public bears the cost of the blind spot in ways the decision-makers mostly don't. Mirage2FA phishing has hit 4,500 US and EU companies by abusing Microsoft 365 login flows, per The Hacker News, an attack that thrives precisely because organisations can't see the full pattern until it's already run through thousands of inboxes. A large DDoS attack knocked Norwegian public services offline this week, per The Record, disrupting services that ordinary people depend on rather than some abstract corporate target. Twenty-four npm packages were caught abusing unpkg mirrors to host fake Cloudflare CAPTCHA pages, a supply-chain trick that works because most developers have no reason to suspect a mirror they've used before. SecurityWeek is even reporting the first malware built specifically for car head units, feeding a botnet, which is as clear a sign as any that attackers are moving into categories of device the public hasn't been told to worry about yet.

The Hacker News also covered E4del and PINHOLE RATs turning FTP banners into dead drops for malware commands, a method that depends on defenders not looking closely at something as mundane as a banner message. None of this happens because defenders are careless. It happens because the information they need to defend well is being withheld, sometimes by vendors managing their image, sometimes by governments managing their secrets, and the withholding always lands on the same people: the ones without a seat in the room where the decision to stay quiet gets made.

The other model was available all along

WhatsApp's security update this week is the useful counter-example. BleepingComputer and SecurityWeek both covered it the same way: stronger two-step verification, multiple passkeys, explained plainly, with the change and the reasoning both public. Nobody had to guess what got fixed or why it mattered. Users can decide whether to adopt the new passkeys because they were actually told the passkeys exist and what they do. That is the entire mechanism of trust that silent patching throws away.

Police also arrested dozens of suspects in a global cybercrime crackdown this week, an operation that only works, and only earns public confidence, because the results get reported rather than filed away. A crackdown nobody hears about doesn't deter the next attacker and doesn't reassure the next victim. Disclosure is not a courtesy in these cases, it is the mechanism by which the work has any deterrent value at all.

Hands-on cyber-physical systems training is returning to the ICS Cybersecurity Conference, which is a small but telling signal in the other direction: the industry still believes, in some corners, that the way to build real defensive capability is to show people exactly how systems fail, not to keep the failure modes private. Schneier's write-up on the state of security vendors at Black Hat is a reminder that the industry already knows how to grade itself in public when it chooses to, and that the choice to do so or not is exactly that: a choice, not a technical necessity.

The choice, in both the Zimbra case and the UK's proposed powers, is not between safety and exposure. It's between two different groups deciding, on the public's behalf, that the public doesn't need to know. Zimbra's 270 servers are what that choice looks like once it's had time to run, and there is no reason to expect a secret supplier ban to age any better.