A web shell is a file on disk with a URL attached to it. The fixed build closes the pre-auth path into the appliance [1], but that file stays on disk, untouched by the patch [2]. So the KEV entry is two work items, and the three-day deadline measures only the one with a progress bar [3]. The other is comparing the appliance filesystem against a known-good image and working out which credentials the box could reach while it was open.
The Taiwan intrusion reads as a scheduling problem more than a capability one. Dream Security's analysis puts 12 documented waves in roughly four days, July 1 to 4 [7], which averages three waves a day [1], with up to eight lettered sub-agents running in parallel inside a wave and agents A through Q seen across the campaign [6]. The archive Dream recovered held 1,395 operational files [11]; spread across those waves, that is about 116 artefacts per wave [2]. The framework scored 14 attack chains with Bayesian priors and ran what its own documentation calls Learning Cycles, searching vulnerability databases, GitHub and security publications when a technique failed [12]. That is the part worth planning against: the loop from failed technique to next technique closed without a human deciding to go and look something up. The guardrail bypass was a cover story, not a jailbreak; the operators framed the work as authorised penetration testing, according to Dream [13].
The outcome numbers deserve the same scrutiny as a vendor benchmark table. The roundup credits the campaign with 85 cracked accounts [8], roughly seven per wave [3]. For that rate to say anything about your estate, your lockout thresholds and your credential reuse would have to resemble the target's, and the published material does not describe either.
The same source carries two volumes for the data taken: 2,500-plus personnel records in its summary [8], and hundreds of personnel records from unauthenticated API endpoints in the detailed write-up [9]. Those describe different incidents in size, and the discrepancy calls for quoting the range and naming which figure came from where.
The findings a defender can act on here are the dull ones: endpoints serving personnel records with no authentication at all [9], and a signature validation flaw in the government's personal authentication service [10]. The backdoors the agents installed outlasted the four days of activity [10]. The holes were already there; multi-agent orchestration simply shortened the distance between finding them and using them. And the operation ran automated Learning Cycles against vulnerability databases while its own directory permissions [11] went unchecked.
