The $700 Million Patch Equifax Never Applied
One unpatched web server. That is the entire story. Everything after it is just the body count. In March 2017, the Apache Struts project disclosed a critical vulnerability, CVE-2017-5638, and shipped a fix in the same window. It was free. It was public. It came with a clear advisory. One of Equifax's web applications, a consumer dispute portal, was running a vulnerable version of Struts. The patch existed and sat there. Nobody applied it where it counted. By mid-May, attackers were already insid
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.