What Happened
Over the past few weeks, the cybersecurity landscape has shifted in ways that should concern every business leader in India — especially those running SMBs without dedicated security teams.
First, Google Chrome faced a critical zero-day vulnerability that earned a $90,000 bug bounty. This wasn't a theoretical flaw; attackers were actively exploiting it in the wild before Google patched it. Simultaneously, ShinyHunters targeted Rockstar Games, one of the world's largest gaming studios, demonstrating that even companies with massive security budgets aren't immune. In parallel, a ShowDoc vulnerability began circulating in exploit databases, and threat actors weaponized it quickly against unsuspecting organizations.
What ties these incidents together? They all represent the gap between when a vulnerability is discovered and when organizations actually patch it. That window — sometimes just hours — is where attackers hunt.
Why This Matters for Indian Businesses
If you're running a business in India without actively monitoring for zero-days, you're gambling with your data and your regulatory standing.
Under the Digital Personal Data Protection (DPDP) Act, 2023, Indian businesses are legally required to report data breaches within timelines set by CERT-In — critical incidents within 6 hours. But if your systems are compromised through an unpatched zero-day, you won't know it happened in time to meet that deadline. The ShowDoc vulnerability is particularly concerning for Indian healthcare and e-governance sectors, where document management is critical and patch cycles are often quarterly or slower.
For any SMB that processes customer data, the consequences of a zero-day breach include:
- Regulatory exposure under DPDP Act
- Reputational damage that directly impacts customer trust in a referral-driven market
- Operational downtime while scrambling to respond
- Incident response costs that can exceed an annual security budget
Technical Breakdown
How Zero-Days Propagate
graph TD
A[Researcher Discovers Vulnerability] -->|Reports to vendor| B[Vendor Develops Patch]
B -->|Patch released| C[Organizations Begin Patching]
D[Attacker Finds Same Flaw] -->|Exploits before patch| E[Breach Occurs]
E -->|Exploit details leak| F[Mass Exploitation Begins]
B -.->|Window of vulnerability| E
C -.->|Delayed patching| F
style A fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
style C fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
style D fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
style E fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0Attack Flow: From Vulnerability to Breach
sequenceDiagram
participant User as Employee Browser
participant Chrome as Vulnerable Chrome
participant Attacker as Attacker Server
participant Network as Internal Network
User->>Chrome: Opens malicious website
Chrome->>Chrome: Executes unpatched code
Chrome->>Attacker: Sends system info
Attacker->>Chrome: Injects backdoor
Chrome->>Network: Backdoor gains network access
Network->>Network: Lateral movement beginsThe ShowDoc Vulnerability Deep Dive
ShowDoc, a document management system used across industries, had a critical flaw allowing unauthenticated remote code execution (RCE). The attack vector was simple:
# Simplified example of the vulnerability attack vector
curl -X POST http://target-showdoc-instance/api/upload \
-F "file=@malicious.php" \
-H "Content-Type: multipart/form-data"
# If unpatched, this bypasses authentication and executes codeOnce an attacker gains RCE, they can:
- Enumerate the system to find databases and sensitive files
- Steal credentials from configuration files
- Move laterally to other systems on the internal network
- Exfiltrate data without triggering traditional alerts
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanHow to Protect Your Business
| Protection Layer | Action | Difficulty | Time to Implement |
|---|---|---|---|
| Immediate Patching | Enable auto-updates for Chrome, Windows, and critical apps | Easy | 30 mins |
| Vulnerability Scanning | Run weekly VAPT scans to identify ShowDoc and similar exposures | Medium | 1 day |
| Network Segmentation | Isolate document management systems from general network | Hard | 1-2 weeks |
| Endpoint Detection | Deploy EDR tools to catch exploitation attempts in real-time | Hard | 2-3 weeks |
| Incident Response Plan | Document your CERT-In notification process | Medium | 2-3 days |
Quick Fix: Enable Automatic Updates
Start here. This single step would have protected against the Chrome zero-day:
# On Windows — use Group Policy to enforce Chrome auto-update
# Open Group Policy Editor
gpedit.msc
# Navigate to: Computer Configuration > Administrative Templates > Google > Google Chrome
# Set "Default Update Policy Override" to "Always allow updates"# Force Windows Update on all machines (run as Administrator)
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoRebootIdentify Vulnerable Applications
# Quick inventory of critical software versions
echo "=== Software Inventory ==="
chrome --version 2>/dev/null
openssh -V 2>/dev/null
apt list --installed 2>/dev/null | grep -E "(apache|nginx|mysql|php)"
# For Windows
wmic datafile where name="C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" get VersionSubscribe to CERT-In Alerts
CERT-In publishes a daily vulnerability advisory feed. Every Indian SMB security contact should be subscribed. This is the fastest way to learn about zero-days affecting software you're running.
How Bachao.AI by Dhisattva AI Pvt Ltd Detects This
Bachao.AI was built to give Indian SMBs the same zero-day visibility that enterprise security teams have:
Cloud Security Audit — If you're hosting ShowDoc or similar tools on AWS/GCP/Azure, our audit identifies misconfigurations that expose these systems to the internet.
Dark Web Monitoring — We continuously scan dark web databases for your domain, employee credentials, and software versions. If a zero-day exploit affecting your stack is being traded, we alert you immediately.
Incident Response (24/7) — If you're breached through a zero-day, our incident response team handles CERT-In notification within the 6-hour mandate, preserving your legal standing under DPDP Act.
What Indian Businesses Should Do Now
- Audit your software inventory — You can't patch what you don't know you're running
- Enable auto-updates — Make this non-negotiable for all critical systems
- Subscribe to CERT-In alerts — India's cybersecurity agency publishes zero-day warnings daily
- Run a vulnerability scan — Identify ShowDoc, unpatched Chrome, and other exposures
- Document your incident response process — CERT-In requires notification within 6 hours; you need a written plan
- Test your backups — When (not if) you're hit, you need clean data to restore from
Frequently Asked Questions
Q: How quickly do attackers exploit a newly disclosed zero-day? A: Research shows that exploitation begins within 15 minutes of public CVE disclosure for high-profile vulnerabilities. For widely-used software like Chrome, weaponized exploit code often appears within 24-48 hours of patch release.
Q: ShowDoc is niche software. Why should I care? A: ShowDoc is representative of a class of vulnerabilities: document management, project management, and internal tooling that businesses deploy without treating as security-critical infrastructure. If it's on your network and reachable from the internet, it's an attack surface.
Q: Does CERT-In publish zero-day advisories for Indian businesses? A: Yes. CERT-In publishes vulnerability notes (CIVN) that cover critical CVEs affecting commonly used software. Subscribe to their mailing list and RSS feed.
Q: What's the minimum patching SLA my business should have? A: Critical severity (CVSS 9.0+): patch within 24 hours. High (7.0-8.9): within 7 days. Medium: within 30 days. These align with what CERT-In expects as "reasonable security measures" under DPDP.
Q: Is there a cost-effective way for Indian SMBs to monitor for zero-days? A: Yes. CERT-In advisories are free. Bachao.AI's VAPT scan provides automated vulnerability detection against your actual software stack. Combining both gives you a practical, affordable zero-day monitoring posture.
Protect your business with Bachao.AI — India's automated vulnerability assessment and penetration testing platform. Get a comprehensive security scan to identify zero-day exposures in your web applications and infrastructure. Visit Bachao.AI to get started.
Originally reported by SecurityWeek
Written by Shouvik Mukherjee, Founder of Bachao.AI (Dhisattva AI Pvt Ltd). Follow him on LinkedIn for daily cybersecurity insights for Indian SMBs.