A warned Vilnius Starlink site puts CISA’s 3-day patch clock in context

Editor’s Note: Lithuanian officials say a Vilnius Starlink site was warned a day or two before an arson attempt early Sunday; the fire was quickly put out. The same day, Estonia’s broadcaster ERR, summarizing an interview with the head of CERT-EE, the national cyber incident team, reported that vulnerabilities are now exploited within two to 24 hours. Earlier that week, every flaw the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities catalog carried a three-day federal due date.

For cybersecurity, information governance and eDiscovery professionals, the better question is when a deadline starts, not how long it runs. Under CISA’s Binding Operational Directive 26-04, a catalog listing cuts the deadline to three days in three of the five categories that carry it, and listing requires evidence that someone, somewhere, has exploited or tried to exploit the flaw. Starting earlier takes warnings that reach the owners of exposed systems; responding well takes evidence captured before patching and logs kept in advance.

Watch the Lithuanian investigation, still open as of Monday; Dec. 7, when federal agencies must meet the directive’s timelines; and the “Defence and digital resilience” discussion at the Tallinn Digital Summit on Nov. 5 and 6.

News Analysis – Cybersecurity Beat

A warned Vilnius Starlink site puts CISA’s 3-day patch clock in context

ComplexDiscovery OÜ Staff

Someone tried to set fire to a Vilnius site storing Starlink equipment early Sunday, a day or two after officials warned the company, and the blaze was quickly put out, Lithuanian officials said.

The same day, Estonia’s public broadcaster reported a two-to-24-hour exploitation window in its account of an interview with the head of the country’s computer emergency response team, who said defenders once hoped to have 30 days to update. Earlier that week, every flaw the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added to its exploited-vulnerabilities catalog came with a three-day federal due date. CISA’s guidance recommends hourly targets inside those three days for the most severe cases.

Taken together, the three accounts point to a variable that rarely makes the headline, and this analysis argues that the week is better read through when a defender’s clock starts than through how long it runs.

What happened at the Vilnius site

Prime Minister Mindaugas Sinkevičius disclosed the attempt on Facebook on Oct. 18. LRT, the Lithuanian public broadcaster, the German news agency DPA and Ukrainska Pravda all relayed the same account: officials had alerted the company that attacks were possible, protection at the site was raised, and the attempt failed. Speaking to LRT Radio later that day, Sinkevičius said someone tried at around 2 a.m. to set fire to satellite antennas and a control unit. Incendiary liquid was found, he said, along with containers with capacities of three to 10 liters.

Vilmantas Vitkauskas, head of Lithuania’s National Crisis Management Center, gave reporters a fuller picture. The fire was put out fast, property damage was minor and operations continued without disruption, he told Reuters, which placed the site on the outskirts of the capital. As far as the center knew, he told reporters in remarks carried by the BNS news agency, the company had been contacted a day or two earlier and given a warning of some kind. He added that complete security cannot be guaranteed and that companies receive such recommendations for good reason.

Both officials tied the attempt to Russia. Vitkauskas told Reuters it was part of Russian efforts to disrupt Starlink and so affect how Ukraine’s operations fare. Sinkevičius called it an attempted act of sabotage, said Russia was likely behind it and pointed to similar incidents in Poland and Bulgaria, while Defense Minister Robertas Kaunas confirmed the incident but said he could not yet give details. Responsibility has not been established, and as of Monday no one had been detained, Police Commissioner General Arūnas Paulauskas said, according to BNS. Presidential national security adviser Deividas Matulionis called Russia a likely suspect. After government and security officials met Monday, Sinkevičius said Lithuania would raise preparedness at critical infrastructure sites and assign more forces to them, Reuters reported.

Estonia puts a number on the window

That warning came before the attempt, and the Estonian figures suggest how little time defenders get once a vulnerability is known. They surfaced in a story about something else entirely. According to ERR, hackers spoiled food across hundreds of French grocery stores on Oct. 11, and the broadcaster then asked Estonian officials whether the country was exposed. Taavi Kupper, who heads the Incident Response Department, known as CERT-EE, at the Information System Authority (RIA), said AI had compressed the entire course of an attack.

“In the past, after discovering a vulnerability, we could hope for a 30-day update cycle before something might be compromised,” Kupper said, in ERR News’ English translation of his Estonian remarks. ERR reported, in its own words following the quotation, that a vulnerability is now exploited within two to 24 hours. The range is the broadcaster’s account of his assessment rather than a published measurement, and neither ERR report cites a dataset behind it.

Kupper’s agency had also sent a warning of its own. He told ERR that Estonia has only a handful of such internet-facing devices and that RIA had contacted every party involved with instructions for closing off access or applying countermeasures. Cyber Command chief René Innos told the broadcaster that military systems see around 100,000 incidents a day on average, a volume he said the command does not regard as a particular threat. He separately put serious incidents at about 20 to 30 a year.

Inside CISA’s three-day clock

Washington has written its own rules for that compressed window. CISA issued Binding Operational Directive 26-04 on June 10, warning that threat actors’ use of AI could shrink further the interval defenders get between a patch’s release and its exploitation. Its remediation table sorts flaws by four questions: whether the asset is publicly exposed, whether the flaw is in CISA’s Known Exploited Vulnerabilities (KEV) catalog, whether exploitation can be automated and whether it gives an attacker partial or total control.

The shortest timeline in the table is three calendar days, and it applies to five of the 16 combinations. Four of those five involve flaws already in the catalog. Three of the four, where a listed flaw gives total control and the asset is exposed or the attack can be automated, also require a forensic triage to check for compromise. The remaining row applies three days to an internet-facing flaw that can be exploited automatically and gives total control, even when it is not in the catalog. The clock starts when CISA lists the flaw or when an agency finds it on one of its assets and reports it to the federal monitoring dashboard, whichever comes first.

Inside those three days, CISA’s implementation guidance, last updated Aug. 25, recommends targets measured in hours. For catalog additions that require forensic triage, it suggests scoping the problem within two hours of the listing, preserving evidence and applying critical patches within two to 24 hours, and reaching an escalation decision within 48 to 72 hours. The guidance calls those timings recommended best practices and says the specific timeline is not required; what the directive requires is an adequate triage.

The catalog shows the clock at work. Nine vulnerabilities were added from Oct. 13 through Oct. 16, each with a due date three days after its addition, and eight of the nine are marked for forensic triage. CISA calculates those dates from the table and the exposure data available to it, and its guidance says each agency makes the final call asset by asset. The interval was not new last week: of the 92 entries added from Aug. 1 through Oct. 16, 74 carried a three-day date and 18 a 14-day one.

The directive binds federal civilian executive branch agencies, which must meet the table’s timelines within 180 days of issuance, or by Dec. 7, although some duties applied immediately. It covers systems that other entities operate on an agency’s behalf. It does not apply to contractors unless a contract says so, but agencies must review their contracts to decide what changes compliance requires. CISA also urges every organization, private industry included, to prioritize the catalog.

Where each clock starts

Those hourly targets address the speed problem ERR described, but they are measured from a catalog listing, and CISA lists a flaw only when there is reliable evidence of exploitation somewhere in the wild, a term that includes attempts. In three of the five three-day rows, catalog status is what shortens the deadline to three days, from 14 or 60 days without it. In a fourth, catalog status adds the forensic triage to a deadline that is already three days. An agency that found the flaw on its own systems first may already have a longer clock running. But in those three rows, the three-day deadline applies only after someone, somewhere, has exploited or tried to exploit the flaw.

The Ivanti Connect Secure flaw added Oct. 13 shows what that means for a defender. CISA said threat actors were already using it for credential theft and data exfiltration, and it warned that Ivanti’s own integrity checker may not detect the intrusion because the attackers’ commands run in memory. For an organization already compromised before the listing, the schedule governs response as much as prevention, although patching still blocks further exploitation of that flaw.

The directive does start some clocks earlier. Its non-catalog row sets three days without waiting for a listing, and an agency that logs a flaw on its own assets starts a timeline before any listing arrives. The Lithuanian warning worked at a different point in the sequence: by the officials’ accounts, it reached the company before the attempt rather than after one.

That comparison has limits, and one weekend proves little. None of the public accounts reviewed says what prompted the warning or how specific it was, Vitkauskas himself said complete security is impossible, and the investigation may yet change the account. A catalog listing is also a warning to every organization not yet hit. Google Threat Intelligence Group, part of a company that sells security products, reported Sept. 30 that only about 0.23 percent of vulnerabilities disclosed in 2026 through August, roughly 1 in 431, had been observed in active exploitation. The group used that figure to argue for threat-intelligence-driven triage over unprioritized mass patching.

What practitioners can take from the week

The gap between a flaw becoming known and a catalog listing is where practitioners have the most room to act. Security teams can apply the logic of the non-catalog row to their own systems by acting on exposure, automation and impact before a listing arrives. Vendor advisories, threat intelligence and a sector response team can all move the trigger earlier than a catalog entry does. RIA’s approach, as Kupper described it, shows the other half of the job: getting the warning to the people who own the exposed asset, with instructions they can act on.

Information governance and eDiscovery teams have a stake in what happens inside the clock. CISA’s guidance recommends capturing memory and other volatile data in the first hours of a triage, before patching can destroy it. It also recommends a collection log recording each item, its source system, the time and the collector. That evidence goes only so far without logs retained beforehand, so retention schedules for security telemetry, and a legal hold process that can reach that telemetry quickly, belong in the same planning as patch timelines. The forensic triage report itself, CISA’s guidance says, serves as an agency record.

Warnings deserve the same treatment. A dated log of each warning received, who received it and what was done in response is the kind of record that later establishes what an organization knew and when. Building that log is work that security, information governance and legal teams share.

A question to carry to Tallinn

That question has an obvious next venue in Tallinn. The Tallinn Digital Summit is scheduled to open Nov. 5, in 17 days. The second of its three stated challenges is “Defence and digital resilience amid geopolitical tensions,” covering hybrid and cyber threats and the protection of critical infrastructure. Lithuania’s response on Monday, more protection at critical sites in advance, gives that discussion a concrete hybrid case, and Estonia’s exploitation estimate gives it a cyber one.

The Vilnius company got its warning a day or two before the fire. How early does a warning reach the people who own your exposed systems, and who in your organization starts that clock?

News sources

• BOD 26-04: Prioritizing Security Updates Based on Risk (Cybersecurity and Infrastructure Security Agency)
• BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk (Cybersecurity and Infrastructure Security Agency)
• Reducing the Significant Risk of Known Exploited Vulnerabilities (Cybersecurity and Infrastructure Security Agency)
• Known Exploited Vulnerabilities Catalog (Cybersecurity and Infrastructure Security Agency)
• CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (Cybersecurity and Infrastructure Security Agency)
• Taavi Kupper is the new head of the Incident Response Department of RIA (Estonian Information System Authority)
• Eksperdid: ka argised kodumasinad võivad küberrünnaku sihtmärgiks sattuda (ERR)
• Experts: Everyday household appliances can be targeted in cyberattacks (ERR News)
• Attempted arson at Lithuanian firm storing Starlink equipment, PM blames Russia (LRT)
• Suspects in attempted arson at SpaceX-linked facility in Vilnius remain at large (LRT)
• Lithuania says Russia likely behind attempted arson at Starlink site (DPA via Yahoo News)
• Attempted arson attack targets Lithuanian company storing Starlink equipment (Ukrainska Pravda)
• Lithuania says attempted Starlink arson was Russia-linked sabotage (Reuters via Internazionale)
• Lithuania to Increase Security at Critical Infrastructure, Prime Minister Says (Reuters via U.S. News & World Report)
• NKVC vadovas: bandyta padegti „SpaceX“ nuomojamas patalpas su „Starlink“ įranga (LRT and BNS)
• Vulnerability Discovery and Exploitation Trends in the AI Era (Google Threat Intelligence Group)
• Tallinn Digital Summit 2026 (International Centre for Defence and Security)
• Tallinn Digital Summit 2026 puts the agentic state to the test (ComplexDiscovery)

Assisted by GAI and LLM Technologies

Additional reading

• Refrigeration hack affected about 700 French supermarkets, government says, as Danfoss interfaces stay online
• MonsterCloud indictment exposes the ransom payment a victim’s own file may not record
• Wikimedia publishes its own account of suspected OpenAI agent activity on its wikis
• Cyber Law Toolkit tests AI deception, cyber torture and peacetime cyber duties
• ENISA Threat Landscape 2026 finds DDoS leads incident counts while ransomware stays most impactful in the short term
• Cyber Resilience Act reporting starts Sept. 11 on an unfinished platform

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more understandable for practitioners, policymakers, and business leaders.