Vulnerability Management

Cybersecurity 6 min CISA Added Seven Exploited Flaws. Five Due in Three Days, Two in Fourteen. Five carry a three-day federal clock, two carry fourteen days, in a single batch. Three of the seven sit in AI... PR Priya Nair 4 Sep Cybersecurity 6 min SonicWall SMA1000's July Fix Is the Build This Advisory Now Calls Vulnerable Two new zero-days are being chained on SMA1000 appliances, in the same two components as the June pair. The Ju... KE Kenji Tanaka 3 Sep Cybersecurity 7 min PaperCut Was Being Exploited for a Day Before It Had a CVE Number The 27 August advisory confirmed active exploitation while carrying no identifier, no severity score and no vu... PR Priya Nair 30 Aug Cybersecurity 7 min Three Days to Patch. CISA's Deadline Used to Be Three Weeks. Every vulnerability CISA catalogued in the first week of August carried a three-day federal deadline. We measu... KE Kenji Tanaka 11 Aug AI & ML 7 min OpenAI Built a Hacking Model and Gave It to Sixteen Companies GPT-5.6-Cyber does vulnerability research and penetration testing, and reaches customers only through sixteen... AI AI Tools Desk 11 Aug Cybersecurity 6 min You Patched SonicWall in Three Days. That May Not Have Been Enough. Ransomware crews are now chaining two SonicWall SMA1000 flaws that CISA gave federal agencies three days to fi... KE Kenji Tanaka 11 Aug Cybersecurity 5 min Vulnerability Disclosures Will Pass Last Year's Record by August. The Share Anyone Actually Exploits Is Falling AI code scanning has pushed disclosures to 45,207 in seven months. Our own count of the exploited-vulnerabilit... CY Cyber Team 1 Aug Developer Tools 5 min A Critical Rails Flaw Reads Your Server's Files From an Image Upload — and Patching Rails Is Not Enough CVE-2026-66066 scores 9.5 and needs no authentication. The fix depends on a libvips version many deployments d... KE Kenji Tanaka 1 Aug Cybersecurity 6 min Four SharePoint Flaws Entered CISA's Catalogue in Twenty-Two Days — One Left a Single Working Day CVE-2026-50522 was exploited hours after proof-of-concept code appeared, and stolen machine keys survive the p... CY Cyber Team 29 Jul Cybersecurity 7 min CISA's Patch Deadlines Collapsed From 21 Days to Three — and It Started Four Months Before the Directive That Gets the Credit We measured every deadline in the KEV catalog's 1,653 entries. The 21-day window was retired on 5 March; BOD 2... CY Cyber Team 26 Jul Cybersecurity 6 min Microsoft's Largest-Ever Patch Tuesday: 600-Plus Fixes, Two Live Zero-Days, and a Triage Problem Microsoft's July update fixed more than 600 CVEs — its biggest ever — including two zero-days already under at... CY Cyber Team 20 Jul Cybersecurity 8 min CERT-In Orders 12-Hour Patching Window as AI Shrinks Exploit Timelines to Hours India's national cybersecurity agency has told organisations running internet-facing systems to patch, mitigat... KE Kenji Tanaka 1 Jun