vulnerability-management
18 posts
NVD stopped, your scanner didn't notice
NVD enrichment is no longer keeping pace with CVE volume. What that breaks inside vulnerability management programs, and what operators must now own.
CVE-2026-44843 turns one message into credential theft
CVE-2026-44843 collapses the boundary between chat message receipt and credential disclosure. What failed, what is not confirmed, and what must change.
The dashboard pushed every critical CVE to GitHub
Technical analysis of a unified vulnerability dashboard pushed to a public GitHub repo, the scanner token blast radius, and what defenders actually see.
The kernel commit lands. Your fleet is exposed.
Linux kernel CVEs publish without distro pre-notice. The exposure window opens at upstream commit, not at advisory. Measure the right number.
Your hosting panel is your attack surface
Active cPanel exploitation is a control plane compromise. The boundary failed before the login form. Operator briefing on what that means.
A CVE number, a label, and nothing else
CVE-2026-31431 Copy Fail is a published identifier. Mechanism, scope, and patch status are not confirmed. Treat it as a pointer, not a flaw description.