Install DesignXSave it to your home screen for one-tap access.
Sample dataset · not a live feed
Threats, vulnerabilities & security advisories.
A continuously updated intelligence feed covering the technologies DesignX builds, hosts, connects, manages and protects — so Kenyan businesses can see which risks apply to them, and what to do next, before an attacker does.
Illustrative counts computed from the sample records below — not current vulnerability statistics. The production feed publishes live counts from the source catalogues.
What we monitor
Security intelligence scoped to what we actually run.
We do not republish every CVE in existence. We track the platforms our clients depend on — and the vulnerabilities that reach them.
A hidden backdoor was published inside the XZ compression library that nearly every Linux distribution ships. On affected builds, an attacker with SSH access could take root without a password prompt and without leaving a trace in the SSH log.
Backdoor planted in the XZ Utils compression library
CriticalKnown exploitedCVE-2024-3094
What happened
The backdoor was introduced upstream in the XZ Utils release tarballs published on 30 January 2024 and was picked up by several distributions that rebuilt packages from those tarballs. It activates through a malicious systemd unit that reaches the SSH daemon, letting an attacker who can open an SSH session authenticate with a crafted public key and run commands as root. Whether a machine is reachable depends on how the package was built, so exposure differed between distributions and installation methods.
Affected software
xz-utils / liblzma 5.6.0 and 5.6.1, including operating system packages rebuilt from those tarballs. Earlier releases of XZ Utils are not affected by this record.
What to do
Check for the malicious unit. On an affected build, the package installs a systemd unit that does not belong on a healthy system. Inspect the package contents and list any xz-related service before assuming the host is clean.
Rebuild from a fixed source. Install a distribution package published after the fix, or rebuild from an XZ Utils tarball other than 5.6.0 / 5.6.1.
Rotate SSH keys. The backdoor was designed to accept attacker-supplied public keys. Rotate keys and review authorized_keys on every host that ran the affected build, particularly for root access.
Harden remote access. Disable SSH password authentication, require MFA on administrative access, and alert on any new root-level key appearing in authorized_keys.
A race condition in OpenSSH’s signal handling lets a remote, unauthenticated attacker run code as root on glibc-based Linux servers under specific conditions. Exploitation needs no credentials, only precise timing.
Remote code execution race condition in the OpenSSH server (regreSSHion)
HighKnown exploitedCVE-2024-6387
What happened
The flaw sits in the way the OpenSSH server handles signals during the login flow. On a glibc-based Linux server running an affected release, a remote client that can open a connection can race the server’s own cleanup handler and execute code inside the privileged sshd process — before any password is checked. Because the race window is narrow, exploitation is slow rather than trivial, but it requires no credentials at all.
Affected software
OpenSSH 8.5p1 through 9.7p1 on Linux distributions that use glibc. Systems built against musl libc, the BSD platforms, and the portable build of OpenSSH are not affected by this record.
What to do
Upgrade OpenSSH to 9.8p1 or later and restart the SSH service.
If you cannot patch immediately, set LoginGraceTime 0 in sshd_config and reload the service. This removes the timing window the exploit depends on.
Reduce exposure of the management plane. Keep SSH behind a VPN or bastion host where possible, and allow administrative access only from known addresses.
Review authentication logs around the upgrade date for malformed or failed pre-authentication attempts from unfamiliar addresses.
A crafted punycode string overflows a buffer in OpenSSL’s internationalised domain name parsing. In most deployments the result is a crashed service — a denial of service — rather than data theft.
OpenSSL’s punycode decoder writes decoded characters into a fixed-size buffer without checking the length first. An attacker who can supply an over-long punycode label — through a certificate, a hostname in a request, or a URL — can overflow that buffer. On most builds the crash is contained to the calling process, so the realistic impact is repeated service interruption for anything that parses attacker-supplied names.
Affected software
OpenSSL 3.0.0 through 3.0.6, with limited-impact variants in OpenSSL 1.1.1 and 1.0.2. OpenSSL 3.1.0 was not affected. The fixes shipped in 3.0.7, 1.1.1t and 1.0.2u respectively.
What to do
Upgrade OpenSSL to 3.0.7 or later, or to the patched 1.1.1t / 1.0.2u branches.
Restart everything that links the library. Running services keep the old copy in memory until they restart, so an upgrade alone changes nothing for live processes.
Reject over-long names at the edge where you can — web servers and reverse proxies can be configured to reject hostnames and headers beyond a sensible length.
An attacker positioned in the middle of an SSH connection can strip the sequence numbers that protect the session, which opens the door to downgrade attacks against some cipher suites.
SSH prefix truncation attack against the Terrapin protocol extension
MediumCVE-2023-48795
What happened
SSH normally numbers every packet in a session so that an attacker in the middle cannot silently remove or reorder them. The Terrapin attack exploits a weakness in certain MAC and encryption algorithms that lets such an attacker strip those counters — and then manipulate the session, including forcing a weaker cipher suite. It requires a machine-in-the-middle position, so it does not apply to an ordinary connection made straight across the internet.
Affected software
Clients and servers running OpenSSH 9.3p2 through 9.6p1 with the vulnerable strict key exchange. ChaCha20-Poly1305 and CBC with Encrypt-then-MAC are the cipher suites most exposed. OpenSSH 9.7 restored the counters.
What to do
Upgrade OpenSSH to 9.7 or later on both ends of the connection — an upgraded client alone does not protect the session.
Until then, disable the affected cipher suites and enable strict key exchange where your version supports it.
For connections that cross an untrusted path, use a VPN or an SSH-over-443 tunnel so the traffic cannot be intercepted and rewritten.
A crafted string in anything your server logs — a username, a header, a filename — makes a widely used Java logging library fetch and run code from a remote host.
Remote code execution in Apache Log4j 2 (Log4Shell)
CriticalKnown exploitedCVE-2021-44228
What happened
Log4j 2 can look up variables embedded in log messages, and that lookup can be pointed at a remote server. A string hidden inside something a user controls — a login name, a request header — causes the server to download and execute a remote class. Because the trigger is simply “anything you log”, it reached web applications, mail servers, CI pipelines and appliances that had no internet-facing flaw of their own.
Affected software
Apache Log4j 2 from 2.0-beta9 through 2.14.1 on Java 8 and later. Log4j 1.x is a separate codebase and is not affected by this record. Version 2.15.0 removed the vulnerable lookup; 2.17.1 is the recommended baseline because 2.16.0 and 2.17.0 carried follow-on issues.
What to do
Upgrade to Log4j 2.17.1 or later across every application that logs user-supplied input.
Remove the vulnerable JAR from the deployment. Old transitive dependencies and Log4j 1.x bridges are the most common reason an upgrade appears not to have worked.
Until patched, remove ${jndi: lookups from configuration and block outbound LDAP and RMI connections from application servers.
Hunt for past exploitation by searching web and application logs for the string ${jndi: and reviewing outbound LDAP traffic from application servers.
A crafted request can make a running Java web application change the code it loads at runtime, which leads to remote code execution on the server — before you log in.
Remote code execution in Spring Framework (Spring4Shell)
CriticalKnown exploitedCVE-2022-22965
What happened
When a Spring application is deployed as a WAR file on Tomcat and runs on Java 9 or later, an attacker can send a request that binds request parameters to internal objects in the framework’s class loader. That binding can be used to change the class loaded at runtime, which gives the attacker code execution inside the application process — no credentials required.
Affected software
Spring Framework 5.3.0 through 5.3.17 and 5.2.0 through 5.2.19, running on JDK 9 or later and deployed as a WAR to Tomcat or a comparable servlet container. Applications running as an executable JAR, on JDK 8, or on other application servers are not affected by this record.
What to do
Upgrade to Spring Framework 5.3.18 or 5.2.20 (or later) and rebuild and redeploy the application.
Confirm how it is deployed. If the artefact is a WAR on Tomcat with JDK 9 or later, treat the environment as exposed until the patched build is running.
Lock down the Tomcat manager applications to localhost only and keep application servers off the public internet where the architecture allows.
Review access and application logs for requests carrying unusual parameter names — that is the shape of the exploit.
On Windows, PHP’s CGI mode can be tricked into accepting command-line options it should never receive — which lets an attacker run arbitrary PHP code on the server.
PHP’s CGI binary interprets a query string that begins with a hyphen as a set of command-line arguments. On Windows, the default configuration allowed an attacker to supply a flag that makes PHP treat attacker-supplied code as a configuration file to execute. Servers running PHP-FPM, or PHP as a module under Apache or Nginx on Linux, are not affected — the weakness is specific to the CGI SAPI on Windows, which is why it showed up in WordPress and other Windows-hosted stacks.
Affected software
PHP 8.1.x before 8.1.29, 8.2.x before 8.2.20 and 8.3.x before 8.3.8, running in CGI mode on Windows. PHP-FPM, mod_php and PHP on Linux are not affected by this record.
What to do
Upgrade PHP to 8.3.8, 8.2.20, 8.1.29 or later, and restart the web server so the new binaries are loaded.
Confirm which SAPI is in use with php -v — it prints the server API. Only “CGI” on Windows is exposed by this record.
Until patched, block query strings that begin with a hyphen at the web server, or disable CGI mode entirely.
Check every PHP installation on Windows servers, including control panels and shared-hosting defaults installed before the fix.
A crafted request can manipulate the database queries WordPress itself issues, so an attacker may be able to read or alter data through the site’s own database connection.
SQL injection in WordPress core (WordPress 5.8.3 security release)
CriticalKnown exploitedCVE-2022-21661
What happened
A parameter used by WordPress’s query builder was not properly sanitised, so a request carrying a specially formed value could alter the SQL sent to the database. Because the flaw sat in core rather than a plugin, it affected sites with no third-party code installed at all, and it ran with exactly the database credentials the site uses. WordPress 5.8.3 was released to close this class of flaw.
Affected software
WordPress core before 5.8.3. Sites running a later core release are not affected by this record, though the underlying lesson — keep core current — applies to every installation.
What to do
Update WordPress core to 5.8.3 or later, and preferably to a currently supported release rather than the minimum fixed version.
Run the built-in integrity check in Tools → Site Health after updating, to confirm the core files were replaced cleanly.
Rotate the database password and the application salts in wp-config.php, then re-save the permalinks so the new salts take effect for existing sessions.
Ask your host to review database and web logs for unusual query volume around the update date.
A client can open and discard HTTP/2 streams faster than the server can process them, so a small amount of traffic can exhaust a web server and take the site offline.
HTTP/2 Rapid Reset — denial of service against web servers
HighKnown exploitedCVE-2023-44487
What happened
HTTP/2 allows many concurrent streams on a single connection. The Rapid Reset attack sends a request and immediately cancels it, over and over, generating server-side work that is never useful to the client. Because the cost falls almost entirely on the server, a modest attacker can saturate its CPU and memory and make it unresponsive to legitimate visitors — a very effective way to knock a business site offline for the cost of a few requests.
Affected software
Broadly, HTTP/2 implementations: Apache httpd, nginx, Envoy and the Go standard library’s http2 package each shipped their own fix. Servers that do not speak HTTP/2 are not affected by this record.
What to do
Patch your HTTP/2 stack — web server, reverse proxy and CDN edge — rather than assuming the fix is inherited from the operating system.
Where you cannot patch immediately, disable HTTP/2 at the edge or rate-limit requests per connection so that rapid resets are discarded cheaply.
Apply the connection and stream limits recommended by your server vendor; the setting names differ between implementations.
Watch request-to-response ratios and connection churn in web server logs — that is the signature of this attack.
jQuery’s deep-extend function, used to merge settings and data objects, did not filter out the special __proto__ key. A caller that passes user-supplied JSON into that function can therefore modify the prototype of every object in the page. Applications that merge configuration or form data this way can have their behaviour altered — including checks that were supposed to be enforced — which is why this is rated medium rather than critical despite being in a library used almost everywhere.
Affected software
jQuery before 3.4.0. jQuery 3.0.0 through 3.3.1 are affected specifically when jQuery.extend(true, ...) is used with untrusted input; 1.x and 2.x releases are affected through the same deep-extend behaviour.
What to do
Upgrade jQuery to 3.4.0 or later — and prefer the current 3.7.x release, which carries later security fixes.
Never merge untrusted JSON with $.extend(true, ...). Validate the shape of the data before it reaches the merge.
Audit plugins and themes for bundled copies of jQuery. A site can stay vulnerable through an old library shipped inside a theme or plugin long after the core site is updated.
A flaw in the Windows protocol that handles domain logins lets an attacker take over a domain controller with no password at all — one of the most severe authentication bypasses ever published.
Elevation of privilege in Windows Netlogon (Zerologon)
CriticalKnown exploitedCVE-2020-1472
What happened
Windows uses a secure channel between workstations and domain controllers to authenticate domain logins. The encryption it relies on starts from a predictable value, and the server does not verify that the client completed the handshake correctly. An attacker on the network can force that handshake to fail, and repeat the attempt until the domain controller accepts a forged session — granting full domain administrator rights without ever presenting a credential.
Affected software
Windows Server 2008 R2, 2012, 2012 R2, 2016 and 2019, plus the Netlogon service on domain-joined clients. Windows Server 2008 and earlier are not affected by this record.
What to do
Install the August 2020 and January 2021 Windows updates on every domain controller, member server and domain-joined workstation.
Enforce secure channel signing and encryption through Group Policy, and confirm the domain controller requirements are applied rather than merely configured.
Restrict network access to domain controllers — block SMB and RPC traffic from untrusted segments and from user workstations where it is not needed.
Treat an unpatched domain as compromised: rotate the krbtgt account password twice, following Microsoft’s guidance, and review domain administrator logons for activity that nobody can account for.
A pre-authentication flaw in the Windows Remote Desktop service lets an attacker with network access to port 3389 take over the machine without any credentials at all.
Remote code execution in Windows Remote Desktop (BlueKeep)
CriticalKnown exploitedCVE-2019-0708
What happened
The Remote Desktop service contains a memory corruption bug in the way it decodes the virtual channel data it receives. Because the flaw sits before authentication, an attacker who can reach the Remote Desktop port can trigger it with a single crafted packet and run code as the system. It became one of the most widely weaponised vulnerabilities of its year and drove emergency patching campaigns worldwide — which is why remote-access ports on old Windows hosts still warrant close attention.
Affected software
Windows 7 and Windows Server 2008 R2 with Remote Desktop Services enabled. Later Windows versions and Windows Server 2008 are not affected by this record.
What to do
Patch, or replace. Windows 7 and Windows Server 2008 R2 are end-of-life and no longer receive security updates, so a business estate still running them needs a migration plan rather than a patch cycle.
Never expose port 3389 directly to the internet. Where remote access is unavoidable, place it behind a VPN or a bastion host with MFA.
Require Network Level Authentication and multi-factor authentication for every remote session.
Verify the fix rather than assuming it — review event logs for repeated RDP connection attempts from unfamiliar addresses around the patch date.
A flaw in the Windows print spooler lets a user who can reach a machine’s print service load a malicious driver and run code as the system — a short hop from ordinary access to full control.
Remote code execution in the Windows Print Spooler (PrintNightmare)
HighKnown exploitedCVE-2021-34527
What happened
The print spooler service loads printer drivers on behalf of users. This flaw allowed a user with limited rights to point the spooler at a malicious driver over the network, which the service then loaded with system privileges. Attackers used it to move from ordinary user access to complete control of the machine, and several ransomware operators used it as a remote entry point. Microsoft has since changed the default behaviour so that only administrators can install print drivers.
Affected software
Windows 7, 8, 8.1 and Windows Server 2008, 2012, 2012 R2, 2016 and 2019 with the Print Spooler service enabled. Windows 10 and later were not affected by this record.
What to do
Install the July 2021 Windows updates on every workstation and server, then reboot so the spooler reloads the patched component.
Apply Microsoft’s mitigation group policy — “Point and Print Installation Restrictions” — so only administrators can install printer drivers on workstations.
Where printing is not required, disable the Print Spooler service entirely. It is a common and unremarkable hardening step.
Review which systems and accounts can reach the print service over the network, and close the exceptions that exist for convenience rather than need.
A string that looks like HTML can survive jQuery’s HTML parsing helper and run script in a visitor’s browser — turning an ordinary data field into a way to attack your users.
jQuery’s HTML prefilter step converts certain strings into HTML nodes. When a string containing an HTML element that carries a source attribute was passed through it, that element could survive the conversion in a form the browser then executes as script. Any site that rendered user-supplied content through jQuery’s HTML helper — including content stored earlier and re-displayed later — could be exposed to a stored or reflected cross-site scripting attack.
Affected software
jQuery 3.0.0 through 3.4.1. Version 3.5.0 is the first fixed release in the 3.x line; earlier 1.x and 2.x branches are unsupported and should be replaced rather than patched.
What to do
Upgrade jQuery to 3.5.0 or later — preferably the current 3.7.x release, which carries later security fixes as well.
Do not pass untrusted content to jQuery’s HTML parsing helpers. Escape it for the context it is rendered in instead.
Add a Content-Security-Policy as a second layer, so that an injected script has a much smaller surface to work with.
When nginx is configured to resolve names through DNS itself, a hostile DNS response can corrupt memory. Servers using the operating system’s resolver are not affected.
nginx normally uses the operating system’s DNS resolver, which is not affected by this record. When the resolver directive is configured — a common setup for dynamic upstream resolution behind load balancers — nginx parses the DNS response itself, and that parser had an off-by-one error when a response record was longer than expected. A malicious or compromised DNS server could then corrupt nginx’s memory, and in the worst case run code in the worker process.
Affected software
nginx 0.6.18 through 1.20.0 where the resolver directive is in use. The fix shipped in 1.20.1 and 1.21.0.
What to do
Upgrade nginx to 1.20.1 or later, or to a currently supported branch release.
Check whether the resolver directive is actually in use. If nginx delegates DNS to the operating system, this record does not apply to you — confirm it in the configuration rather than assuming.
Restrict which DNS servers nginx may query, and prefer resolvers you operate yourself.
A crafted feature parameter in a GlobalProtect request leads to command injection on the firewall itself — remote code execution, before authentication, with no credentials required.
Command injection in Palo Alto Networks GlobalProtect
CriticalKnown exploitedCVE-2024-3400
What happened
The GlobalProtect portal or gateway contained a file path parameter that was not validated before being handed to the operating system. A specially crafted request could inject operating system commands that then ran with the privileges of the firewall process. The requirement is that GlobalProtect is enabled on the interface — a common configuration for organisations exposing remote access to staff working from home or travelling.
Affected software
Palo Alto Networks PAN-OS 10.2 before 10.2.9-h1, 11.0 before 11.0.4-h1 and 11.1 before 11.1.2-h3, where a GlobalProtect portal or gateway is configured. Devices without GlobalProtect enabled are not affected by this record.
What to do
Upgrade PAN-OS to the fixed hotfix for your branch — 10.2.9-h1, 11.0.4-h1 or 11.1.2-h3, or later.
Until the upgrade, disable device telemetry where that is operationally acceptable. Palo Alto Networks published this as an interim measure, and telemetry matters for the platform’s wider protection capability — so treat it as a short-term step, not a permanent answer.
Restrict GlobalProtect access to known addresses, and confirm that the management and trust interfaces are not reachable from the internet.
Review firewall logs for requests carrying a feature parameter, and treat any device that was exposed during the window as needing investigation rather than just a patch.
A specially crafted request against the SSL VPN service causes an out-of-bounds write and remote code execution — no credentials needed, and exploited in the wild within days of disclosure.
The SSL VPN web portal accepted a request that triggered a memory corruption bug. Because the flaw sat in the pre-authentication request path, an unauthenticated attacker could run code on the appliance as the root user simply by sending a crafted HTTP request. For an organisation that publishes its VPN portal for remote staff, this turns a perimeter device into an entry point into the internal network.
Affected software
Fortinet FortiOS 6.0 through 6.0.16, 6.2 through 6.2.14, 6.4 through 6.4.12, 7.0 through 7.0.13, 7.2 through 7.2.7 and 7.4 through 7.4.1, and FortiProxy 6.2 through 6.2.14, 7.0 through 7.0.13, 7.2 through 7.2.7 and 7.4 through 7.4.1 — in every case where an SSL VPN service is configured.
What to do
Upgrade to a fixed firmware release immediately. Fortinet shipped fixes for every affected branch; the fixed builds are listed in the vendor’s PSIRT advisory.
Run the vendor’s SSL VPN log scanner. Fortinet published IOC-based tooling for this record. Treat any appliance that returns hits as compromised — reimage it rather than only patching it.
Rotate every credential and certificate that was ever used through the SSL VPN portal on an affected device, including local accounts and any API keys.
Restrict management and VPN interfaces to known source addresses, and never expose an SSL VPN portal directly to the internet without an additional access control layer in front of it.
A flaw in NetScaler ADC and Gateway leaks valid session tokens, letting an attacker bypass authentication entirely and hijack live sessions without a password.
NetScaler appliances that front remote access for corporate applications had a flaw that returned session tokens in an unexpected place. An attacker who captured or read that token could present it directly to the appliance and take over the session — without a password, without multi-factor authentication, and without triggering a failed-login alert. This is the difference between an attack that is blocked and an attack that simply walks in through the front door.
Affected software
Citrix NetScaler ADC and NetScaler Gateway 13.1-13.1-48.47, NetScaler ADC 14.1-14.1-8.50, NetScaler ADC 14.1-14.1-8.50 on AWS, NetScaler Cloud, NetScaler Console and NetScaler Management Center. Appliances running a build newer than those listed were not affected.
What to do
Patch the appliance to the fixed build Citrix published for your platform. There is no configuration change that mitigates this on its own.
Terminate all active sessions after patching, and revoke the tokens they carried. Patching without killing sessions leaves the door open behind you.
Rotate any credentials that were used through the gateway during the exposure window, and review the applications behind it for signs of unauthorised access.
Enable and review ICA session recording where it exists. For the organisations that were breached through this route, session recording was the fastest route to knowing what actually happened.
An unauthenticated attacker can read the database behind a managed file-transfer product without any credential — the flaw behind one of the largest mass-exploitation campaigns on record.
MOVEit Transfer is a managed file-transfer product used to move payroll files, customer records and other sensitive documents between organisations. The vulnerability let an unauthenticated attacker inject SQL into the application’s own database interface and extract data — including files, employee records and customer banking details — without ever logging in. Rapid automated scanning found exposed instances within days, and the scale of the resulting breaches made this the largest mass-exploitation campaign to date.
Affected software
MOVEit Transfer 2021.0 through 2023.0. Older and newer releases were not affected by this specific record. Managed file-transfer instances are frequently exposed directly to the internet and rarely monitored — which is exactly why they were scanned so aggressively.
What to do
Patch immediately — the vendor released a fixed build and, for many versions, provided a way to disable the vulnerable component as a stopgap while you schedule the upgrade.
Assume the data was taken. Patching stops further access; it does not undo an extraction that already happened. A breach assessment of what was in the system is required.
Look for the indicators of compromise the vendor published, including suspicious files and outbound connections from the transfer service.
Ask the hard question about file transfer. If your organisation moves payroll, banking or customer data through a tool nobody monitors, that gap is the real finding — treat it as a managed service requirement, not a one-off patch.
A chain of four flaws in on-premises Exchange let an unauthenticated attacker plant a web shell on a mail server — the flaw behind the largest email-server compromise in history.
ProxyLogon pre-authentication flaw in Microsoft Exchange
CriticalKnown exploitedCVE-2021-34473
What happened
Exchange Server processes a great deal of untrusted input on behalf of internet-facing clients, and this chain of four vulnerabilities let an attacker bypass authentication, reach the backend and run arbitrary code as the system. The attacker’s typical next move was to drop a web shell on the server — a small piece of code that survives reboots and gives persistent, hidden access to mailboxes, files and credentials. Because the flaw was exploited for months before patching, the cleanest question is not “did you patch?” but “do you know what else was done?”
Affected software
Microsoft Exchange Server 2013, Exchange Server 2016 and Exchange Server 2019. Microsoft Exchange Online (Microsoft 365) was not affected by this record, which is one of the clearest arguments for cloud-hosted mail where the patching is somebody else’s problem.
What to do
Apply the Microsoft security update to every on-premises Exchange server, including any that are not internet-facing — the flaw was routinely exploited through the Outlook client path as well as the web path.
Run Microsoft’s Exchange Log Scanner for this record and treat any hit as a confirmed compromise requiring investigation, not merely a patch.
Hunt for web shells. Microsoft published indicators of compromise for this campaign. Assume the presence of a webshell until an investigation says otherwise.
Rotate credentials that lived on the server — service accounts, delegated permissions and any secrets the server held — because persistence mechanisms commonly targeted exactly those.
No advisories match those filters.
Try a broader search term, a different service area, or clear the filters to see the full sample set.
A published CVE tells you a weakness exists somewhere. It does not tell you whether that weakness is on a machine your business depends on. These three rules are how we use the same intelligence internally when we look after a client’s estate.
We check exposure before we check headlines
Every advisory is matched against a live inventory of the systems we manage. A critical CVE on a server you do not run is news; it is not work. Nothing in your scope changes until the version matches.
Known-exploited changes the clock
When a flaw appears in CISA’s Known Exploited Vulnerabilities catalogue, attackers are already using it. That moves the fix from a scheduled maintenance window to the next working day, and it is why we track that catalogue separately.
Patch, then verify
Applying an update closes a hole but does not undo an intrusion. For anything on the exploited list we follow the patch with a hunt for indicators of compromise — because the breach usually happened months before the advisory did.
Next step
Know what you are actually running.
The gap between “a vulnerability was published” and “we are affected” is where most risk quietly lives. We close that gap with a vulnerability assessment of your estate — an inventory, a version match against this feed, and a prioritised remediation plan you can hand to whoever owns the budget.