Technical depth on vulnerability management, AI-powered remediation, and TRIS™ scoring. Written by practitioners, for practitioners.
Vulnerability scoring engines almost never consume control-validation evidence as input. A working definition of defense efficacy, the four kinds of artifact that count, a half-life for freshness, how it moves findings across SLA bands, and the governance rule that keeps downgrades honest.
Microsoft's September 2026 Patch Tuesday shipped two Windows local privilege escalation zero-days already in the wild: CVE-2026-81963, a link-following flaw in the Windows Update Stack, and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC that lets an AppContainer sandbox escape to SYSTEM. Both land at CVSS 7.8, both hit CISA KEV the same day. Mechanism for each primitive, why a base-score sort mis-ranks a KEV LPE, a TRIS layer walk, and the hunts and rotations to run this week.
On August 2, 2026, N-able shipped Hotfix 1 for the N-central authentication bypass and Storm-1175 detonated StormEncryptor, a previously undocumented C++ encryptor, on the same calendar day. The novelty is not the CWE-288 bypass but the coupling: a fresh n-day and an in-house tooling debut timed so the patch layer and the signature layer went blind together, retiring a Medusa IOC set that still read as healthy coverage. Mechanism, the Hotfix 2 supersession trap, a TRIS layer walk, and a renamed-binary hunt you can run today.
CISA's BOD 26-04 made public exposure a required urgency input for federal systems on June 10, 2026. A practitioner definition of reachability across four layers (network, service, code, identity), a cheap approximation for each layer built from tooling most teams already own, the AND rule for composing the four answers, and a ten-item queue re-sorted before and after.
A public PoC for CVE-2026-19490 dropped in early September 2026 and Previdian's sensors logged the first matching requests from six unique IPs on September 3. The bug is a CWE-288 alternate path authentication bypass on NetScaler ADC and Gateway. On 14.1 builds at or beyond 43.56 and 13.1 builds at or beyond 61.28 the alternate path only opens when a SAML action is bound to the vserver, on older builds a Gateway or AAA vserver alone is enough. Fixed builds are 14.1-73.32 and 13.1-63.21, no workaround. Mechanism, TRIS layer walk, and a concrete upgrade and hunt playbook.
CVE-2026-82329 is a CVSS 9.8 authentication bypass in JFrog Access. When no admin ever set a join key, the parser accepts an empty entry and the signing routine PKCS7 pads it to 32 bytes of 0x20. Anyone can then sign a NoAuth join JWT and receive a scope admin service token. JFrog patched on August 28, 2026. watchTowr saw active exploitation by September 1. CISA KEV since September 2 with a September 5 federal deadline. Mechanism, TRIS layer walk, and a concrete patch, rotate, hunt playbook.
On April 15, 2026 NIST moved 29,000 backlogged CVEs into Not Scheduled and published the criteria for what still gets enrichment. That is the permission structure a private program needs to bring the same move to its auditor. The five-step reset procedure, the evidence package (criteria memo, disposition ledger, re-admission rules), and what changes the morning the new queue goes live.
Seven supply-chain CVEs from the last two weeks of CVEasy threat-intel, plotted by CVSS, showing three perfect 10.0 scores with no reported exploitation while lower-scored flaws were under active attack.
On August 27, 2026 PaperCut disclosed two chained zero-days in NG and MF. CVE-2026-81578 lets an unauthenticated request drive admin components in the web management interface, and CVE-2026-82078 turns a config write into arbitrary Java code via unsafe dynamic class loading. The first emergency patch was bypassed within hours, so only Emergency Patch Release 2 (24.1.10, 25.0.13, 26.0.5) closes the chain. CISA added both to KEV on August 31 with a September 14 federal deadline. TRIS layer walk and a concrete remediation workstream.
On April 15, 2026 NIST moved 29,000 backlogged CVEs into Not Scheduled and stopped enriching all but the KEV, federal, and EO 14028 subset. On June 10, CISA BOD 26-04 dropped CVSS as a required federal input. The five-part exposure statement, a four-term translation table, the answer for when there is no score, and a one-slide format your board can vote on.
On August 27, 2026 ServiceNow shipped KB3152242 with three CVSS 10.0 unauthenticated flaws in the AI Platform: CVE-2026-18885 code injection in the GraphQL Composite Data API, CVE-2026-18886 access control gap in the system configuration image upload processor, and CVE-2026-74820 SQL injection through a dynamic schema ORDER BY clause. Cloud tenants patched automatically. Self-hosted appliances need Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4, or the equivalent Zurich and Australia builds.
CVE-2026-8452 is an unauthenticated heap overflow in NetScaler ADC and Gateway SAML signature canonicalization. An oversized PrefixList in ds:SignedInfo overflows a fixed-size buffer, corrupts an adjacent nsb chunk header, and yields a controlled memcpy that overwrites tx_pkt_complete_fptr inside nsppe running as root. Citrix patched on June 30 and called it DoS. watchTowr weaponized it into pre-auth root RCE on August 14. KEV since August 26 with a federal deadline of August 29.
Assistants moved from experiment to load-bearing part of the SDLC while security controls kept assuming a human wrote every line. The gap is now measurable in Veracode, Spracklen et al, and field data from a Fortune 50: three new surfaces (hallucinated packages in lockfiles, insecure patterns copied at scale, provenance loss), what prior art already covers, and the four pipeline changes to land this quarter.
CVE-2026-21962 is a CVSS 10.0 authentication bypass in the Oracle HTTP Server and WebLogic Server Proxy Plug-in caused by URI parser disagreement between the front-end and the backend. CISA added it to KEV on August 24, 2026 with a federal patch deadline of August 27. Patch every 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 plug-in binary and hunt the percent-encoded traversal signatures.
Interlock was inside Cisco firewall CVE-2026-20131 a month before disclosure. BOD 26-04 made three days the default, not the exception, on 87% of new KEV entries. The hour-by-hour first-48 playbook that treats a zero-day as an exposure event, keyed to 2026 exploitation speed and the EU CRA reporting clock.
CVE-2026-19478 is a CVSS 9.4 unauthenticated code injection through the @gl_introduced GraphQL directive. watchTowr reproduced it from the patch diff in minutes and exploitation landed within two days of the August 17 out-of-band release. Patch, hunt @gl_introduced, harden /api/graphql.
The official description for the Windows TCP/IP RCE is six words. Fewer than one in a hundred vulnerability records says enough to test a machine against. So we write up how the bugs actually work, and our app reads what we wrote.
CVE-2026-64849 is an unauthenticated SSRF via POST /api/2.0/mlflow/webhooks/{id}/test. Attackers hop the tracking server into AWS, GCP, and Azure metadata through a redirect the validator never sees. CISA KEV since August 19.
Five questions, a fixed hour of time boxes, a 24-hour pre-work brief, an ADR-shaped decision log, and a re-band slot turn the weekly meeting into a control loop.
Eight supply-chain CVEs from the last two weeks of CVEasy threat-intel, ranked by CVSS, showing how fast exploitation arrived after each fix or disclosure.
CVE-2026-59310 is a directory traversal in the vCenter Syslog Server that a network reachable attacker turns into root code execution without authenticating. 361 appliances across 47 countries fell inside five days of the patch. Mechanism, the ESXi .babyk smokescreen, TRIS layer walk, and what to hunt this week.
A six-agency advisory published August 10 documents Gunra operators editing the authentication files on a corporate VDI portal so one attacker-chosen one-time password always validated. Mechanism, the two KEV-listed Fortinet auth bypasses behind it, TRIS scoring, and what to hunt this week.
BOD 26-04 tells federal teams the tier. It does not tell any team how the clock behaves. A vendor-neutral re-banding trigger taxonomy, clock arithmetic on promotion and demotion, and the stop-clock rule that separates paste from proof, grounded in the DBIR, Edgescan, and VulnCheck 1H 2026 capacity numbers.
SAP shipped Note 3771065 on August 11 for CVE-2026-58231, a max-severity Data Hub Adapter RCE. Defused honeypots logged live exploitation three days later with no public PoC. Mechanism, TRIS scoring, and what to fix by the end of the week.
CVE-2026-68820 is a use-after-free race in Windows afd.sys that Lazarus Group rode for five weeks to escalate to SYSTEM and drop FudModule v3.1 on defense employees. Mechanism, TRIS scoring, and what to fix before the CISA KEV deadline on August 25.
Exception registers become dangerous when every exception looks the same. Four workflow states with different lifecycles, evidence requirements, and expirations, credited across FedRAMP DR types, NIST RMF, PCI Appendix B, Rapid7 InsightVM, and Microsoft Defender, plus a Rosetta stone across the frameworks and the doctrine that no expiration means no exception.
Progress Kemp LoadMaster CVE-2026-8037 (CVSS 9.6) turns a single anonymous POST to /accessv2 into a pre-auth root shell. 792 confirmed exploit attempts across 65 IPs before CISA moved it to KEV on August 7. Mechanism, TRIS scoring, and remediation.
Security teams treat remediation as a synonym for patching. Real remediation is seven ranked layers, from remove at the top to prevent recurrence at the base, borrowed deliberately from the NIOSH hierarchy of controls and adapted for exposure work.
On August 3, 2026, attackers weaponised an unauthenticated SQL injection in Metabase's /api/session/reset_password endpoint (GHSA-vwf4-m7j8-wcjf, CVSS 10.0), promoted themselves to admin, and used stored data-source credentials to steal Framework and Tally customer records.
Across the two weeks ending August 5, 2026, the one charted CVE with no confirmed exploitation carried a CVSS of 9.8, while the lowest-scored flaw at 5.3 was already under active zero-day attack.
Six of seven critical CVEs charted from the last two weeks of CVEasy threat-intel were already under active exploitation, several within days of the patch.
On Aug 4, 2026 an attacker took over the jaredwray npm account and shipped a self-propagating credential-stealing worm through keyv, cacheable, flat-cache, and seven other caching packages, all with valid Sigstore provenance still validating. Preinstall hook, Bun stage two, harvest scope, Ethereum smart contract C2, the TRIS layer walk, and the rotate-first response.
SBOMs describe the artifact; risk lives in what is deployed, loaded, and reachable. A vendor-neutral join architecture with honest credit to Sysdig's RBOM, EdgeBit, Bomfather, GUAC, Endor Labs, and Semgrep, plus where the runtime-evidence VEX flow is still open ground.
Three weeks after the July 14 patch and the July 17 KEV deadline, INC Ransomware keeps landing new names on the leak site by weaponizing the SonicWall SMA 1000 wsproxy chain (CVE-2026-15409, CVE-2026-15410). One preauth HTTP request on port 443 reaches localhost ctrl-service, escalates to root, and steals credentials and TOTP MFA seeds that outlive the patch. Mechanism, per-appliance TRIS layer walk, and the ordered patch, rotate, hunt, rebuild playbook.
Scanners find and dashboards rank; the operating model between security, infra, apps, change, and business owners is where findings age. Credit to SANS VMMM, NIST SP 800-40r4, and BOD 26-04 for the pieces already down, then the four owners, seven action queues, twelve-field ticket contract, honest exception path, and evidence-based closure that hold the rest together.
CVE-2026-18556 was an authentication bypass in on-premises and hosted N-central through 2026.1, fixed in 2026.2 on August 1. A day later, N-able came back with CVE-2026-18577, an incomplete patch that expanded the affected range to every build through 2026.3.1 and pushed the safe build to 2026.3.1.7. Huntress observed the full chain: alt-path bypass, Take Control pivot, Windows services running cloudflared tunnels on managed endpoints. Mechanism, TRIS layers, and the patch, isolate, hunt, rotate list.
A CVSS 5.3 hardcoded low-privilege account in on-prem Secure FMC, actively exploited before the July 29 patch and on a three-day CISA KEV clock. The real story is the chain: the same July hotfix also carries the fix for CVE-2026-20079's CVSS 10.0 pre-auth root RCE, and both advisories now share the same /var/tmp/license.tmp forensic indicator. Mechanism, TRIS layers, and the patch, hunt, rotate list.
The interesting security data is also the sensitive data. A four-boundary reference architecture for adding an AI assistant to vulnerability work without turning the exposure map into someone else's input stream, with credit to OWASP LLM02:2025, the lethal trifecta, NIST AI 600-1, Anthropic's shared responsibility model, and Microsoft's agent failure-mode taxonomy.
A CVSS 10.0 unauthenticated OS command injection in on-prem Arista VeloCloud Orchestrator, exploited as a zero-day and added to CISA KEV on July 27, 2026. The bug lives in "privileged internal functionality" that was never supposed to be reachable. Mechanism, why the same CVE lands in four different TRIS bands across four environments, and the patch, restrict, hunt, rotate playbook for the on-prem VCO fleet.
Security debt is Veracode's application backlog. Exposure debt is the wider ledger it misses: expired exceptions, unknown assets, untested detections, broken sensor coverage. Credit the prior art, then read the unified ledger, the accrual mechanic through coupling, exception drift, and response cost, and the signals no single score can compress.
A CVSS 9.0 Fastjson 1.x zero-day discovered by FearsOff. The type check itself resolves a nested jar: URL through Spring Boot's LaunchedURLClassLoader, treats an attacker-supplied @JSONType annotation as a trust signal, and hits defineClass before binding runs. ThreatBook and Imperva confirmed active exploitation. Mechanism, TRIS layers, and the SafeMode-first remediation plan.
A public PoC dropped July 20 for a CVSS 9.8 unauthenticated deserialization in on-premises SharePoint. A single POST to /_trust/default.aspx exfiltrates the IIS machine keys, and the July 14 patch does not invalidate keys an attacker has already walked away with. Mechanism at the SessionSecurityTokenHandler BinaryFormatter sink, the four TRIS layers that push this to ACT, and the honest patch-plus-rotate weekend list.
Gartner drew CTEM as a five-stage program. Between the process and the vendor product boxes there is no vendor-neutral technical reference. Credit to ctem.org's 29-identifier open taxonomy, then six architectural layers under the program (asset truth, exposure ingestion, enrichment, scoring, validation, evidence), how the AEV and EAP market moves of 2025 map to them, two anti-patterns, and a five-question buyer checklist.
CVE-2026-6875 is a CVSS 9.5 pre-auth RCE in the ServiceNow AI Platform. The javascript: prefix on a /assessment_thanks.do query lands in an inner Rhino sandbox, gs.include() loads a library into the less restricted outer context, and the two share one global scope. Patched July 13, exploited in the wild July 18. Mechanism, TRIS layers, and the MID Server rotation plan.
BOD 26-04 codified what practitioners have argued for years: single signals over-fire or under-fire, and only convergence tells the truth. Eight signal classes weighted at the class level, a rule for when signals disagree (KEV listed but EPSS low), and a worked queue example that credits EPSS v4, SSVC, VulnCheck exploit maturity, and CISA Vulnrichment where they already do the work.
WordPress 6.9 and 7.0 shipped a REST batch route handler that pushed WP_Error onto $validation but not $matches, sliding sub-request i onto handler i+1 and dropping an anonymous request onto the WP_Query author__not_in SQL injection behind it. Hexastrike honeypots and IR engagements confirmed exploitation over the weekend. Chain, TRIS layers, remediation.
On July 14, 2026, attackers exploited a pull_request_target misconfiguration in the AsyncAPI generator repository to steal the asyncapi-bot PAT, pushed unauthorized commits to protected branches, and let the legitimate npm trusted-publishing pipeline sign five malicious versions across four packages with valid SLSA provenance. Mechanism, TRIS layers, remediation.
Deep dive on the problem the local-first CTEM piece left open: staying current on vulnerability intelligence without egress. Credits TUF, Sigstore, EPSS, KEV, Nessus offline, OpenCTI diode, and Dragos as prior art, then stakes novelty on the composed pipeline, per-feed freshness budgets, an offline STIX/TAXII profile, and a post-2026 NVD-degradation answer.
A CVSS 10.0 SSRF in the SMA1000 Workplace interface (CVE-2026-15409) chains with a CVSS 7.2 post-auth code injection in the Appliance Management Console (CVE-2026-15410) to give an unauthenticated attacker on the internet a root shell on the appliance that fronts the internal network. SonicWall confirmed active exploitation, CISA added both to KEV on July 14, BOD 26-04 deadline July 17. Mechanism, TRIS layers, remediation.
CVEasy scores every exposure into four action bands with an SLA attached: ACT (24 to 72 hours), ATTEND (2 weeks), TRACK (this quarter), MONITOR (accept and watch). The vocabulary deliberately aligns with CISA SSVC, and the receipts show the industry converging on decision language: Vulnrichment stamping SSVC onto CVE records, CVSS v4's own severity-is-not-risk guidance, and BOD 26-04 setting federal patch clocks by decision tier.
OCSF's Vulnerability Finding class (uid 2002), Elastic ECS, and OASIS SARIF 2.1.0 all model the scanner event well, and none of them model the mutable exposure entity a remediation program actually operates against. Nucleus, the ex-Vulcan stack inside Tenable, and Brinqa's CyberRisk Graph build that entity proprietarily; we sketch the open shape and the six concerns the scanner schema cannot carry.
A CVSS 9.8 authentication bypass in the official Gitea Docker image, where a shipped REVERSE_PROXY_TRUSTED_PROXIES = * default lets any source IP claim any user by attaching an X-WEBAUTH-USER header. Sysdig caught the first live probe from a ProtonVPN exit on July 7. Gitea 1.26.4 is the fix; 1.26.3 shipped with a regression. Mechanism, TRIS layers, remediation.
A CVSS 10.0 path traversal in the ColdFusion RDS FILEIO handler (/CFIDE/main/ide.cfm?ACTION=FILEIO) lets an unauthenticated attacker write a CFML webshell into the webroot and run it as the ColdFusion service account, which defaults to NT AUTHORITY\SYSTEM on Windows. Adobe shipped APSB26-68 on June 30, watchTowr published the PoC on July 2, and honeypots caught live exploitation about two hours later. Mechanism, TRIS layers, remediation.
Every scanner, cloud plane, EDR, CMDB, and SBOM pipeline invents its own asset key, and until they are joined the queue lies about how many things there are. Here is the minimum viable identity graph in five nodes, with durable identifiers, precedence, decay, conflict handling, and resolution confidence as a scoring input, plus honest credit to ServiceNow IRE, CNCF Cartography, CAASM, and the martech entity resolution patents.
NetScaler's custom XML parser at /saml/login does not treat whitespace as an attribute terminator, so a bare <samlp:AuthnRequest> tag padded with 476 spaces walks the parser off the end of its buffer and echoes appliance memory back through the NSC_TASS cookie. Watched attempts landed on July 2, 2026, less than 48 hours after Citrix bulletin CTX696604. Mechanism, TRIS layers, and the rotation plan.
Gartner named Adversarial Exposure Validation in 2026 and the detection engineering maturity models describe the top tier, but most SOCs still count enabled rules on a dashboard. We credit the category and its finished shape, then stitch Atomic Red Team, MITRE Caldera, Stratus Red Team, a coverage matrix, and a scheduler into the same loop, so a team with no vendor budget can climb into it.
SOCRadar tied one FortiBleed operator to active negotiation panels for both INC Ransom and Lynx on July 2, with 354 completed attack chains and twelve confirmed ransomware deployments. FortigateSniffer turns FortiGate boxes into passive credential collectors by abusing diagnose sniffer packet; CVE-2026-35616 uses a spoofed X-SSL-CLIENT-VERIFY header to turn FortiClient EMS 7.4.5 or 7.4.6 into the delivery channel for EKZ Stealer.
Every security company promises to find and fix your vulnerabilities. My personal brand says I am one. The story behind the line: an outsourced help desk job, a stalled career, the Security+ exam I sat alone, and the seventeen months of two degrees and twenty certifications that proved nobody has to come save you, because you can patch yourself.
SharePoint routed attacker-controlled bytes through LosFormatter.Deserialize on a list item update with no type filter, turning any Site Member into remote code execution on the server. CISA added CVE-2026-45659 to KEV on July 1, 2026 with a July 4 federal deadline, six weeks after Microsoft's Exploitation Less Likely tag and a CVE that was quietly absent from the initial May Security Updates release notes. Mechanism, TRIS layers, and the patch-plus-machine-key-rotation plan.
Guidance on securing AI agents is scattered across Willison, Meta, OWASP, AWS, and NVIDIA. We unify it into one vendor-neutral field guide, organized around the lethal trifecta and Meta's Rule of Two, with every layer credited to whoever taught it to us and one worked example a defender can copy.
SimpleHelp accepted OIDC identity tokens without checking the signature, so an unauthenticated attacker could mint a full technician session and walk into the RMM. CISA added it to KEV on June 29, 2026 with a July 2 federal deadline, and Blackpoint Cyber tied active exploitation to a new Node.js loader named TaskWeaver and a cross-platform infostealer named Djinn Stealer that sweeps cloud, SCM, registry, SSH, and AI IDE credentials from every endpoint the RMM managed.
Mainstream CTEM is SaaS, so your asset inventory ends up in someone else's tenant. We credit the prior art by name (Gartner's five CTEM stages, the Ink and Switch local-first ideals from 2019, Tenable Enclave Security, the Qualcomm split-plane patent), then stake novelty on naming the synthesis and on the signed offline delta bundle that keeps the loop current without phoning home.
An nginx auth gate on UniFi OS checks the raw, percent-encoded URI, while the upstream router reads the normalized form. A request whose raw path starts with the public /api/auth/validate-sso/ prefix and continues with encoded traversal lands at the internal latest_package endpoint, where an unquoted package name is interpolated into sudo /usr/bin/uos runnable latest-versions and shoved through sh -c. Passwordless sudo on dpkg finishes the climb to root. CISA added all three to KEV on June 23, 2026; a Mirai/Gaafgyt botnet has been recruiting from 176.65.148.183 since June 9.
A pipe character in the jid GET parameter on /fortisandbox/job-detail/tracer-behavior hands unauthenticated attackers root on the appliance that issues verdicts to FortiGate, FortiMail, FortiClient, and FortiEDR. Defused Cyber honeypots have caught POSTs to /jsonrpc/ on port 443 since June 15, 2026. Patched in FortiSandbox 4.4.9 and 5.0.6 per Fortinet PSIRT FG-IR-26-112 and FG-IR-26-141.
CVSS base score rates the bug in the abstract, not your risk from it. We credit the prior art (EPSS, KEV, SSVC, CVSS v4 Environmental, reachability tools, Picus PXS) by name, then stake novelty on a five-question rubric that stacks those signals in ten minutes and forces an explicit call on the business layer CVSS itself put out of scope.
A heap out-of-bounds write in FFmpeg's MagicYUV decoder, disclosed by JFrog, comes from the allocator and the decoder rounding chroma plane heights differently. A 50 KB clip dropped into a watched folder triggers it through an automatic library scan, with no user action, and JFrog walked it to remote code execution on Jellyfin and Nextcloud. Patched in FFmpeg 8.1.2.
MCP shipped HTTPS, OAuth 2.1, and RFC 8707 audience binding, so the transport is solved. The cargo it carries (tool definitions and tool results) still has no integrity layer. We credit ETDI and MCP-Scan for the prior art on rug pulls, then stake novelty on three open problems: per-result provenance, enforced data and instruction separation, and egress isolation.
A Russian-speaking actor swept 59.3 million internet hosts, narrowed to 320,777 FortiGates, and used a 45 GPU Hashtopolis cluster to crack intercepted SSL VPN authentication hashes from a fleet still storing them under legacy SHA-256 with salt. Researcher Volodymyr Diachenko found the verified dataset on a misconfigured actor server: 73,932 FortiGate devices, 21,632 domains, 194 countries. CISA issued a June 18, 2026 advisory.
On June 8, 2026 the Hades sub-wave of the Mini Shai-Hulud campaign used stolen maintainer tokens to publish trojanized versions of six PyPI bioinformatics packages (embiggen, ensmallen, gpsea, phenopacket-store-toolkit, ppkt2synergy, pyphetools) whose native .abi3.so extensions drop a Bun runtime credential stealer at import time. Combined with the Miasma branch's hit on 32 @redhat-cloud-services npm packages, the broader TeamPCP cluster has passed 473 malicious artifacts across PyPI and npm. Tracked under CVE-2026-45321.
Sonatype researchers tracked the Atomic Arch campaign as it abused AUR's orphan adoption process to claim 1,500+ Arch User Repository packages between June 10 and June 13, 2026, planting PKGBUILD scripts that pulled a malicious npm dependency named atomic-lockfile carrying an eBPF-based Linux rootkit and a stealer for credentials, SSH keys, and access tokens. The Arch Linux security team suspended new AUR account registrations while it audited the repository.
CVEasy AI v2 tops the CTEM Fitness Score leaderboard ahead of GPT-5.5, Gemini 3.1 Pro, and Llama 3.1, and beats the shipped v1 on all four product pillars: +124% on autonomous pentest, +24.5% overall on a 17-task held-out suite. Reproducible, deterministic, and 100% on-device.
A CVSS 9.8 missing authentication flaw in a Splunk Enterprise PostgreSQL sidecar endpoint lets any network-reachable attacker create or truncate arbitrary files on the host with no credentials. WatchTowr Labs demonstrated a /backup plus /restore chain that turns the file primitive into full pre-authentication remote code execution against the SIEM. Fixed in Splunk Enterprise 10.4.0, 10.2.4, and 10.0.7 per advisory SVD-2026-0603.
A CVSS 9.8 pre-authentication RCE in the Oracle PeopleSoft Enterprise PeopleTools Updates Environment Management component (PSEMHUB) was exploited as a zero-day by ShinyHunters (UNC6240) from May 27 through June 9, 2026. Oracle shipped an out-of-band Security Alert on June 10. ShinyHunters claims 100 plus breached organizations across 300 vulnerable internet-facing instances, with 40 GB of student and billing data confirmed stolen from the University of Nottingham.
A CVSS 9.3 certificate validation logic error in Check Point Remote Access VPN and Mobile Access gateways lets unauthenticated attackers establish a VPN session without a valid password. Exploited in the wild since May 7, 2026, with at least one Qilin ransomware affiliate intrusion already confirmed.
Field notes from the Gartner Security & Risk Management Summit. Under the agentic-AI hype, every serious conversation circled back to one word: resiliency. The identity shift to exposure management, the tools getting it right, and why defenders should build it.
Cisco's June 5 advisory cisco-sa-sdwan-privesc-4uxFrdzx confirms in-the-wild exploitation of a CVSS 7.8 privilege escalation in Catalyst SD-WAN Manager that lets a netadmin operator reach root on the controller. No fix exists today, and the bug chains off two earlier 2026 netadmin disclosures.
On June 1, 2026 the Miasma variant of the Shai-Hulud npm worm rode Red Hat's own GitHub Actions OIDC trust to republish 96 versions of 32 official @redhat-cloud-services packages, sweeping AWS, GCP, Azure, npm, and CI credentials at install time.
An authentication bypass in Palo Alto Networks PAN-OS GlobalProtect lets unauthenticated attackers forge override cookies and claim internal VPN IP addresses. Active exploitation. CISA KEV deadline June 1.
A threat actor tracked as TeamPCP pushed 5,718 malicious commits into 5,561 GitHub repositories in six hours, injecting backdoored Actions workflows to steal CI/CD secrets. No CVE. Named in a CISA advisory.
A malicious Nx Console VS Code extension (nrwl.angular-console v18.95.0) lived 18 minutes, silently auto-updated to roughly 6,000 developers, and led to the breach of about 3,800 GitHub internal repos. CVE-2026-48027. Confirmed exploitation.
A cross-ecosystem credential stealer planted 34 packages and 384+ versions across npm, PyPI, and Crates.io, poisoning AI assistant config files to exfiltrate wallet keys, SSH keys, and cloud credentials. No CVE. Confirmed active.
AI expanded the build and dependency surface faster than security maturity could follow. Why context engineering and exposure-driven prioritization replace the patch-everything treadmill.
Attackers rewrote 502 git tags across four Composer packages to execute a credential stealer on every composer install. No CVE. Confirmed exploitation.
CVSS tells you severity. EPSS predicts exploitation. Cloud engines score in someone else's building. TRIS v2 runs on your hardware across twelve layers, five of them brand new. Your data never leaves your network.
Everything you need to build a Continuous Threat Exposure Management program, stage by stage. All 5 Gartner CTEM stages. Integration patterns. Tool selection. Metrics. Pitfalls. A framework you can actually follow.
Master the art of building effective SIEM detection rules that reduce alert fatigue and catch real threats. Sigma rules, MITRE ATT&CK mapping, and practical examples.
Thirty minutes from a cold install to knowing your real exposure. A practitioner walkthrough of importing a scan, reading the Command Center, triaging findings, and prioritizing fixes by TRIS.
CVSS tells you how bad a vulnerability could be in theory. TRIS tells you what to do about it today. How to read the score, the action bands, and the Sprint Board, with a Log4Shell example.
A timeboxed walk through the full loop. Get data in, read your risk, triage, prioritize by TRIS, fix, and prove it, in one sitting. Run it weekly and exposure stops being a fire drill.
CVSS vs EPSS vs SSVC vs KEV vs TRIS™ , what each framework measures, what it misses, and how to layer them for composite scoring.
What BAS is, MITRE ATT&CK mapping, automated vs manual testing, ROI measurement, and the open-source BASzy™ AI option.
RBAC misconfigs, container image scanning, admission controllers, network policies, etcd security, and a hardening checklist.
OWASP API Top 10, BOLA/BFLA testing, authentication bypass, rate limiting, GraphQL security, and building an API testing program.
Security champions, PR scanning, automated dependency updates, security debt tracking, and metrics that prove DevSecOps maturity.
How VM fits into ZTA: micro-segmentation, continuous verification, device posture scoring, and a phased implementation roadmap.
Multi-tenant scanning, client reporting, SLA management, pricing models, and scaling from 10 to 100 clients profitably.
SCADA systems, the Purdue model, air-gapped scanning, ICS-CERT advisories, and compensating controls for systems that cannot be patched.
NTIA minimum elements, CycloneDX vs SPDX, and how to operationalize SBOMs as the missing layer in your VM program.
SAST, DAST, and SCA pipeline integration patterns, false positive management, and gate policies that developers will actually follow.
External attack surface discovery, asset inventory automation, continuous monitoring, and risk-based prioritization for the assets you didn't know you had.
OWASP LLM Top 10, jailbreak testing, prompt injection detection, guardrail bypass, and agent security testing with BASzy™ AI.
Right-sizing VM for small teams: the complete low-cost toolchain, minimum viable program, and SOC 2 compliance on a startup budget.
CSPM vs traditional VM, cloud-native vulnerability classes your scanner misses, and how to unify both in one prioritization pipeline.
Automated patching workflows, AI-generated fix guidance, SLA tracking with escalation, and the metrics that prove remediation velocity.
Board-level metrics, FAIR risk quantification, executive dashboards, and the 5-slide framework that gets security budgets approved.
I wasn't trying to start a company. I was tired of watching CVSS 6.5 vulnerabilities get skipped while teams chased 9.8s that nobody exploited.
A direct comparison of Rapid7 InsightVM and SentinelOne Singularity VM, and why the price gap no longer makes sense in 2026.
The 5 stages of CTEM, how EPSS+KEV+asset criticality map to each stage, and an implementation roadmap by org size.
Map CVEs to ATT&CK techniques. Score vulnerabilities by detection coverage. Patch what attackers actually exploit.
CC7.1 explained: scan frequency, SLA documentation, evidence collection, and the gap between Vanta/Drata automation and human auditor scrutiny.
Layer inheritance, SBOM generation with Syft and Grype, Cosign image signing, and automation with Dependabot and Renovate.
Coverage gaps, enrichment delays post-2024, ecosystem strengths, and how to build a multi-source aggregation pipeline.
RA-5 control requirements, mandatory CVSS-based SLA tiers, POA&M documentation, ConMon reports, and CSP vs 3PAO responsibilities.
OTX, MISP, Shodan, GreyNoise, KEV, EPSS, how to correlate feeds, map IOCs to CVEs, weight sources, and set alert thresholds.
The 5-stage pipeline, Ansible playbooks, Kubernetes rolling updates, canary deployments, rollback triggers, and SLA tracking automation.
The data sovereignty and privacy case for running vulnerability AI on your own infrastructure.
How correlated intelligence cuts signal-to-noise ratio and surfaces the vulnerabilities that are actually on fire.
The predictive framework for patching the vulnerabilities ransomware actors exploit most, before they get there.
A deep dive into the three-layer scoring model that replaces CVSS-only prioritization.
Understanding the exploit lifecycle and how to reduce your exposure before CVEs are even published.
A repeatable 5-step workflow for turning Microsoft's monthly release into a ranked, defensible patch order in under two hours.
A practitioner's guide to the four pillars of VM: asset discovery, assessment, prioritization, and remediation.
BOD 22-01 created a mandatory patch timeline for federal agencies, and a best-practice model for everyone else.
MTTR is easy to game and hard to act on. Here are five metrics that actually drive security outcomes.
Traditional scanners struggle with supply chain vulnerabilities. Here's why, and what to do about it.
CVSS measures severity. EPSS predicts exploitability. TRIS v2 combines 12 layers, including attack-path, supply-chain, defense efficacy, and FAIR-based financial impact, for the complete picture.
From Cobalt Strike to BASzy AI. Manual red teaming vs automated BAS, why you need both.
Tenable One, XM Cyber, Pentera, Cymulate, Picus, CrowdStrike, Microsoft, Rapid7, Qualys, and CVEasy: which cover all five stages, which actually validate, and what each costs to run.
Pentera, Horizon3, Cymulate, Picus, SafeBreach, XM Cyber, Scythe, Caldera, and BASzy: real exploitation vs simulation, and whether the evidence ever reranks your queue.
Cymulate, Picus, SafeBreach, AttackIQ, Pentera, Caldera, Atomic Red Team, and BASzy: simulation vs real exploitation, and where the results should actually go.
Kenna, Tenable VPR, Qualys TruRisk, Rapid7, Nucleus, Brinqa, Vulcan, ServiceNow, and TRIS: how many signals each scores, and which ranking ever gets validated.
Tenable, Qualys, Rapid7, Wiz, CrowdStrike and more, side-by-side with pricing and deployment.
No per-asset pricing. No cloud dependency. TRIS v2 12-layer scoring vs the industry incumbent.
Predictable pricing, data sovereignty, and built-in attack simulation for MSSPs.
Air-gapped, local-first, zero cloud. The definitive guide for restricted environments.
Per-asset pricing creates perverse incentives that make organizations less secure. Here's the math, and a better model.
Turn vulnerability scan results into audit evidence. How to align your VM program with the controls that actually get tested.
A practical framework for translating scanner output into reports that drive decisions instead of confusion.
A Nessus XML export is a raw data dump. Here's how to cross-reference with EPSS/KEV and produce a ranked remediation queue.
Why SaaS VM tools fail in classified networks, and how to run a full VM program with zero internet connectivity.
A 7-tier SLA framework built on EPSS and KEV, not CVSS, with escalation paths that IT will actually follow.
KEV, EPSS, NVD, MITRE ATT&CK, ISACs, what each feed tells you, what it doesn't, and how to avoid feed overload.
CVSS was designed to score severity in isolation. But "severity" without context creates noise, not signal. Here's how correlated intelligence changes everything.