{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "CVEasy AI Blog",
 "home_page_url": "https://cveasyai.com/blog/",
 "feed_url": "https://cveasyai.com/blog/feed.json",
 "description": "Exposure, exploitation and remediation research from CVEasy AI. Newest first; follow next_url for older posts.",
 "language": "en",
 "next_url": "https://cveasyai.com/blog/feed-2.json",
 "_cveasy": {
  "page": 1,
  "pages": 9,
  "total_items": 176
 },
 "items": [
  {
   "id": "https://cveasyai.com/blog/program-architecture-of-trust.html",
   "url": "https://cveasyai.com/blog/program-architecture-of-trust.html",
   "title": "The program architecture of trust, and how a vulnerability queue earns it or burns it",
   "summary": "Remediation teams that stop believing the vulnerability queue triage it privately and move risk decisions into hallways. Trust is an output of six design choices, from false positive rate at intake to verified closure. A trust ledger, four ways to measure it without a survey, and a rebuild sequence that starts by shipping less work.",
   "date_published": "2026-10-28T00:00:00Z",
   "date_modified": "2026-10-28T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/program-architecture-of-trust.png"
  },
  {
   "id": "https://cveasyai.com/blog/safepay-nas-factory-reset-recovery-destruction.html",
   "url": "https://cveasyai.com/blog/safepay-nas-factory-reset-recovery-destruction.html",
   "title": "SafePay Ransomware: Factory-Resetting the Backup NAS to Kill Recovery Before Encryption (AA26-293A)",
   "summary": "SafePay does not just delete shadow copies. It factory-resets the backup NAS that holds your clean restore, then encrypts. Mechanism, the five KEV CVEs that get it in, TRIS exposure scoring, and what to hunt this week.",
   "date_published": "2026-10-27T00:00:00Z",
   "date_modified": "2026-10-27T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/safepay-nas-factory-reset-recovery-destruction.png"
  },
  {
   "id": "https://cveasyai.com/blog/arista-velocloud-cve-2026-114625-sqli-read-only-to-operator-kev.html",
   "url": "https://cveasyai.com/blog/arista-velocloud-cve-2026-114625-sqli-read-only-to-operator-kev.html",
   "title": "Arista VeloCloud Orchestrator CVE-2026-114625: Read Only to Operator Superuser via SQL Injection, CISA KEV Deadline Today",
   "summary": "On October 22, 2026, Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator that lets an Enterprise Read Only user impersonate a local operator superuser. CISA KEV deadline is October 26. Mechanism, TRIS layer walk, and the fix today.",
   "date_published": "2026-10-26T00:00:00Z",
   "date_modified": "2026-10-26T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/arista-velocloud-cve-2026-114625-sqli-read-only-to-operator-kev.png",
   "_cveasy": {
    "cves": [
     "CVE-2026-114625"
    ]
   }
  },
  {
   "id": "https://cveasyai.com/blog/exposure-chart-2026-w44.html",
   "url": "https://cveasyai.com/blog/exposure-chart-2026-w44.html",
   "title": "Both exploited flaws were in attacker hands before anyone disclosed them",
   "summary": "Six CVEs from October 14 to October 28, 2026: BeyondTrust and Ivanti were exploited before disclosure, while three 9.2 scored flaws in PHP and Node.js have no confirmed exploitation.",
   "date_published": "2026-10-26T00:00:00Z",
   "date_modified": "2026-10-26T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/exposure-chart-2026-w44.png"
  },
  {
   "id": "https://cveasyai.com/blog/litellm-1-107-0-pypi-docker-cook-pth-credential-stealer.html",
   "url": "https://cveasyai.com/blog/litellm-1-107-0-pypi-docker-cook-pth-credential-stealer.html",
   "title": "LiteLLM 1.107.0 PyPI and Docker Images Shipped a Credential Vacuum via cook.pth and sitecustomize.py",
   "summary": "On October 21, 2026, LiteLLM 1.107.0 landed on PyPI and Docker Hub carrying cook.pth, cook.py, and sitecustomize.py. The three files ran on every python invocation, exfiltrated cloud and AI credentials to litellm[.]dev/healthcheck, and never needed anyone to import litellm. No CVE. Mechanism, TRIS layer walk, and the clean rebuild sequence.",
   "date_published": "2026-10-23T00:00:00Z",
   "date_modified": "2026-10-23T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/litellm-1-107-0-pypi-docker-cook-pth-credential-stealer.png"
  },
  {
   "id": "https://cveasyai.com/blog/cve-identifier-layer-plural-and-partial.html",
   "url": "https://cveasyai.com/blog/cve-identifier-layer-plural-and-partial.html",
   "title": "The CVE identifier layer went plural and the enrichment went partial",
   "summary": "On April 15, 2026 NIST moved about 29,000 CVEs to Not Scheduled and narrowed enrichment to KEV, federal, and EO 14028 critical software. CPE is the quiet casualty. The ecosystem is now plural, CVE plus EUVD plus GHSA plus vendor advisories, and vulnerability programs have to rebuild around an alias set, a precedence policy, and a local mirror. An architecture piece, not a news post.",
   "date_published": "2026-10-21T00:00:00Z",
   "date_modified": "2026-10-21T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/cve-identifier-layer-plural-and-partial.png"
  },
  {
   "id": "https://cveasyai.com/blog/beyondtrust-remote-support-cve-2026-102764-armory-castle-zero-day.html",
   "url": "https://cveasyai.com/blog/beyondtrust-remote-support-cve-2026-102764-armory-castle-zero-day.html",
   "title": "BeyondTrust Remote Support Zero-Day CVE-2026-102764 Added to CISA KEV; China-Nexus ARMORY CASTLE Exploited Since August",
   "summary": "On August 29, 2026 ARMORY CASTLE began exploiting an improper origin validation flaw (CVE-2026-102764) in BeyondTrust Remote Support, writing files to the appliance web root and climbing to root through an SUID shell. BT26-05-RS patches 24.3.1 through 26.2.3. CISA added it to KEV on October 16 with a federal deadline of October 19.",
   "date_published": "2026-10-19T00:00:00Z",
   "date_modified": "2026-10-19T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/beyondtrust-remote-support-cve-2026-102764-armory-castle-zero-day.png",
   "_cveasy": {
    "cves": [
     "CVE-2026-102764"
    ]
   }
  },
  {
   "id": "https://cveasyai.com/blog/vulnerability-program-maturity-ladder.html",
   "url": "https://cveasyai.com/blog/vulnerability-program-maturity-ladder.html",
   "title": "A vulnerability program maturity ladder rated by evidence, not activity adoption",
   "summary": "Every security maturity model, from CMMI to OWASP SAMM, grades a vulnerability program on which practices it has adopted. OMB M-26-14 showed the better shape, measured coverage gated by level and a maturity rating that respects the weakest element. Five rungs with an evidence test for each.",
   "date_published": "2026-10-14T00:00:00Z",
   "date_modified": "2026-10-14T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/vulnerability-program-maturity-ladder.png"
  },
  {
   "id": "https://cveasyai.com/blog/flax-typhoon-microscan-mirai-botnet-recon-kev-flaws.html",
   "url": "https://cveasyai.com/blog/flax-typhoon-microscan-mirai-botnet-recon-kev-flaws.html",
   "title": "Flax Typhoon and MicroScan: Reconnaissance Run on a Mirai Botnet Against Five Aging KEV Flaws (CVE-2015-3306, CVE-2016-3081)",
   "summary": "Court filings unsealed October 8, 2026 describe Flax Typhoon reconnaissance running on a Mirai variant botnet of consumer devices, aimed at a fixed set of aging pre-authentication flaws. Mechanism, hunting queries, and why a CVSS-first queue buries all five.",
   "date_published": "2026-10-13T00:00:00Z",
   "date_modified": "2026-10-13T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/flax-typhoon-microscan-mirai-botnet-recon-kev-flaws.png",
   "_cveasy": {
    "cves": [
     "CVE-2015-3306",
     "CVE-2016-3081"
    ]
   }
  },
  {
   "id": "https://cveasyai.com/blog/ahsaycbs-cve-2026-105133-105134-unpatched-rce-chain.html",
   "url": "https://cveasyai.com/blog/ahsaycbs-cve-2026-105133-105134-unpatched-rce-chain.html",
   "title": "AhsayCBS CVE-2026-105133 and CVE-2026-105134: Unpatched Chain Executes as SYSTEM on MSP Backup Consoles",
   "summary": "On October 7, 2026, attackers began chaining two unpatched AhsayCBS zero-days to run as SYSTEM on MSP backup consoles, dropping JSP webshells and XMRig miners disguised as Microsoft Edge. Ahsay 10.3.4.0 does not fix either CVE. Mechanism, TRIS layer walk, remediation.",
   "date_published": "2026-10-12T00:00:00Z",
   "date_modified": "2026-10-12T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/ahsaycbs-cve-2026-105133-105134-unpatched-rce-chain.png",
   "_cveasy": {
    "cves": [
     "CVE-2026-105133",
     "CVE-2026-105134"
    ]
   }
  },
  {
   "id": "https://cveasyai.com/blog/exposure-chart-2026-w42.html",
   "url": "https://cveasyai.com/blog/exposure-chart-2026-w42.html",
   "title": "Four perimeter vendors, six flaws, and every one already exploited",
   "summary": "Six supply-chain CVEs cleared the bar to chart over the last two weeks, all on internet-facing products from Fortinet, Cisco, Citrix, and Palo Alto, and every one was confirmed under active exploitation.",
   "date_published": "2026-10-12T00:00:00Z",
   "date_modified": "2026-10-12T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/exposure-chart-2026-w42.png"
  },
  {
   "id": "https://cveasyai.com/blog/tensorlake-npm-0-5-144-chaindrop-shai-hulud-bun-worm.html",
   "url": "https://cveasyai.com/blog/tensorlake-npm-0-5-144-chaindrop-shai-hulud-bun-worm.html",
   "title": "Tensorlake npm 0.5.144 Compromised by Shai-Hulud ChainDrop Variant Delivering a Bun-Launched Credential Worm",
   "summary": "On October 8, 2026, a compromised Tensorlake maintainer identity shipped tensorlake 0.5.144 to npm. A preinstall hook downloaded the Bun runtime and ran a Shai-Hulud credential-stealing worm under it. Mechanism, TRIS layer walk, and remediation.",
   "date_published": "2026-10-09T00:00:00Z",
   "date_modified": "2026-10-09T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/tensorlake-npm-0-5-144-chaindrop-shai-hulud-bun-worm.png"
  },
  {
   "id": "https://cveasyai.com/blog/security-queue-economics.html",
   "url": "https://cveasyai.com/blog/security-queue-economics.html",
   "title": "Security queue economics, the steady-state math a vulnerability program cannot dashboard its way out of",
   "summary": "The 2026 arithmetic shows CVE arrivals rising fast and remediation service rate roughly flat. Little",
   "date_published": "2026-10-07T00:00:00Z",
   "date_modified": "2026-10-07T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/security-queue-economics.png"
  },
  {
   "id": "https://cveasyai.com/blog/netscaler-edge-cluster-log-poisoning-deferred-root-execution.html",
   "url": "https://cveasyai.com/blog/netscaler-edge-cluster-log-poisoning-deferred-root-execution.html",
   "title": "NetScaler Edge Intrusion Cluster: CVE-2026-88771 Log Injection Turns a Failed Login Into Deferred Root Execution",
   "summary": "An unattributed cluster is mass-exploiting Citrix NetScaler CVE-2026-88771 and CVE-2026-88772. A failed login writes a command into the appliance audit log and a default-enabled root telemetry worker runs it later. Mechanism, the TRIS layer walk, hunting queries and remediation.",
   "date_published": "2026-10-06T00:00:00Z",
   "date_modified": "2026-10-06T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/netscaler-edge-cluster-log-poisoning-deferred-root-execution.png",
   "_cveasy": {
    "cves": [
     "CVE-2026-88771",
     "CVE-2026-88772"
    ]
   }
  },
  {
   "id": "https://cveasyai.com/blog/fortimail-cve-2026-104286-ibe-path-traversal-null-byte-kev.html",
   "url": "https://cveasyai.com/blog/fortimail-cve-2026-104286-ibe-path-traversal-null-byte-kev.html",
   "title": "FortiMail CVE-2026-104286, pre-auth path traversal with a null byte, actively exploited and on CISA KEV",
   "summary": "CVE-2026-104286 is a CVSS 9.8 pre-auth path traversal in FortiMail",
   "date_published": "2026-10-05T00:00:00Z",
   "date_modified": "2026-10-05T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/fortimail-cve-2026-104286-ibe-path-traversal-null-byte-kev.png",
   "_cveasy": {
    "cves": [
     "CVE-2026-104286"
    ]
   }
  },
  {
   "id": "https://cveasyai.com/blog/cisco-sdwan-manager-cve-2026-76504-uri-encoding-auth-bypass-kev.html",
   "url": "https://cveasyai.com/blog/cisco-sdwan-manager-cve-2026-76504-uri-encoding-auth-bypass-kev.html",
   "title": "Cisco Catalyst SD-WAN Manager CVE-2026-76504 Auth Bypass: One Encoded Character Opens the Admin API",
   "summary": "Cisco Catalyst SD-WAN Manager CVE-2026-76504 (CVSS 9.8) is in CISA KEV with a federal remediation deadline of October 3, 2026. One hex-encoded character in the URI, %6a instead of j in j_security_check, slips past the auth filter and lands on the admin API. Mechanism, TRIS scoring, and remediation.",
   "date_published": "2026-10-02T00:00:00Z",
   "date_modified": "2026-10-02T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/cisco-sdwan-manager-cve-2026-76504-uri-encoding-auth-bypass-kev.png",
   "_cveasy": {
    "cves": [
     "CVE-2026-76504"
    ]
   }
  },
  {
   "id": "https://cveasyai.com/blog/zero-day-vulnerability-tabletop.html",
   "url": "https://cveasyai.com/blog/zero-day-vulnerability-tabletop.html",
   "title": "A zero-day tabletop for vulnerability teams: rehearsing the mass-exploitation day",
   "summary": "IR tabletops rehearse breaches. Vulnerability teams rarely rehearse the day a vendor advisory hits a program that cannot yet answer whether it even runs the affected product. A framework with four capability tests, an inject set, scoring, and a composite scenario, grounded in CISA CTEP and NIST SP 800-84.",
   "date_published": "2026-10-01T00:00:00Z",
   "date_modified": "2026-10-01T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/zero-day-vulnerability-tabletop.png"
  },
  {
   "id": "https://cveasyai.com/blog/mcp-python-sdk-oauth-credential-theft-ghsa-qx49-fqc8-xw99.html",
   "url": "https://cveasyai.com/blog/mcp-python-sdk-oauth-credential-theft-ghsa-qx49-fqc8-xw99.html",
   "title": "MCP Python SDK OAuth Credential Redirection Lets Any Server Steal Client Secrets, GHSA-qx49-fqc8-xw99",
   "summary": "Anthropic",
   "date_published": "2026-09-30T00:00:00Z",
   "date_modified": "2026-09-30T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/mcp-python-sdk-oauth-credential-theft-ghsa-qx49-fqc8-xw99.png"
  },
  {
   "id": "https://cveasyai.com/blog/citrix-netscaler-cve-2026-88771-88772-dual-zero-day-rce.html",
   "url": "https://cveasyai.com/blog/citrix-netscaler-cve-2026-88771-88772-dual-zero-day-rce.html",
   "title": "Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 Dual Pre-Auth Zero-Day RCEs Exploited Before Patch, CTX697096 Ships September 27",
   "summary": "CVE-2026-88771 is an unauthenticated improper input validation RCE that hits every NetScaler ADC and Gateway on affected builds including default configuration. CVE-2026-88772 is a memory overflow reachable over DTLS, on by default on every VPN virtual server. Both scored CVSS 9.5, both exploited before the patch shipped, both on CISA KEV with a federal deadline of September 30, 2026. Mechanism, TRIS layer walk, patch, rotate, and hunt checklist.",
   "date_published": "2026-09-28T00:00:00Z",
   "date_modified": "2026-09-28T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/citrix-netscaler-cve-2026-88771-88772-dual-zero-day-rce.png",
   "_cveasy": {
    "cves": [
     "CVE-2026-88771",
     "CVE-2026-88772"
    ]
   }
  },
  {
   "id": "https://cveasyai.com/blog/exposure-chart-2026-w40.html",
   "url": "https://cveasyai.com/blog/exposure-chart-2026-w40.html",
   "title": "The perimeter appliances were the target this fortnight",
   "summary": "Seven critical CVEs charted from two weeks of CVEasy AI threat-intel, all under active exploitation, with edge and security appliances from Cisco, F5, Check Point, and Citrix leading the list.",
   "date_published": "2026-09-28T00:00:00Z",
   "date_modified": "2026-09-28T00:00:00Z",
   "image": "https://cveasyai.com/images/heroes/exposure-chart-2026-w40.png"
  }
 ]
}