IT and AI security incidents, checked against the primary source
Chicago, IL
Joined February 2020
- Tweets360
- Following58
- Followers34
- Likes27
Pinned Tweet
When the CVE record, the CVSS score, and the federal deadline all disagree, how does your team decide what gets patched first?
Federal deadline Friday, November 6: CISA (@CISAgov) put WordPress Core in the exploited catalog, and the NVD record gained the deadline without its change timestamp ever moving.
severitydaily.com/wordpress-…
Federal deadline Friday, November 13. Ivanti (@GoIvanti) scored its own exploited Connect Secure flaw 4.3 Medium, and the CVE record that landed today carries no KEV fields for a scanner to see.
severitydaily.com/ivanti-con…
A 10.0 Node-RED flaw is being exploited, and the only CVE for it covers one Siemens gateway. VulnCheck (@VulnCheckAI) caught it October 30. Not on KEV. For most instances there is no patch, only adminAuth.
severitydaily.com/node-red-c…
Deal with the Synology NAS first, not the 4.9 million SSNs — only one of Monday's ten stories is still happening. Both flaws under active attack carry records marked exploitation: none.
severitydaily.com/recap-2026…
A Dockerfile FROM line was enough to send kaniko's Entra ID token to a lookalike registry host. The library at fault has no CVE and no fixed version. No exploitation reported.
severitydaily.com/kaniko-cve…
Apache (@TheASF) fixed both new Fineract SQL injections in 1.16.1 only. NVD's version data, written today, marks 1.16.0 as not affected — and 1.16.0 shipped six days earlier. No exploitation reported.
severitydaily.com/nvd-finera…
Barracuda's advisory for a 9.3 unauthenticated bypass in its Email Security Gateway is the one page its own advisory index doesn't list. No exploitation reported.
severitydaily.com/barracuda-…
Synology confirms ransomware is encrypting NAS devices through a flaw it patched in 2024 and won't name it. The 9.8 in the advisory it points to still carries CISA (@CISAgov) exploitation: none, and no KEV entry.
severitydaily.com/synology-d…
Sunday's biggest number was Binance's $6.3B. The thing to fix first is smaller: MathLive 0.111.2 turns on a sender check that defaulted to off for years, and it carries no CVE, so nothing flags it.
severitydaily.com/recap-2026…
Jpom hands super-administrator to anyone who sends the text “is not null” as a session token. No credentials, public reproduction since October 30, and no fixed version. No exploitation reported.
severitydaily.com/jpom-is-no…
The 184,000 total circulating for the Amadeus airline breach adds three carriers' customer counts to a fourth's booking count, and the four carriers that published no number at all count as zero.
severitydaily.com/amadeus-br…
MathLive shipped the origin check behind the ChatGPT share-link takeover defaulting to "none." OpenAI patched October 26, the library on October 31, and its fix carries no CVE. No exploitation reported.
severitydaily.com/mathlive-0…
Binance says no wallet private key leaked in the $6.3 billion hot wallet theft. The attacker reached a service container that could submit withdrawals, so the signer did the work.
severitydaily.com/binance-6-…
Patch Saturday's smallest number first. The WordPress upgrade-window RCE is the only flaw with attacks reported, and its fix shipped Wednesday. Six of the day's twelve stories name no fixed version.
severitydaily.com/recap-2026…
AO3 told users to change reused passwords. The one they can't change is the AO3 password — the Archive is down at least two weeks, and OTW can't rule out the user database was taken.
severitydaily.com/ao3-otw-se…
CrowdStrike's ARTEX report confirms post-exploitation at nine organizations. The number that traveled through coverage was 140, which appears nowhere in the report.
severitydaily.com/crowdstrik…
Northflank learned of its own breach from an outside threat alert, and now tells every user to assume their environment variables were decrypted. Multiple users confirm their AI keys were used.
severitydaily.com/northflank…
WordPress (@WordPress) fixed a race condition in its own updater on October 28. The only CVE for it was published this morning, after Wordfence (@wordfence) blocked 62,969 attacks in a day.
severitydaily.com/wordpress-…
Friday's first job isn't the federal deadline. A trojanized Claude Code build left SSH backdoors that outlive uninstalling, and advisories disagree on which version to hunt. Ivanti's KEV clock ends Monday, November 2.
severitydaily.com/recap-2026…
CISA (@CISAgov) put both halves of one Ivanti Connect Secure exploit chain on KEV the same day, with deadlines eleven days apart — Monday, November 2 and November 13. The later CVE has no NVD record.
severitydaily.com/ivanti-con…
