IT and AI security incidents, checked against the primary source
Chicago, IL
Joined February 2020
- Tweets354
- Following58
- Followers31
- Likes27
Pinned Tweet
When the CVE record, the CVSS score, and the federal deadline all disagree, how does your team decide what gets patched first?
Barracuda's advisory for a 9.3 unauthenticated bypass in its Email Security Gateway is the one page its own advisory index doesn't list. No exploitation reported.
severitydaily.com/barracuda-…
Synology confirms ransomware is encrypting NAS devices through a flaw it patched in 2024 and won't name it. The 9.8 in the advisory it points to still carries CISA (@CISAgov) exploitation: none, and no KEV entry.
severitydaily.com/synology-d…
Sunday's biggest number was Binance's $6.3B. The thing to fix first is smaller: MathLive 0.111.2 turns on a sender check that defaulted to off for years, and it carries no CVE, so nothing flags it.
severitydaily.com/recap-2026…
Jpom hands super-administrator to anyone who sends the text “is not null” as a session token. No credentials, public reproduction since October 30, and no fixed version. No exploitation reported.
severitydaily.com/jpom-is-no…
The 184,000 total circulating for the Amadeus airline breach adds three carriers' customer counts to a fourth's booking count, and the four carriers that published no number at all count as zero.
severitydaily.com/amadeus-br…
MathLive shipped the origin check behind the ChatGPT share-link takeover defaulting to "none." OpenAI patched October 26, the library on October 31, and its fix carries no CVE. No exploitation reported.
severitydaily.com/mathlive-0…
Binance says no wallet private key leaked in the $6.3 billion hot wallet theft. The attacker reached a service container that could submit withdrawals, so the signer did the work.
severitydaily.com/binance-6-…
Patch Saturday's smallest number first. The WordPress upgrade-window RCE is the only flaw with attacks reported, and its fix shipped Wednesday. Six of the day's twelve stories name no fixed version.
severitydaily.com/recap-2026…
AO3 told users to change reused passwords. The one they can't change is the AO3 password — the Archive is down at least two weeks, and OTW can't rule out the user database was taken.
severitydaily.com/ao3-otw-se…
CrowdStrike's ARTEX report confirms post-exploitation at nine organizations. The number that traveled through coverage was 140, which appears nowhere in the report.
severitydaily.com/crowdstrik…
Northflank learned of its own breach from an outside threat alert, and now tells every user to assume their environment variables were decrypted. Multiple users confirm their AI keys were used.
severitydaily.com/northflank…
WordPress (@WordPress) fixed a race condition in its own updater on October 28. The only CVE for it was published this morning, after Wordfence (@wordfence) blocked 62,969 attacks in a day.
severitydaily.com/wordpress-…
Friday's first job isn't the federal deadline. A trojanized Claude Code build left SSH backdoors that outlive uninstalling, and advisories disagree on which version to hunt. Ivanti's KEV clock ends Monday, November 2.
severitydaily.com/recap-2026…
CISA (@CISAgov) put both halves of one Ivanti Connect Secure exploit chain on KEV the same day, with deadlines eleven days apart — Monday, November 2 and November 13. The later CVE has no NVD record.
severitydaily.com/ivanti-con…
A backdoored Claude Code build planted SSH keys on developer machines Thursday. Cursor's advisory was revised today to add 2.1.312 — a build researchers verified clean and the registries still serve.
severitydaily.com/claude-cod…
NVD (@NISTcyber) analyzed IBM's 33 Langflow CVE records and gave the three unauthenticated 9.8s no primary score at all, so its own severity filter returns none of them. No exploitation reported.
severitydaily.com/nvd-analyz…
Polymarket's wallet drainer arrived inside a web performance monitoring script, and beaconed the stolen data to that vendor's own telemetry endpoints, so egress looked like monitoring traffic.
severitydaily.com/polymarket…
Thursday: patch Palo Alto per the vendor's own fix table and you close one KEV entry while leaving a second open. That outranks the day's $150 million cyber cost. Kernel flaw due Saturday, October 31.
severitydaily.com/recap-2026…
GitLab (@gitlab) has a 10.0 regex overflow on CISA's KEV with a federal deadline of Sunday, November 1 — and CISA's own note says the exploited bug is Ruby's, fixed upstream with no CVE of its own.
severitydaily.com/gitlab-cve…
Palo Alto Networks (@PaloAltoNtwks) points one PAN-OS branch at a hotfix its own FAQ says fixes only php2shell, leaving the Brotli KEV flaw open. Federal deadline Tuesday, November 10.
severitydaily.com/palo-alto-…
