Posts
Your Build lands in Release Jail. You're welcome
Announcing Release Jails: a pipeline gate on a repository's accumulated state rather than on one scan. Fail CI when findings sit past the remediation window your triage policy already publishes, when a runtime goes end-of-life, when a migration misses its date, or when secrets, licence, container and infrastructure hygiene regress. Four rule kinds sharing one shape, org-wide policy with per-repository overrides, time-boxed exemptions carrying a reason and an approver, and OpenVEX, CycloneDX and SARIF attestations written on every run including failing ones. Stale or missing scan coverage gets its own exit code, because a pipeline that quietly stopped scanning is not the same problem as a vulnerability and does not have the same owner.
security policy gatevulnerability SLA enforcementremediation windowCISA KEVend-of-life dependenciestechnical debt policy
Nobody Knows Which MCP Servers Your Developers Wired In. Now You Do, And You Can Say No.
The Vulnetix AI Firewall now governs the agent capability plane: the tools a coding agent offers the model, the MCP servers wired into the session, the skills it exposes, and which client is driving. Four rule families (tool, MCP, skill, client) with four actions, including strip, which removes one tool from the request so the model is never offered it and the session keeps working. Alongside it, a runtime AI inventory of every tool, MCP server, skill and client your agents actually carry, built from live traffic and free on every plan. An MCP server added to a developer local config appears in no pull request, no procurement record and no repository scan, but it is in every request that agent makes. Pairs with AI-BOM: a scan finds what is written down, this finds what ran. Metadata only, still no prompts logged.
MCP securityshadow MCPMCP governanceagent tool allowlistAI firewallLLM gateway
Your Coding Agent is Confidently Wrong About CVEs. The MCP Server Fixes That.
Announcing the Vulnetix MCP server: 31 vulnerability intelligence tools and 33 expert security workflows for every Model Context Protocol client, including Claude Code, Cursor, VS Code, Windsurf, Zed, Cline, Goose, JetBrains and Codex CLI. One URL and one header, nothing to install. CISA KEV deadlines, exploit intelligence across 20 sources, EPSS and SSVC signals, ranked remediation plans and pre-install dependency risk gating, answered from live data instead of training data. Responses are shaped server-side from 2.6 MB to 10.6 KB so they fit a context window, and no source code ever leaves your machine.
MCP serverModel Context Protocolvulnerability intelligenceClaude Code MCPCursor MCPVS Code MCP
You Already Fixed It. You Just Did Not Know Yet. Vulnetix is Now in Your Editor.
Announcing Vulnetix for VS Code: six scanners (dependencies across 40+ ecosystems, 790 static analysis rules, 1,090 secret patterns, container, infrastructure-as-code and licence checks) surfacing findings on the line that causes them. Scanning runs locally, so source code never leaves the machine, and the extension drives the same binary and the same organisation policy as your pipeline. Published to the Visual Studio Marketplace and Open VSX, so it works in 13 editors including Cursor, Windsurf, VSCodium, Gitpod, Coder, Kiro, Positron and Trae. Every finding carries the records that decide urgency: four KEV catalogues, exploit counts across 20 sources, end-of-life release data, malware records, OpenSSF Scorecard and per-advisory reachability queries.
VS Code security extensionVS Code vulnerability scannerCursor security extensionWindsurf security pluginVSCodium securityOpen VSX
Campaigns are Live: Your Burndown Finally Lands on Zero
Announcing Campaigns: a named remediation push whose cohort is frozen when you commit to it, so the denominator cannot move while the team works. Three targets (vulnerabilities, dependencies, repositories), seven ways an item can be judged finished, and a closure that only counts when a later scan of the same repository confirms it. Closures with that evidence are reported separately from closures without. Covers the work every team already runs under a different name: AppSec remediation campaigns, risk reduction sprints, AppSec debt liquidation, flaw eradication, exploitation surface reduction, security hygiene sprints, dependency upgrade waves, SLA breach remediation, audit readiness sprints and policy enforcement waves.
remediation campaignAppSec remediation campaignvulnerability remediation campaignrisk reduction sprintAppSec debt liquidationflaw eradication campaign
Risk Prioritization is Live: You Set the Order, Not the Scores
Announcing per-organisation risk prioritization: an ordered rule strategy that decides how Vulnetix ranks your open findings. Fifteen signals you can drag into any order, from known malware and four KEV catalogues (CISA, ENISA EU, Vulnetix, VulnCheck) through weaponized exploits and live honeypot sightings, to EPSS and Coalition ESS prediction, CVSS and CWSS impact, and the custom scores your own analysts set. First matching rule wins, the shipped default is 23 rules, and every signal is backed by the Vulnetix VDB across 160+ upstream sources.
risk prioritizationvulnerability prioritisationrisk-based vulnerability managementRBVMprioritisation strategywhat to fix first
Reports are Live: Eight Exec-Ready Reports, Built from the Daily Work
Announcing the Vulnetix reporting suite: eight period-scoped reports produced continuously from your findings, SBOMs, firewall telemetry and triage decisions. Six map to the regulations and frameworks your auditors ask about (EU AI Act, NIST AI RMF, ISO 42001, OWASP Top 10, PCI DSS, EU Cyber Resilience Act); two are native operational reads (Scan Coverage, and Exposure and Remediation Performance). Org-wide or per-repository, honest about their own maturity, exportable as PDF, OSCAL JSON and evidence bundles with SHA-256 sums.
compliance reportssecurity reportingexec-ready reportsboard reportingGRCEU AI Act
Ignore Rules are Live: Suppress Findings from the CLI, in Code, and Org-Wide
Announcing the Vulnetix suppression system: manage ignore rules with vulnetix ignore (add, list, remove, sync), suppress in source with gosec-compatible nosec comments, keep rules in a local .vulnetix/memory.yaml that works offline, and sync them to the backend so the whole organisation shares one policy. Anchor a rule by rego ruleId, finding id (CVE), or file path, scope it by scanner category, set a suppression type and reason, and auto-expire it. Every anchor must match before a finding is silenced.
suppressionignore rulesvulnetix ignoresuppress findingsfalse positiverisk accepted
The Bird is Back: Three Ways to Ask Pix
Pix, the Vulnetix Resolve AI assistant, now answers in three modes. Rubber Duck is a fast, plain-spoken debugging and triage sounding-board. Kremvax is a meticulous auditability and provenance analyst for the evidence trail: what was scanned, what the SBOM and signatures say, why a decision holds up. Dark Avenger is a deep cross-domain investigator that connects the audit trail to the wider threat picture. Grounded in your findings, SBOMs and the PixLog audit trail, powered by a free, open-source CLI and coding plugin, with an honest comparison to AI autofix from Snyk, Endor Labs, Aikido, GitHub Copilot Autofix and Semgrep. Press Shift+Tab to cycle modes.
Pix AI AssistantVulnetix ResolveAI security chatbotvulnerability triage AISOC triageAppSec assistant
Supply-Chain Malware Trends
A live, data-led view of software supply-chain malware across four feeds: OSSF Malicious Packages, OpenSourceMalware, Vulnetix CLI Malscan and the Vulnetix VDB. Malware advisories, malicious packages, IOC samples and bad actors, tracked per ecosystem, per month, straight from the Vulnetix VDB, with an honest reckoning of which feeds a scanner can actually act on.
supply chain malwaremalicious packagesOSSF malicious packagesOSV MALOpenSourceMalwareMalscan
Cryptography Inventory is Live: Know Your Post-Quantum Exposure
Announcing the Cryptography Bill of Materials (CBOM) for the Vulnetix Code Scanner. vulnetix cbom inventories every algorithm, certificate and crypto library across your code and config, classifies each for post-quantum readiness (quantum-safe / vulnerable / deprecated / hybrid), and scores the whole estate against nine national standards bodies, including NIST, CNSA 2.0, BSI, NCSC and more. CycloneDX 1.7 native, metadata only, no source or key bytes leave your machine.
CBOMcryptography bill of materialspost-quantumPQC readinessquantum-safequantum-vulnerable
AI Bill of Materials is Live: Inventory the AI in Your Code
Announcing the AI Bill of Materials (AI-BOM) for the Vulnetix Code Scanner. vulnetix aibom discovers every AI coding agent, SDK and model touching a project across four evidence passes (environment-variable names, config and instruction files, source-level SDK and model literals, and commit authorship) and emits a CycloneDX 1.7 AI-BOM. Catches shadow AI and autonomous agents like Devin and Jules that leave only a commit trailer. Env-var values are never read.
AI-BOMAIBOMAI bill of materialsshadow AIAI governanceCycloneDX
Malscan is Live: In-Process Malware Scanning, and Free STIX Threat Feeds
Announcing Malscan, the Vulnetix in-process malware engine: four detector families (iocscan, detect, ioc, badhash) scan the dependencies already installed on disk across ten ecosystems, inside vulnetix scan or standalone with SARIF output. The headline: the intelligence is free, with per-ecosystem STIX 2.1 DNS and URL feeds at vulnetix.com/malscan-stix/, refreshed every 15 minutes with sha256 sidecars, AGPL-3.0 licensed, ready for your SIEM, firewall, EDR or CTI platform.
Malscanmalware scanningsupply chain malwareSTIX 2.1free threat feedthreat intelligence
Malware Campaigns & Threat Actors
An interactive, data-driven catalogue of the software supply-chain malware campaigns Vulnetix tracks and the threat actors behind them. Choose any campaign for an impact-and-mitigations teardown, or any actor for a motivations-tools-tradecraft profile, with live indicators of compromise from the Vulnetix VDB. Where our data is partial we show the IOCs and say so.
malware campaignthreat actorsupply chain attackIOCindicators of compromisethreat intelligence
Atomic Arch, and other tracked Malware campaigns
Our threat intelligence on the supply-chain malware campaigns Vulnetix investigates. Starting wiht Atomic Arch (hijacked AUR maintainer accounts), and others like TeamPCP / Miasma (PyPI) that we have some insights to share. Threat-actor accounts, recovered emails, file hashes, C2 domains and IPs, and .onion endpoints, grouped by campaign.
malware campaignsupply chain attackthreat actorIOCindicators of compromiseAUR
Safe Harbour is Live: Upgrade to Safe, Not Just to New
Announcing Safe Harbour, the Vulnetix remediation-confidence engine: every published version of a dependency scored across four axes (vulnerabilities, exploits, malware and end-of-life), with the closest clean version recommended, not just the newest. Three presets (safest, latest, stable), full per-version evidence (exploit maturity, KEV, EPSS, CESS, CVSS), and consistency with the Package Firewall so remediation and prevention agree. No source upload; it works from the package name in the Console, API and agent skills.
Safe Harboursafest versionsafe versiondependency upgraderemediationversion bump
Announcing the Vulnetix Vendor Patching Archives
Twelve vendor-specific patching-guidance archives are now live on Vulnetix, Microsoft Patch Tuesday, Red Hat RHSA, Google / Chrome (incl. Project Zero), Apple, Canonical / Ubuntu, Alpine (with Chainguard + Wolfi + Red Hat hardened-registry variants), SUSE (incl. Rancher portfolio), AWS (Amazon Linux + AWS SDK), Cloudflare, Cisco PSIRT, Broadcom / VMware (incl. Bitnami + Tanzu), and Alibaba Cloud. Each archive ships month-by-month coverage, downloadable CSAF / VEX where the vendor provides it, and live KEV / EPSS / PoC-maturity enrichment from the Vulnetix VDB.
Vulnetix vendor archivesvendor patchingPatch TuesdayRHSAUSNALAS
Google / Chrome Security Advisory Archive
Every Google-attributable CVE across five programmes, GCVE (Google's CNA), Google Cloud Security Bulletins (incl. Chrome stable channel + Android Security Bulletin redistributions), Project Zero in-the-wild tracker, and the ~20 Google-maintained open-source projects (Chromium, Android/AOSP, ChromeOS, Go, Kubernetes, TensorFlow, Angular, Bazel, gRPC, Protocol Buffers, gVisor, Flutter, Dart, Firebase, Skia, Tink, V8, Material, ORTools, Polymer, Istio, googleapis SDKs). Month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
GoogleChromeChromiumAndroidAOSPChromeOS
Apple Security Advisory Archive
Every Apple-vendor CVE across macOS, iOS, iPadOS, tvOS, watchOS, visionOS, Safari (WebKit), Xcode, iCloud for Windows, iTunes, Apple TV, HomePod, AirTag, and the broader Apple portfolio, month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
ApplemacOSiOSiPadOStvOSwatchOS
Canonical / Ubuntu Security Advisory Archive
Every Ubuntu Security Notice (USN-NNNN-N) across all supported LTS releases, plus Livepatch, Snap store advisories, and the broader Canonical portfolio (MAAS, Juju, Multipass, microK8s, LXD, Incus, Charmed Kubernetes). Month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
CanonicalUbuntuUSNUbuntu Security NoticesUbuntu LTSLivepatch
Alpine Linux Security Advisory Archive
Every Alpine Linux security advisory across all supported releases (Alpine 3.18, 3.19, 3.20, 3.21, edge), aports source packages from the Alpine secdb feed plus the same package as it ships in the Docker Hub Official Alpine image, Chainguard hardened images, Wolfi undistro, and the Red Hat hardened registry. Same upstream package, different vulnerability footprint per registry. Month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
Alpine LinuxAlpine secdbaportsalpine:3.18alpine:3.19alpine:3.20
SUSE Security Advisory Archive
Every SUSE security advisory, SUSE-SU-* errata for SUSE Linux Enterprise Server and SUSE Manager, openSUSE-SU-* errata for Leap and Tumbleweed, plus Rancher-portfolio CVEs across K3s, RKE2, NeuVector, Harvester, and Longhorn. Month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
SUSESLESSUSE Linux EnterpriseopenSUSEopenSUSE LeapopenSUSE Tumbleweed
Cloudflare Security Advisory Archive
Every Cloudflare security advisory, CNA GHSA entries from the cloudflare/advisories repo, blog disclosures from blog.cloudflare.com/tag/cve, and changelog notices from developers.cloudflare.com/changelog, covering Workers, Pages, R2, D1, Access, Tunnel, WAF, DNS, Magic Transit, and the rest of the portfolio. Month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
CloudflareCloudflare CNAcloudflare/advisoriesGHSACloudflare WorkersCloudflare Pages
Alibaba Security Advisory Archive
Every Alibaba Cloud Linux 2 security advisory (ALINUX2-SA-*) and every CVE naming Alibaba or Aliyun as the affected vendor across the Aliyun product portfolio (ECS, OSS, RDS, SLB, PolarDB, Lindorm, MaxCompute, DataWorks) plus Dragonwell JDK, month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
AlibabaAlibaba CloudAliyunALINUXALINUX2-SAAlibaba Cloud Linux 2
Cisco Security Advisory Archive
Every Cisco PSIRT security advisory (cisco-sa-*) and every CVE naming Cisco as the affected vendor across IOS, IOS-XE, NX-OS, ASA, Firepower, Meraki, Webex, AnyConnect, Catalyst, Nexus, and acquired products (Duo, AppDynamics, ThousandEyes), month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
CiscoPSIRTcisco-saCisco IOSIOS-XENX-OS
AWS Security Advisory Archive
Every Amazon Linux ALAS advisory (AL1, AL2, AL2023), every AWS Security Bulletin for cloud services (EC2, S3, IAM, EKS, ECS, Lambda, RDS), and every CVE in the official AWS SDKs (Java, Go, JavaScript, Python, CDK), month by month, enriched with live KEV / EPSS / PoC maturity from the Vulnetix VDB.
AWSAmazon LinuxALASAL1AL2AL2023
Broadcom Security Advisory Archive
Every Broadcom security advisory across the VMware, Bitnami, Cloud Foundry, and Tanzu portfolios, month by month, with VMSA-coded VMware bulletins, Bitnami packaged-software CVEs, BOSH stemcell + Cloud Foundry buildpack enrichment, downloadable CSAF where available, and live exploit intelligence from the Vulnetix VDB.
BroadcomVMwareVMSAVMware Security AdvisoryvCentervSphere
Red Hat Security Advisory Archive
Every Red Hat Security Advisory (RHSA), month by month, with downloadable CSAF documents, full CVE coverage, affected products, and live exploit intelligence from the Vulnetix VDB. Navigate the full RHSA history or deep-link to any month.
RHSARed Hat Security AdvisoryRed Hat Enterprise LinuxRHELerrataCSAF
Just Patch It
The decline of the CVE program, NVD obsolescence, the CISA ADP downgrade, and GCVE's federated takeover, visualised. Why "just patch" is the security industry's alternator joke.
CVE programNVDNISTCISAVulnrichmentADP
Reachability is Live: Find the Code That Actually Matters
Announcing reachability for the Vulnetix Code Scanner, precise per-CVE detection patterns, evaluated locally against your source across 17 languages, no source upload. Cuts the SCA queue by 60-90% on mature codebases, ships audit-grade evidence for VEX, and gives security vendors a defensible reachability story without rebuilding the database.
reachabilitycode scannerSCAvulnerability prioritisationVEXsemantic reachability
Vulnetix KEV: Evidence the Authority Lists Haven't Reached Yet
A live analysis of Vulnetix KEV, an independent, evidence-driven catalogue of CVEs with corroborated exploitation signals that aren't (yet) on CISA, ENISA, or VulnCheck KEV. Qualifying-signal breakdowns, added-over-time pace, vendor concentration, ransomware overlap, and a searchable table of every entry.
Vulnetix KEVknown exploited vulnerabilitiesCISA KEVENISAVulnCheck KEVexploitation evidence
Exploit Intelligence Signals
A seven-tier view of how the world's exploit data actually stacks up, from social mentions to KEV listings to EPSS predictions. Live counts from the Vulnetix VDB, honestly sourced.
exploit intelligenceCVEKEVEPSSCESSCoalition ESS
Patch Tuesday Archive
Every Microsoft Patch Tuesday release, CVE-by-CVE, with downloadable CSAF + VEX documents and live exploit intelligence from the Vulnetix VDB. Navigate the full history or deep-link to any month.
Patch TuesdayMSRCMicrosoft Security Response CenterCVECSAFVEX
Detection Rules are Live: Patch What You Can, Detect What You Can't
Announcing Detection Rules in the Vulnetix VDB: Snort and YARA rules from the Snort community, Emerging Threats and Vulnetix research, correlated automatically to the CVEs in your findings, parsed into one schema with MITRE ATT&CK technique and tactic IDs, and ranked by Threat Exposure Score. Cross-referenced with Safe Harbour: when a CVE has no safe version to upgrade to, its detection rule is flagged as the best mitigation. CLI commands, VDB API and console included.
detection rulesSnort rulesYARA rulesSuricataIDS rulesIPS rules
Matching Cloud Vulnerabilities
How Vulnetix correlates cloud-provider advisories to your running workloads using the IETF CRIT specification, deterministic matching across AWS, GCP, and Azure.
cloud vulnerabilitiesCVE matchingIETF CRITcloud securityAWS advisoriesGCP advisories
Vulnerabilities Confirmed Discovered by AI
A living tracker of every CVE and equivalent ID confirmed discovered by an AI system, from Big Sleep's SQLite stack underflow to Project Glasswing's 50+ entries. Includes the models-vs-harness distinction, a leaderboard across AI orgs, live exploitation intelligence from the Vulnetix VDB, and a maintainer's honest accounting of the AI-bug-report slop problem.
AI security researchCVEvulnerability discoveryBig SleepProject GlasswingMythos
Bypassing the Need for Scanners
Traditional vulnerability scanners fire after the code is already written, committed, and pushed. The feedback loop is architecturally broken. Here's why AI coding agents make the old model obsolete.
AI coding agentsvulnerability scannersshift-leftpre-commit securitySCASAST
Vendor Disclosure Trends
Monthly and yearly vendor disclosure counts, broken down by CVE, GHSA, and everything else. Live data from the Vulnetix VDB, sourced from 160+ authorities. An honest look at who's actually writing the world's advisories.
CVE trendsGHSAvulnerability disclosurevendor advisoriesCNAvulnerability database
SBOM: Source of Truth for Software Supply Chain Security
Why every software team needs an SBOM. From incident response to regulatory compliance, and the 11 hidden problems with vendor SBOM generators that Vulnetix solves.
SBOMsoftware bill of materialsCycloneDXSPDXsupply chain securityvulnerability management
Topics
.vulnetix0day in the wildACSCADPagent capabilityagent harnessagent tool allowlistagentic AI securityagentic securityAI asset inventoryAI assistantsAI autofixAI bill of materialsAI coding agent securityAI coding agentsAI firewallAI governanceAI inventoryAI SDK inventoryAI security chatbotAI security researchAI-BOMAIBOMAikido AutoTriageAirPodsAirTagAISLEAIVDAL1AL2AL2023ALASAlibabaAlibaba ACKAlibaba CloudAlibaba Cloud Linux 2ALINUXALINUX2-SAAliyunAliyun ECSAliyun OSSAliyun RDSAliyun SLBAlpinealpine edgeAlpine LinuxAlpine secdbalpine:3.18alpine:3.19alpine:3.20alpine:3.21Amazon LinuxAndroidAngularAnthropicAnyConnectAOSPapkaportsAppDynamicsAppleApple security releaseApple TVAppSec assistantAppSec debt liquidationAppSec governanceAppSec remediation campaignAria AutomationASAAtomic Archattacker emailattacker handleaudit evidenceaudit readinessaudit readiness sprintaudit trailAURautonomous vulnerability discoveryAWSAWS advisoriesAWS CDKAWS SDKAWS security bulletinsaws-sdk-goaws-sdk-javaaws-sdk-jsAzure advisoriesbadhashbase imageBazelBedrockbest mitigationBig SleepBitnamiBitnami Helm chartboard reportingBOSHboto3BroadcomBSIbug bountyC2C2 URLsCanonicalCatalystCBOMCCCScertificateCESSChainguardChainguard imagesCharmed KubernetesChromeChromeOSChromiumCI security gateCIRCLCISACISA KEVCISA KEV due dateCiscoCisco IOSCisco PSIRTcisco-saClaudeClaude CodeClaude Code MCPClaude Code securityCline MCPclosest safe versionCloud Foundrycloud securitycloud vulnerabilitiesCloudflareCloudflare AccessCloudflare AI Gateway alternativeCloudflare CNACloudflare D1Cloudflare DNSCloudflare PagesCloudflare R2Cloudflare TunnelCloudflare WAFCloudflare Workerscloudflare/advisoriescloudflaredCNACNSA 2.0Coalition ESScode scannerCodeQL comparisonCoderCodexCodex CLI MCPCodex CLI securitycompliance evidencecompliance reportsCompute Enginecontainercontainer registryContinuous Threat Exposure ManagementCopilotcorrelated rulesCPECrowdSeccrypto inventorycryptography bill of materialsCSAFCTEMcurl pipe bashCursorCursor MCPCursor securityCursor security extensioncustom scoringCVECVE detectionCVE matchingCVE programCVE trendsCVSSCWE eradicationCWSSCycloneDXCycloneDX VEXDark AvengerDartDataWorksdependency confusiondependency migrationdependency risk gatingdependency upgradedependency upgrade wavedetection rulesdeveloper workflowDevinDevSecOpsdistrolessDocker Hub AlpineDragonwellDuo SecurityEC2ECSEKSEmerging Threatsend of lifeend-of-life dependenciesend-of-life detectionEndor Labs AURIENISAENISA EU KEVEO 14028EOLEPSSerrataESXiEU AI ActEU AI Act record keepingEU CRAEU Cyber Resilience Actevidence bundleexception managementexec-ready reportsexit codeexpire suppressionexploit intelligenceexploit maturityExploit-DBexploitability indexexploitation evidenceexploitation maturityexploitation surface reductionExploitDBexposure managementexposure reportfalse positivefinding triageFirebaseFirepowerflaw eradication campaignFlutterFMCfree threat feedFXOSGCPGCP advisoriesGCVEGemini CLIGHSAGitHub Copilot AutofixGitpodGKEGogolangGoogleGoogle CloudgoogleapisGoose MCPgosec nosecGRCgRPCgVisorharvest now decrypt laterHarvesterHomePodHT201222IaCIAMiCloudIDE security scanningIDS rulesIETF CRITignore rulesincident responseIncusindicators of compromiseinline suppressionintent-to-useIOCIOC feediocscaniOSIOS-XEiPadOSIPS rulesISO 42001ISO 42001 AI inventoryISO/IEC 42001IstioiTunesJBossJetBrains MCPJujuJulesK3sk8sKB articleskernel CVEKEVKiroknown exploited vulnerabilitiesKpqCKremvaxKubernetesLambdaLangChainlicenseLindormLiteLLM alternativeLivepatchLLM gatewaylocal security scanningLonghornLXDMAASmachine-learning-modelmacOSMagic TransitMagic WANmalicious domainsmalicious packagemalicious packagesMalscanmalwaremalware advisoriesmalware campaignmalware detectionmalware in CI/CDmalware scanningmalware trendsmalware versionMaterial DesignMaxComputeMCP governanceMCP securityMCP serverMCP server policymean time to remediatememory.yamlMerakiMetasploitMiasmamicroK8sMicrosoftMicrosoft Security Response CenterMicrosoft vulnerabilitiesmigration trackingMiniflareMISPMITRE ATT&CKML-DSAML-KEMModel Context Protocolmodel inventorymodelCardmonthly archiveMSRCMTTRMultipassmuslMythosNCSCNeuVectorNexusNISTNIST AI RMFNmap NSEnosecnpmnpm malwareNucleiNuGetNUKIBNVDNVD alternativeNX-OSo3open source AppSecOpen VSXOpenAIOpenCTIOpenShiftOpenSourceMalwareOpenSSF Malicious PackagesOpenSSF ScorecardopenSUSEopenSUSE LeapopenSUSE TumbleweedopenSUSE-SUOpenVEXOR-Toolsorg scoredorg-wide policyOSCALOSS-FuzzOSSF malicious packagesOSVOSV MALOWASP LLM06 excessive agencyOWASP Top 10OWASP Top 10 2025package firewallpackage updatesPackagistpatch availabilityPatch TuesdayPCI DSSPCI DSS v4.0.1Pix AIPix AI assistantPix AI AssistantPixLogPolarDBpolicy as codepolicy enforcement wavePolymerPortkey alternativePositronpost-quantumpostinstall malwarePQC readinesspre-commit securityprioritisation strategyProject GlasswingProject ZeroProtocol Buffersprovenanceprovenance analysisPSIRTpurlPyPIPyPI malwarequality gatequantum-safequantum-vulnerableRancherransomwareratchetRBVMRDSreachabilityRed HatRed Hat Enterprise LinuxRed Hat hardened registryRed Hat Security AdvisoryRegulation 2024/1689Regulation 2024/2847remediationremediation burndownremediation campaignremediation guidanceremediation performanceremediation SLAremediation windowremote MCP serverReport on ComplianceRHELRHSArisk acceptancerisk acceptedrisk prioritizationrisk reduction sprintrisk-based vulnerability managementRKE2ROCRubber DuckRubyGemsrule catalogruleIdruntime AI discoveryS3SafariSafe Harboursafe harbour autofixsafe patchingsafe versionsafest versionSARIFSARIF ruleIdSASTSAST VS CodeSBOMSBOM VS CodeSCASCA VS Codescan coveragesecret scanning VS CodesecretsSecurity Copilotsecurity debtsecurity erratasecurity exemptionssecurity hygiene sprintsecurity policy gatesecurity reportingsemantic reachabilitySemgrep AssistantSentinelshadow AIshadow MCPShadowservershift left securityshift-leftsigned SBOMSkiaSLA breach remediationSLA complianceSLESSLH-DSASLSASnap storeSnapcraftSnortSnort rulesSnyk Agent FixSnyk SAST comparisonSOCSOC triagesoftware bill of materialssoftware supply chainSPDXSplunkSSHSSVCSTIX 2.1streamable HTTPsupply chain attacksupply chain malwaresupply chain securitysuppress findingssuppressionsuppression policiesSuricataSUSESUSE Linux EnterpriseSUSE ManagerSUSE-SUTanzuTeamPCPtechnical debttechnical debt policyTensorFlowThousandEyesthreat actorthreat actorsthreat exposurethreat huntingthreat intelligenceTinkTLStool allowlistTraetriage queuetvOStyposquatUbuntuUbuntu LTSUbuntu ProUbuntu Security NoticesUSNV8vCenterVDBvendor advisoriesvendor patchingverified remediationversion bumpversion safety matrixVEXVEX evidencevisionOSVMSAVMwareVMware Security AdvisoryVS Code MCPVS Code security extensionVS Code vulnerability scannerVSCodium securityvSphereVulnCheckVulnCheck KEVVulnCheck XDBvulnerability advisoriesvulnerability burndownvulnerability correlationvulnerability databasevulnerability disclosurevulnerability discoveryvulnerability intelligencevulnerability managementvulnerability management programvulnerability prioritisationvulnerability remediation campaignvulnerability scannersvulnerability SLA enforcementvulnerability triage AIVulnetixvulnetix aibomvulnetix cbomVulnetix CLIvulnetix ignoreVulnetix KEVvulnetix malscanVulnetix ResolveVulnetix VDBvulnetix vdb snort-rulesvulnetix vdb yara-rulesVulnetix vendor archivesVulnrichmentWARPwatchOSweaponized exploitWebexWebKitwhat to fix firstWindows patchesWindsurf MCPWindsurf security pluginWolfiWranglerX.509XcodeYARA rulesZed MCPzero-day