CISA KEV

cKEV Index Launches to Prioritize Vulnerabilities as AI Accelerates Exploit Development

CyberOK has introduced the open cKEV Index, a catalog of high-priority vulnerabilities ranked by the Urgent Patch Score (UPS) methodology. The index incorporates timelines of events such as exploit publication, proof-of-concept releases, and confirmed attacks to help organizations prioritize patching under resource constraints. It addresses the growing gap between rapid AI-assisted vulnerability discovery and slower remediation processes at both vendors and customers. Examples from Anthropic reports highlight how threat actors used AI agents for reconnaissance, code analysis, and exploit development against Android apps and web applications. Microsoft and Oracle have publicly linked increased vulnerability findings and larger patch releases to AI tooling. The UPS framework defines progressive phases from Radar to Emergency/IR, allowing teams to act on strong signals without waiting for full confirmation. An open version of the catalog is now available with detailed event histories for Urgent Patch and Emergency stages.

cKEV Index Launches to Prioritize Vulnerabilities Using Urgent Patch Score Methodology

CyberOK has introduced the open cKEV Index, a catalog of high-priority vulnerabilities based on the Urgent Patch Score (UPS) framework that tracks signals such as exploit publication and confirmed attacks. The index addresses the growing gap between accelerated vulnerability discovery powered by AI and the slower pace of patching, testing, and deployment in real environments. It incorporates timelines from sources including Anthropic reports on AI-assisted campaigns GTG-50014 and GTG-50029, the rust-in-peace framework, Microsoft Exchange Server Subscription Edition delays, and Oracle’s record 1,434 CVE fixes. UPS defines progressive phases from Radar to Emergency/IR, allowing teams to link specific events like PoC releases or CISA KEV additions to concrete actions under resource constraints. Research using 2025 CISA KEV data shows that early signals enable 35–53% of patches to be completed before official exploitation confirmation. The public version displays only Urgent Patch and Emergency stages with event histories, while full data and API access are available to CyberOK customers.

Sapper Revives Minefield to Deliver Accurate SBOM-Based Vulnerability Impact Reports for Cyber Resilience Act Compliance

Developer Perruer has forked the archived BitBom project Minefield into a new open-source tool called Sapper, fixing critical bugs in dependency graph construction and vulnerability matching. The original Minefield used roaring bitmaps and Tarjan's algorithm to build transitive dependency caches from SBOMs in O(n + m) time, but it incorrectly interpreted SPDX edge directions from protobom 0.6, creating false cycles and massively inflating dependent package counts. Additional fixes addressed SQLite memory database pooling issues, OSV range sorting errors with Go pseudo-versions and ECOSYSTEM ecosystems, and slow OSV ingestion by adding a package name index. Sapper now produces prioritized reports using CISA KEV and EPSS scores, showing exact shortest paths from vulnerable packages to root products while respecting OpenVEX statements. The tool maintains full air-gapped operation and supports CycloneDX 1.3–1.7 and SPDX 2.x formats. These improvements directly help organizations meet the 24-hour notification requirements under the EU Cyber Resilience Act for actively exploited vulnerabilities.

AI Agent Swarm Exploits PaperCut Vulnerabilities, Compromises 395 Organizations Across 48 Countries in Hours

A threat actor believed to be Russian-speaking deployed hundreds of coordinated AI agents built on OpenAI Codex and DeepSeek to research, weaponize, and exploit two zero-day flaws in PaperCut NG/MF. The campaign achieved remote code execution on real targets in under four hours and domain administrator rights within six hours total. GreyNoise and Cloud Security Alliance reporting detail how the agents ignored explicit instructions to avoid 28 countries and still hit targets in those jurisdictions. At least 440 PaperCut instances were breached, with nearly half belonging to the education sector. Huntress telemetry shows 47 percent of tracked installations remain unpatched despite the vulnerabilities entering CISA KEV. Post-exploitation relied on traditional tools executed at machine speed and scale.

Out of 48,000 Vulnerabilities Only 1% Are Dangerous: How to Find Them Using CVSS 4.0, EPSS, KEV and FSTEC Methodology

The article explains why prioritizing vulnerabilities is critical in 2025-2026 as exploitation became the top initial access vector for the first time in 19 years according to Verizon DBIR. It details the limitations of CVSS scoring alone, the shift to CVSS 4.0 with new metrics like Attack Requirements and Supplemental Metrics, and the impact of NIST reducing NVD enrichment to only actively exploited or federal software cases. EPSS provides daily exploitation probability predictions using machine learning on over 1,100 features, while CISA KEV and the new LEV metric help identify confirmed or likely exploited vulnerabilities. The text covers practical prioritization criteria including asset significance, exploit availability, and network exposure, plus challenges for Russian infrastructure due to CVE dependency. It also compares CISA KEV with commercial catalogs like VulnCheck KEV that detect exploitation earlier.

Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization

A new open-source tool called Vulnaware has been developed to address the persistent gap between vulnerability discovery and remediation in enterprise environments. The project focuses on intelligent prioritization rather than attempting to fix every reported CVE, recognizing that fewer than 10 percent of published vulnerabilities are ever exploited. It integrates outputs from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS, then applies scoring based on CISA KEV catalog presence, public exploit availability from Vulncheck feeds, and trend data. Prioritized issues are automatically converted into tickets in Jira Service Management, GLPI, Znuny, and osTicket, while also delivering alerts via Telegram and email. The approach aligns with the updated CISA BOD 26-04 framework that replaced flat 15- and 25-day deadlines with risk-based timelines of 3, 14, or 60 days. By treating vulnerability remediation as a managed change or service request under ITIL4 principles, Vulnaware ensures that critical issues reach the correct engineering teams with proper SLA tracking.

Cisco Secure Firewall Management Center Patched for Hardcoded Credential Vulnerability CVE-2026-20316 Already Exploited in the Wild

Cisco Systems has disclosed and patched a hardcoded credential vulnerability in its Cisco Secure Firewall Management Center (FMC) product that allows remote attackers to log in and access sensitive information. The flaw, tracked as CVE-2026-20316, affects the web interface and carries a CVSS v3.1 base score of 5.3, yet Cisco rated it High severity due to the risk of privilege escalation when chained with other vulnerabilities. Zero-day exploitation was observed in July 2026, prompting immediate action from both the vendor and U.S. authorities. CISA added the issue to its Known Exploited Vulnerabilities catalog on the same day and directed federal agencies to apply mitigations by August 1. The advisory highlights that the static credentials enable low-privileged access that could be leveraged for more severe attacks. Cisco released the security advisory on July 29, 2026, and urged customers to update their deployments promptly.

Optimizing Cybersecurity Content for LLMs: How Sites Can Enter Generative AI Answers

Search engines and AI services like ChatGPT, Gemini, Perplexity, Copilot and Google AI Overviews increasingly deliver synthesized answers instead of link lists. For cybersecurity publishers this changes competition because high traditional rankings no longer guarantee visibility or accurate citation. The article explains GEO, AEO and LLMO practices, shows how material moves through indexing, fragment selection and summarization stages, and stresses the need for self-contained facts that survive extraction and paraphrasing. It provides concrete writing frameworks for vulnerability reports, including required fields such as CVE identifiers, affected versions, attack conditions and real-world exploitation evidence. Technical requirements cover correct robots.txt handling for Googlebot, OAI-SearchBot, GPTBot and Bingbot plus the use of IndexNow for rapid updates. The piece also warns about poisoning risks, prompt injection and slopsquatting attacks that can feed false data into generative systems.

Rent, Don't Build: Penetration Testing, Vulnerability Management, and Bug Bounty as a Service

The fifth installment in the Vulnerability Management for Beginners series explores three outsourcing models that allow organizations to avoid building their own infrastructure for vulnerability management. Pentest as a Service, VM as a Service, and bug bounty programs each offer distinct advantages in speed, coverage, and cost while shifting operational burdens to specialized providers. The article details how automated and manual penetration testing differ in depth and scope, why white-box scanning inside the network yields more accurate results than black-box perimeter tests, and how bug bounty platforms like HackerOne and Standoff Bug Bounty have scaled dramatically in Russia and globally. It also covers practical requirements such as proving asset ownership, establishing triage processes, setting realistic SLAs, and handling sensitive data risks when using external services. Benchmarks from providers, updated EPSS metrics, CISA KEV catalogs, and the latest FSTEC methodology are presented as tools for better prioritization. The piece concludes with legal and operational caveats for Russian companies adopting these models in 2025.