home.social

#vulnerabilitymanagement — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #vulnerabilitymanagement, aggregated by home.social.

  1. What happens when attackers weaponize cellular-based IoT?

    In this Nexus Podcast episode, Rapid7's Deral Heiland breaks down the #cybersecurity risks of connected #IoT devices—from unauthorized access and data exfiltration to potential pivots into backend infrastructure.

    🎧 Full episode here: nexusconnect.io/podcasts/deral

    #VulnerabilityManagement #RiskManagement #OperationalResilience

  2. What happens when attackers weaponize cellular-based IoT?

    In this Nexus Podcast episode, Rapid7's Deral Heiland breaks down the #cybersecurity risks of connected #IoT devices—from unauthorized access and data exfiltration to potential pivots into backend infrastructure.

    🎧 Full episode here: nexusconnect.io/podcasts/deral

    #VulnerabilityManagement #RiskManagement #OperationalResilience

  3. What happens when attackers weaponize cellular-based IoT?

    In this Nexus Podcast episode, Rapid7's Deral Heiland breaks down the #cybersecurity risks of connected #IoT devices—from unauthorized access and data exfiltration to potential pivots into backend infrastructure.

    🎧 Full episode here: nexusconnect.io/podcasts/deral

    #VulnerabilityManagement #RiskManagement #OperationalResilience

  4. Seven FuelCMS CVEs documented. XSS callbacks now show IP and headers. Website Scanner detects exposed private keys passively. Scheduled scan exports. API risk filtering.

    Also: free scanner for CVE-2026-41940, the cPanel auth bypass exploited for 64 days before a patch existed. No account needed.

    pentest-tools.com/network-vuln

    #infosec #pentesting #vulnerabilitymanagement

  5. OpenAI Bolsters Europe's Cybersecurity With Model Access

    OpenAI is ramping up Europe's cybersecurity game by granting restricted access to its cutting-edge vulnerability-finding model, GPT-5.5-Cyber, to dozens of European organizations through its new Trusted Access for Cyber program. This move will empower defenders to swiftly protect systems and respond to threats, while also addressing security…

    osintsights.com/openai-bolster

    #Cybersecurity #Europe #Openai #Gpt55cyber #VulnerabilityManagement

  6. Sering kali kita bingung membedakan antara "nama" celah keamanan dan "skor" keparahannya. Di artikel ini, saya bedah cara kerja sistem penamaan dari MITRE dan bagaimana skor CVSS dihitung.

    Baca selengkapnya di sini: analis-siber-purwakarta.blogsp

    #CyberSecurity #InfoSec #CVE #CVSS #VulnerabilityManagement #TechBlog #BelajarIT #KeamananSiber

  7. Sering kali kita bingung membedakan antara "nama" celah keamanan dan "skor" keparahannya. Di artikel ini, saya bedah cara kerja sistem penamaan dari MITRE dan bagaimana skor CVSS dihitung.

    Baca selengkapnya di sini: analis-siber-purwakarta.blogsp

    #CyberSecurity #InfoSec #CVE #CVSS #VulnerabilityManagement #TechBlog #BelajarIT #KeamananSiber

  8. Sering kali kita bingung membedakan antara "nama" celah keamanan dan "skor" keparahannya. Di artikel ini, saya bedah cara kerja sistem penamaan dari MITRE dan bagaimana skor CVSS dihitung.

    Baca selengkapnya di sini: analis-siber-purwakarta.blogsp

    #CyberSecurity #InfoSec #CVE #CVSS #VulnerabilityManagement #TechBlog #BelajarIT #KeamananSiber

  9. CVE-2026-41940 was exploited for 64 days before a patch existed. First attack: Feb 23. Advisory: Apr 28.

    After disclosure, 15,448 cPanel hosts in malicious activity on May 1 alone. Ransomware and a Mirai botnet running in parallel. CVSS 9.8. CISA KEV.

    We built a free scanner. No account needed.

    pentest-tools.com/network-vuln

    #infosec #pentesting #vulnerabilitymanagement

  10. Most tools added AI and called it a feature. We kept asking whether it actually makes results more reliable.

    Session two of Office Hours is recorded. Jan covers the ML classifier, the authentication layer, and the MCP integration that won't act without your explicit go-ahead.

    45 minutes. Q&A included.

    Recording: youtube.com/watch?v=abGruzf2pPk

    #penetrationtesting #offensivesecurity #vulnerabilitymanagement

  11. NIST Curtails CVE Enrichment Amid Vulnerability Surge

    The National Institute of Standards and Technology (NIST) is overhauling its approach to enriching entries in the National Vulnerability Database (NVD) due to a staggering 263% surge in vulnerability submissions. To keep pace, NIST will now prioritize enrichment for only the most critical entries that meet specific conditions.

    osintsights.com/nist-curtails-

    #VulnerabilityManagement #Nist #NationalVulnerabilityDatabase #Nvd #Cve

  12. AI Bolsters Software Security with Enhanced SAST Accuracy

    Can artificial intelligence revolutionize software security by supercharging SAST accuracy and making testing a breeze for developers? By harnessing the power of AI, organizations can potentially transform the way they identify and fix vulnerabilities, without slowing down their software builders.

    osintsights.com/ai-bolsters-so

    #ArtificialIntelligence #Sast #SoftwareSecurity #DeveloperTools #VulnerabilityManagement

  13. NIST updated their NVD operations. They will now prioritize CISA's KEV catalog, federal government software, and "critical software" defined in the Executive Order 14028 for faster enrichment.

    They also will not assign their own severity scores to CVEs that received a score from CNAs.

    AI CVEs took a toll on them, it seems like.

    nist.gov/news-events/news/2026

    #cybersecurity #cve #security #nist #cisa #cna #vulnerability #vulnerabilitymanagement #ai

  14. NIST updated their NVD operations. They will now prioritize CISA's KEV catalog, federal government software, and "critical software" defined in the Executive Order 14028 for faster enrichment.

    They also will not assign their own severity scores to CVEs that received a score from CNAs.

    AI CVEs took a toll on them, it seems like.

    nist.gov/news-events/news/2026

    #cybersecurity #cve #security #nist #cisa #cna #vulnerability #vulnerabilitymanagement #ai

  15. NIST updated their NVD operations. They will now prioritize CISA's KEV catalog, federal government software, and "critical software" defined in the Executive Order 14028 for faster enrichment.

    They also will not assign their own severity scores to CVEs that received a score from CNAs.

    AI CVEs took a toll on them, it seems like.

    nist.gov/news-events/news/2026

    #cybersecurity #cve #security #nist #cisa #cna #vulnerability #vulnerabilitymanagement #ai

  16. NIST updated their NVD operations. They will now prioritize CISA's KEV catalog, federal government software, and "critical software" defined in the Executive Order 14028 for faster enrichment.

    They also will not assign their own severity scores to CVEs that received a score from CNAs.

    AI CVEs took a toll on them, it seems like.

    nist.gov/news-events/news/2026

    #cybersecurity #cve #security #nist #cisa #cna #vulnerability #vulnerabilitymanagement #ai

  17. gcve-eu-kev updated — a CISA KEV and ENISA CNW/EUVD to GCVE BCP-07 converter.

    It now also includes a generic RSS/Atom exporter for any GCVE KEV BCP-07 feed.

    @gcve

    #cybersecurity #gcve #kev #cve #vulnerability #vulnerabilitymanagement

    🔗 github.com/gcve-eu/gcve-eu-kev
    🔗 gcve.eu/bcp/gcve-bcp-07/

  18. The GCVE vulnerability database, developed by Luxembourg’s CIRCL, is now publicly available and designed to remain CVE-compatible.

    It aggregates advisories from 25+ centralized and decentralized sources, correlates naming conventions, and supports machine-based analysis for security teams and researchers.

    The launch reflects ongoing conversations around redundancy, governance, and long-term stability in vulnerability disclosure frameworks.

    How do you evaluate new vulnerability data sources before integrating them into your pipeline?

    Source: inside-it.ch/europaeische-cve-

    Follow @technadu for objective cybersecurity reporting.

    #GCVE #VulnerabilityManagement #ThreatIntel #CVE #SecurityResearch #EUInfosec

  19. KEV Assertion Format – Draft Specification (potential BCP?)

    This format describes a generic KEV (Known Exploited Vulnerability) assertion format.

    The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended.

    Feedback, ideas, comments more than welcome!

    🔗 discourse.ossbase.org/t/kev-kn

    @gcve

    #kev #gcve #cve #vulnerability #vulnerabilitymanagement

  20. Cal.com has patched a critical authentication bypass (CVE-2025-66489) that allowed attackers to submit any non-empty TOTP field and skip password checks. Versions ≤5.9.7 were impacted.

    Update to 5.9.8 to ensure both password and TOTP verification are enforced.
    How should MFA implementations be validated to prevent logic gaps like this?

    Source: gbhackers.com/critical-cal-com

    Share your insights and follow us for more security reporting.

    #infosec #appsec #CVE2025 #authentication #MFA #ThreatIntel #SecureCoding #SoftwareSecurity #VulnerabilityManagement #SecurityUpdate

  21. OpenAI has launched Aardvark, an autonomous “agentic security researcher” powered by GPT-5.

    It scans codebases for vulnerabilities, validates exploitability in sandboxed environments, and auto-generates potential patches.

    Early reports show 10+ CVEs identified in open-source projects.

    What’s your view - is AI-driven vulnerability research the future of cybersecurity or another layer of risk?

    #CyberSecurity #OpenAI #GPT5 #Aardvark #Infosec #AI #DevSecOps #VulnerabilityManagement #MachineLearning #CodeSecurity #TechNews

  22. 🎯 NOW PUBLISHING: On-Location Coverage from #BlackHatUSA 2025!

    We're back in the office and excited to start sharing all the conversations we captured on location in Las Vegas with our amazing sponsors and editorial coverage!

    🔔 Follow ITSPmagazine, Sean Martin, CISSP, and Marco Ciappelli to get this content fresh as it drops!

    We're honored to share this eye-opening Brand Story conversation thanks to our friends at runZero 🙏

    The Often-Overlooked Truth in #Cybersecurity: Seeing the Unseen in Vulnerability Management

    Most successful breaches don't happen because defenders ignored known vulnerabilities. They happen because attackers exploited assets that organizations never knew existed.

    HD‏​​​​​​​​​​‏ ⁢​​​​Moore, founder and CEO of runZero and creator of #Metasploit, reveals the uncomfortable truth: organizations routinely miss half their actual attack surface. Through decades of penetration testing high-security environments, Moore discovered that traditional discovery methods only find properly managed systems while #shadowIT, legacy hardware, and misconfigured devices remain invisible.

    Key insights from our conversation:

    • When using attacker-grade discovery techniques, asset counts typically DOUBLE what organizations thought they had

    • The industry's CVE obsession creates false security while real attacks exploit misconfigurations and zero-days

    • Unknown assets—from IoT devices to forgotten servers—bypass even sophisticated security controls

    • Traditional agent-based tools can't see what attackers see

    #RunZero inverts the traditional model by starting with unauthenticated discovery that mirrors how attackers actually probe networks. This reveals the true attack surface and transforms vulnerability management from reactive patching to strategic risk reduction.

    📺 Watch the video: youtu.be/hkKJsKUugIU

    🎧 Listen to the podcast: brand-stories-podcast.simpleca 📖 Read the blog: itspmagazine.com/their-stories

    ➤ Learn more about RunZero: itspm.ag/runzero-5733

    ✦ Catch more stories from RunZero: itspmagazine.com/directory/run

    🎪 Follow all of our #BHUSA 2025 coverage: itspmagazine.com/bhusa25

    #Cybersecurity #VulnerabilityManagement #AssetDiscovery #AttackSurface #BlackHatUSA #BHUSA25 #ShadowIT #SecurityVisibility #Metasploit #ZeroDay #tech #technology #cybersecurity

  23. 🎯 NOW PUBLISHING: On-Location Coverage from #BlackHatUSA 2025!

    We're back in the office and excited to start sharing all the conversations we captured on location in Las Vegas with our amazing sponsors and editorial coverage!

    🔔 Follow ITSPmagazine, Sean Martin, CISSP, and Marco Ciappelli to get this content fresh as it drops!

    We're honored to share this eye-opening Brand Story conversation thanks to our friends at runZero 🙏

    The Often-Overlooked Truth in #Cybersecurity: Seeing the Unseen in Vulnerability Management

    Most successful breaches don't happen because defenders ignored known vulnerabilities. They happen because attackers exploited assets that organizations never knew existed.

    HD‏​​​​​​​​​​‏ ⁢​​​​Moore, founder and CEO of runZero and creator of #Metasploit, reveals the uncomfortable truth: organizations routinely miss half their actual attack surface. Through decades of penetration testing high-security environments, Moore discovered that traditional discovery methods only find properly managed systems while #shadowIT, legacy hardware, and misconfigured devices remain invisible.

    Key insights from our conversation:

    • When using attacker-grade discovery techniques, asset counts typically DOUBLE what organizations thought they had

    • The industry's CVE obsession creates false security while real attacks exploit misconfigurations and zero-days

    • Unknown assets—from IoT devices to forgotten servers—bypass even sophisticated security controls

    • Traditional agent-based tools can't see what attackers see

    #RunZero inverts the traditional model by starting with unauthenticated discovery that mirrors how attackers actually probe networks. This reveals the true attack surface and transforms vulnerability management from reactive patching to strategic risk reduction.

    📺 Watch the video: youtu.be/hkKJsKUugIU

    🎧 Listen to the podcast: brand-stories-podcast.simpleca 📖 Read the blog: itspmagazine.com/their-stories

    ➤ Learn more about RunZero: itspm.ag/runzero-5733

    ✦ Catch more stories from RunZero: itspmagazine.com/directory/run

    🎪 Follow all of our #BHUSA 2025 coverage: itspmagazine.com/bhusa25

    #Cybersecurity #VulnerabilityManagement #AssetDiscovery #AttackSurface #BlackHatUSA #BHUSA25 #ShadowIT #SecurityVisibility #Metasploit #ZeroDay #tech #technology #cybersecurity

  24. 🎯 NOW PUBLISHING: On-Location Coverage from #BlackHatUSA 2025!

    We're back in the office and excited to start sharing all the conversations we captured on location in Las Vegas with our amazing sponsors and editorial coverage!

    🔔 Follow ITSPmagazine, Sean Martin, CISSP, and Marco Ciappelli to get this content fresh as it drops!

    We're honored to share this eye-opening Brand Story conversation thanks to our friends at runZero 🙏

    The Often-Overlooked Truth in #Cybersecurity: Seeing the Unseen in Vulnerability Management

    Most successful breaches don't happen because defenders ignored known vulnerabilities. They happen because attackers exploited assets that organizations never knew existed.

    HD‏​​​​​​​​​​‏ ⁢​​​​Moore, founder and CEO of runZero and creator of #Metasploit, reveals the uncomfortable truth: organizations routinely miss half their actual attack surface. Through decades of penetration testing high-security environments, Moore discovered that traditional discovery methods only find properly managed systems while #shadowIT, legacy hardware, and misconfigured devices remain invisible.

    Key insights from our conversation:

    • When using attacker-grade discovery techniques, asset counts typically DOUBLE what organizations thought they had

    • The industry's CVE obsession creates false security while real attacks exploit misconfigurations and zero-days

    • Unknown assets—from IoT devices to forgotten servers—bypass even sophisticated security controls

    • Traditional agent-based tools can't see what attackers see

    #RunZero inverts the traditional model by starting with unauthenticated discovery that mirrors how attackers actually probe networks. This reveals the true attack surface and transforms vulnerability management from reactive patching to strategic risk reduction.

    📺 Watch the video: youtu.be/hkKJsKUugIU

    🎧 Listen to the podcast: brand-stories-podcast.simpleca 📖 Read the blog: itspmagazine.com/their-stories

    ➤ Learn more about RunZero: itspm.ag/runzero-5733

    ✦ Catch more stories from RunZero: itspmagazine.com/directory/run

    🎪 Follow all of our #BHUSA 2025 coverage: itspmagazine.com/bhusa25

    #Cybersecurity #VulnerabilityManagement #AssetDiscovery #AttackSurface #BlackHatUSA #BHUSA25 #ShadowIT #SecurityVisibility #Metasploit #ZeroDay #tech #technology #cybersecurity

  25. 🎯 NOW PUBLISHING: On-Location Coverage from #BlackHatUSA 2025!

    We're back in the office and excited to start sharing all the conversations we captured on location in Las Vegas with our amazing sponsors and editorial coverage!

    🔔 Follow ITSPmagazine, Sean Martin, CISSP, and Marco Ciappelli to get this content fresh as it drops!

    We're honored to share this eye-opening Brand Story conversation thanks to our friends at runZero 🙏

    The Often-Overlooked Truth in #Cybersecurity: Seeing the Unseen in Vulnerability Management

    Most successful breaches don't happen because defenders ignored known vulnerabilities. They happen because attackers exploited assets that organizations never knew existed.

    HD‏​​​​​​​​​​‏ ⁢​​​​Moore, founder and CEO of runZero and creator of #Metasploit, reveals the uncomfortable truth: organizations routinely miss half their actual attack surface. Through decades of penetration testing high-security environments, Moore discovered that traditional discovery methods only find properly managed systems while #shadowIT, legacy hardware, and misconfigured devices remain invisible.

    Key insights from our conversation:

    • When using attacker-grade discovery techniques, asset counts typically DOUBLE what organizations thought they had

    • The industry's CVE obsession creates false security while real attacks exploit misconfigurations and zero-days

    • Unknown assets—from IoT devices to forgotten servers—bypass even sophisticated security controls

    • Traditional agent-based tools can't see what attackers see

    #RunZero inverts the traditional model by starting with unauthenticated discovery that mirrors how attackers actually probe networks. This reveals the true attack surface and transforms vulnerability management from reactive patching to strategic risk reduction.

    📺 Watch the video: youtu.be/hkKJsKUugIU

    🎧 Listen to the podcast: brand-stories-podcast.simpleca 📖 Read the blog: itspmagazine.com/their-stories

    ➤ Learn more about RunZero: itspm.ag/runzero-5733

    ✦ Catch more stories from RunZero: itspmagazine.com/directory/run

    🎪 Follow all of our #BHUSA 2025 coverage: itspmagazine.com/bhusa25

    #Cybersecurity #VulnerabilityManagement #AssetDiscovery #AttackSurface #BlackHatUSA #BHUSA25 #ShadowIT #SecurityVisibility #Metasploit #ZeroDay #tech #technology #cybersecurity

  26. 🎯 NOW PUBLISHING: On-Location Coverage from #BlackHatUSA 2025!

    We're back in the office and excited to start sharing all the conversations we captured on location in Las Vegas with our amazing sponsors and editorial coverage!

    🔔 Follow ITSPmagazine, Sean Martin, CISSP, and Marco Ciappelli to get this content fresh as it drops!

    We're honored to share this eye-opening Brand Story conversation thanks to our friends at runZero 🙏

    The Often-Overlooked Truth in #Cybersecurity: Seeing the Unseen in Vulnerability Management

    Most successful breaches don't happen because defenders ignored known vulnerabilities. They happen because attackers exploited assets that organizations never knew existed.

    HD‏​​​​​​​​​​‏ ⁢​​​​Moore, founder and CEO of runZero and creator of #Metasploit, reveals the uncomfortable truth: organizations routinely miss half their actual attack surface. Through decades of penetration testing high-security environments, Moore discovered that traditional discovery methods only find properly managed systems while #shadowIT, legacy hardware, and misconfigured devices remain invisible.

    Key insights from our conversation:

    • When using attacker-grade discovery techniques, asset counts typically DOUBLE what organizations thought they had

    • The industry's CVE obsession creates false security while real attacks exploit misconfigurations and zero-days

    • Unknown assets—from IoT devices to forgotten servers—bypass even sophisticated security controls

    • Traditional agent-based tools can't see what attackers see

    #RunZero inverts the traditional model by starting with unauthenticated discovery that mirrors how attackers actually probe networks. This reveals the true attack surface and transforms vulnerability management from reactive patching to strategic risk reduction.

    📺 Watch the video: youtu.be/hkKJsKUugIU

    🎧 Listen to the podcast: brand-stories-podcast.simpleca 📖 Read the blog: itspmagazine.com/their-stories

    ➤ Learn more about RunZero: itspm.ag/runzero-5733

    ✦ Catch more stories from RunZero: itspmagazine.com/directory/run

    🎪 Follow all of our #BHUSA 2025 coverage: itspmagazine.com/bhusa25

    #Cybersecurity #VulnerabilityManagement #AssetDiscovery #AttackSurface #BlackHatUSA #BHUSA25 #ShadowIT #SecurityVisibility #Metasploit #ZeroDay #tech #technology #cybersecurity

  27. 🔒 Elevate Your Web Application Security Game! 🔒

    Are you taking the necessary steps to safeguard your web applications against cyber threats? Dive into our latest insights on the OWASP Top 10 vulnerabilities and discover actionable strategies to fortify your defenses.

    relianoid.com/blog/relianoid-o

  28. “Vulnerability management is becoming increasingly important” – Greenbone CEO Dr. Jan-Oliver Wagner at PITS Congress

    Greenbone CEO Dr. Jan-Oliver Wagner was invited as an expert to take part in the panel discussion “Putting your finger in the wound – managing or closing vulnerabilities?" at the Public IT Security Congress initiated by Behoerdenspiegel.

    More at the Greenbone Blog via @mfeilner

    greenbone.net/en/blog/vulnerab

    #PublicITSecurity #CRA #CSAF #VulnerabilityManagement #Greenbone #OpenVas