What a CVE actually does once you read past the score: encoding bugs, supply-chain surfaces, secrets that outlive the repository they leaked from, and the end-of-life dates that turn a working system into an unpatched one.
CVE-2024-4577 turns on one record in a Microsoft mapping table, and the versions everyone calls patched carry a fix PHP deleted eight days after shipping it.
EPSS scores how likely exploitation is in 30 days; CVSS scores how bad it would be. The arithmetic for a 400-item backlog, and the threshold we defend.
PHP 8.1 reached end of life on 31 December 2025. Canonical patched 22 new CVEs into it in the 301 days after: 2.22 a month against 1.11 before.
npm 12 blocked dependency install scripts by default on 8 July 2026. No Node.js release bundles it, so the default on your machine still runs everything.
A client secret handed to a Spark job lands in six places. Rotation deletes none, and a derived 30-day period still runs 576 times a federated token.
Browse by tag
Twenty minutes, no deck. We’ll tell you straight whether this is work we should be doing, and if it isn’t, we usually know who should.
We come back within one business day.
Analytics
We’d like to use Google Analytics to see which pages people find useful. It sets cookies, and only if you say yes. Your choice can be changed at any time under Cookie settings. Privacy