§Answers
Security questions, answered.
Short, direct answers to the questions that come up constantly — what a CVE actually is, what a CVSS score does and does not tell you, and how to decide what to patch first. No preamble.
Vulnerabilities
What is a CVE?
A CVE is a public identifier for one specific security vulnerability, written as CVE-YEAR-NUMBER, for example CVE-2024-3094. It is assigned by a CVE Numbering Authority so that vendors, researchers and defenders can all refer to the same flaw unambiguously. A CVE identifier records that a vulnerability exists; it does not by itself say how severe or exploitable it is.
What is a zero-day vulnerability?
A zero-day is a vulnerability that is being exploited, or is publicly known, before the vendor has a patch available — leaving defenders zero days to have fixed it. The term is used loosely for three related things: an unknown flaw, an unpatched flaw, and an attack using one. The distinction matters because only the third means someone is being attacked.
What is the difference between a vulnerability, an exploit, and a threat?
A vulnerability is a weakness in a system. An exploit is the technique or code that takes advantage of that weakness. A threat is the actor or event with the intent and capability to use it against you. Risk is what emerges when all three meet something valuable that you own and have not adequately protected.
Prioritisation
What does a CVSS score actually mean?
CVSS is a 0–10 severity score describing how bad a vulnerability would be if exploited. In CVSS v3.1 the bands are Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9 and Critical 9.0–10.0. The score most people quote is the Base score, which measures intrinsic severity only — it says nothing about whether anyone is actually exploiting the flaw.
What is the CISA KEV catalog?
The CISA Known Exploited Vulnerabilities catalog is a public list of CVEs with confirmed evidence of exploitation in the wild. It was established by US Binding Operational Directive 22-01 and sets remediation deadlines that federal civilian agencies must meet. Because entries require observed exploitation rather than theoretical severity, KEV is one of the strongest available signals that a vulnerability needs attention now.
What is EPSS and how is it different from CVSS?
EPSS, the Exploit Prediction Scoring System, estimates the probability that a vulnerability will be exploited in the wild in the next 30 days, expressed as a value between 0 and 1. CVSS measures how damaging exploitation would be; EPSS estimates how likely it is to happen. They answer different questions and are strongest when used together.
Practice
How do I know if a CVE affects my organisation?
Check four things in order: whether you run the affected product at all, whether your specific version falls in the affected range, whether the vulnerable component is reachable by an attacker, and whether any vendor mitigation already applies. A CVE only matters to you if all four line up — most published CVEs will fail at the first question.
How quickly should I patch a critical vulnerability?
Patch anything with confirmed in-the-wild exploitation on internet-facing systems within days, not weeks — CISA KEV deadlines for US federal agencies are typically two to three weeks and are treated as a ceiling, not a target. Everything else belongs on a risk-ranked cycle driven by exposure and exploitation probability rather than severity score alone.
How do I keep up with cybersecurity news without drowning in it?
Separate two jobs. Build a short act-on list from your own asset inventory and drive it from CISA’s Known Exploited Vulnerabilities catalog, then EPSS exploitation-probability scores for what remains. Keep awareness separate and cap it: one curated daily or weekly digest, read on a schedule. Reading everything is neither possible nor useful, and volume is not coverage.
How do I find out about recent data breaches?
Use Have I Been Pwned to check whether your own accounts appear in known breaches. For organisational disclosures, read United States state attorney general breach notification portals, SEC Form 8-K Item 1.05 filings for listed companies, and your national data protection regulator’s register. News outlets are fastest; official registers are authoritative and slower.
Attacks
What is double extortion ransomware?
Double extortion ransomware both encrypts your data and steals a copy of it before encrypting. The attacker then demands payment twice over: once to restore your systems, and again to stop publication of the stolen data. It exists because reliable backups defeat plain encryption, so attackers added a second form of leverage that backups cannot undo.
What is a software supply chain attack?
A software supply chain attack compromises something you trust and install, rather than attacking you directly. Typical routes are a poisoned package in a public registry, a compromised vendor update, or stolen build infrastructure. It is effective because the malicious code arrives through a legitimate, signed, expected channel that your defences are configured to allow.
What are the latest cyber threats I should know about?
"Latest" is usually the wrong question: the vulnerabilities exploited at scale are frequently months or years old and already patched. The durable categories are ransomware with data extortion, exploitation of internet-facing edge devices, identity attacks driven by infostealers, supply chain compromise, and social engineering. Track CISA’s Known Exploited Vulnerabilities catalog for what is genuinely being used now.
Sources
What is the best cybersecurity newsletter?
No single cybersecurity newsletter is best for everyone; the useful answer segments by role. Practitioners tracking daily incidents read Risky Bulletin, SANS NewsBites or Metacurity. Developers and application security engineers read tl;dr sec. Security leaders read Seriously Risky Business or Return on Security. Investigative depth comes from Krebs on Security. Pick by the decision you need to make.
What are the best cybersecurity news websites?
No single site is best; each is best for one job. BleepingComputer, The Hacker News and SecurityWeek carry the daily volume. Krebs on Security, The Record and 404 Media break original stories. CyberScoop covers United States policy. SANS Internet Storm Center serves practitioners. Much security news originates in vendor research blogs, which are the actual primary source.
Which cybersecurity news sources are most reliable?
Primary sources are reliable by construction: CISA’s Known Exploited Vulnerabilities catalog, the National Vulnerability Database, vendor security advisories and national CERT bulletins. Among news outlets, judge reliability by four things: named bylines, links to primary documents, a visible corrections policy, and whether the outlet distinguishes what is confirmed from what an attacker merely claims.