Daily CVE triage & patch urgency for sysadmins | Exploited-in-wild first | Weekday digests → patchdayalert.com/subscribe
Joined May 2026
- Tweets 77
- Following 259
- Followers 52
- Likes 2
Photos and videos
Pinned Tweet
May 21
If you run IT or security ops, this is for you:
PatchDay Alert is a concise daily CVE digest with clear actions, not vendor fluff.
Subscribe here:
patchdayalert.com/subscribe/
1
2
13
146,092
Jun 13
Scattered Spider didn't need a zero-day. They used a decade-old Intel driver Windows still loads to reach the kernel and patch out your EDR. CVE-2015-2291, BYOVD, and the defenses you can turn on right now. patchdayalert.com/blog/intel…
36
Jun 13
RobbinHood ransomware shipped a signed GIGABYTE driver to turn off Windows' own security checks, then loaded its unsigned malware from the kernel. Four CVEs explain how it happened. patchdayalert.com/blog/gigab…
11
Jun 12
Patching CVE-2022-40684 won't save you. This Fortinet auth bypass let attackers plant admin accounts before the fix. If your FortiOS, FortiProxy, or FortiSwitchManager got hit, you need forensics, not just patches. patchdayalert.com/blog/forti…
33
Jun 12
That 'test connection' button in your FortiGate just handed your LDAP credentials to an attacker. CVE-2018-13374 shows why diagnostic features that transmit stored secrets are a design trap. patchdayalert.com/blog/forti…
3
1
38
Jun 12
Unauthenticated SQL injection in FortiClient EMS that runs OS commands as SYSTEM. No auth needed. CISA KEV. Here's how to check your environment and patch it. patchdayalert.com/blog/forti…
9
Jun 12
SolarWinds Serv-U DoS got a CISA KEV listing in 48 hours. A 7.5 isn't usually urgent, so why the speed? The answer matters for how you triage your queue. patchdayalert.com/blog/solar…
6
Jun 11
CERT-CC says CVE-2026-41089 is exploited in the wild. Microsoft says it isn't. Either way, pre-auth RCE on every domain controller goes to the top of your queue. Here's why the disagreement doesn't matter. patchdayalert.com/blog/netlo…
70
Jun 10
Your patch triage meeting is too long and too pointless. Here's how to run it in 15 minutes with actual decisions instead of arguments. patchdayalert.com/blog/the-1…
4
Jun 10
A third of last year's CVEs hit High or Critical. But only a few percent ever get exploited. Your patch queue treats CVSS like a crystal ball. It isn't. Here's why that costs you 43 days on confirmed exploits. patchdayalert.com/blog/cvss-…
1
Jun 10
Three CVEs, one name, only one story worth your time. VS Code marketplace, 3,800 GitHub repos, 18 minutes. The delivery channel nobody was watching. patchdayalert.com/blog/nx-co…
9
Jun 10
CVE-2026-0257 is a GlobalProtect auth bypass with a KEV deadline that's passed. But your patch urgency hinges on one config setting, not your PAN-OS version. Here's what actually matters. patchdayalert.com/blog/palo-…
50
Jun 9
Microsoft just quietly closed another identity loophole. Two Entra Conditional Access changes in two weeks, and they're signaling something bigger. Your org may have exemptions you forgot you set up. patchdayalert.com/blog/entra…
14
Jun 9
AWS buried two SageMaker SDK bugs on its own bulletins page. No CVE IDs. No CISA KEV list. Patching is your job, not theirs. This visibility gap is the real problem. patchdayalert.com/blog/aws-s…
27
Jun 9
Magento shops running Mirasvit Cache Warmer: CVE-2026-45247 is live RCE, no auth needed, already under attack. CISA deadline is Saturday. Patch now, not later. patchdayalert.com/blog/miras…
33
Jun 8
June 30, 2026. Your printer stops scanning to email. Your Teams room keyboard goes mute. Your scheduling breaks. None of them will tell you why. patchdayalert.com/blog/june-…
7
May 24
Cisco's management plane keeps bleeding. Hardcoded credentials, unauthenticated RCEs across Smart Licensing, ISE, IOS XE, SD-WAN Manager, Unified Comms. The pattern's worth watching.
patchdayalert.com/blog/cisco…
26
May 24
CISA just added a 2008 worm bug to the KEV catalog. MS08-067 (Conficker era) is back on the exploitation radar. If you're still patching Windows XP somewhere, tonight's the night.
patchdayalert.com/blog/cisa-…
20
May 23
Check Point zero-day: unauthenticated file read on your VPN gateway. Attackers grabbed password hashes and ntds.dit. Patching stops future attacks but doesn't recover stolen AD. CISA KEV list. What you need to know.
patchdayalert.com/blog/check…
15
May 23
Apple, Chrome, Android zero-days are mostly spyware targeting specific people, not your org. The defense is boring: keep auto-update on. We break down what's actually your problem.
patchdayalert.com/blog/brows…
14