8. Staying Current Vulnerabilities, Exploits and News

New flaws and exploits appear every week, so security knowledge goes stale quickly. This note lists the places to watch, the vocabulary they use, a way to decide what actually needs action, and some famous incidents worth reading in full. The general process is in 1. Security Fundamentals; the dependency side is in 5. Secure Coding and Supply Chain.

Site addresses and feeds change; if a link fails, search for the project's name. Everything below is for defence and learning: only test exploits against systems you own or have written permission to test.

The names you were looking for

The sites that list known flaws are vulnerability databases and advisory feeds. They all revolve around a few standard identifiers:

CVSS bands: 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High, 9.0 to 10.0 Critical. A score says how bad a flaw can be, not whether anyone is using it, which is why EPSS and KEV exist.

Where to look

Vulnerability databases and catalogues

Vendor and distribution advisories

Patch notices from the people who ship what you run: - Linux distros: Debian Security Tracker (security-tracker.debian.org), Ubuntu Security Notices (ubuntu.com/security), Red Hat (access.redhat.com/security), Arch Security Tracker. - Microsoft: the Security Update Guide (msrc.microsoft.com) and the monthly "Patch Tuesday" release (second Tuesday of each month). - Cloud and platforms: AWS, Azure and Google Cloud security bulletins; Cisco, Fortinet, Palo Alto and other network vendors publish their own advisories, and edge devices are frequent targets. - Language and framework projects: release notes and security pages for Django, Rails, Spring, Node.js, PHP and the like.

Mailing lists and research

• oss-security (openwall.com/lists/oss-security): where open-source maintainers disclose flaws, often with a patch and timeline. Low volume, high signal.
• Google Project Zero (projectzero.google): detailed write-ups of real 0-days.
• PortSwigger Research (portswigger.net/research) and the Web Security Academy (free labs): web-attack techniques explained and practised.
• SANS Internet Storm Center (isc.sans.edu): daily "diary" posts on what is being seen in the wild.
• Vendor research blogs: Cisco Talos, Palo Alto Unit 42, Mandiant, Microsoft Threat Intelligence, and similar teams publish campaign analyses.

News and commentary

National and other trackers

• CISA alerts, US-CERT and the UK's NCSC publish advisories; most countries have a national CERT/CSIRT. Check which covers your own country and region.
• Shodan and Censys show what is exposed on the internet, useful for checking your own footprint.
• abuse.ch (URLhaus, MalwareBazaar) and AlienVault OTX publish malware and indicator feeds; VirusTotal checks files and URLs.

Keeping up without drowning

flowchart LR
    F["Feeds: RSS, email, release watches"] --> T["Triage once a day"]
    T --> A{"Do we run it?"}
    A -->|No| X["Ignore"]
    A -->|Yes| K{"On the KEV list or high EPSS?"}
    K -->|Yes| U["Patch or mitigate now"]
    K -->|No| S{"Internet-facing or holds sensitive data?"}
    S -->|Yes| W["Patch this week"]
    S -->|No| N["Patch in the normal cycle"]

Practical set-up: - RSS reader (Feedly, Miniflux, NetNewsWire, Thunderbird) with 5 to 10 trusted feeds beats checking sites ad hoc. Many of the sources above publish RSS or an email digest. - Watch releases and security advisories on the GitHub repositories you depend on (Watch, then Custom, then Security alerts), and turn on Dependabot alerts. - Subscribe to your distro's security list (for example debian-security-announce) and enable unattended security updates for servers. - Keep an inventory (an SBOM from Syft or trivy sbom) so "are we affected?" takes minutes, not days. - Set a rhythm: a short daily skim, a weekly review of everything pending, a monthly patch window, and an emergency path for KEV entries on internet-facing systems. - Write down your decisions, including "not affected because the vulnerable function is never called".

Hands-on examples

# Look up one CVE through the NVD API
$ curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228" | jq '.vulnerabilities[0].cve.descriptions[0].value'

# EPSS score for a CVE
$ curl -s "https://api.first.org/data/v1/epss?cve=CVE-2021-44228" | jq '.data[0]'

# Is it on the CISA KEV list? (download the JSON feed from the CISA site, then search it)
$ jq -r '.vulnerabilities[] | select(.cveID=="CVE-2021-44228") | .vulnerabilityName' known_exploited_vulnerabilities.json

# Search offline copies of Exploit-DB
$ sudo apt install exploitdb
$ searchsploit apache 2.4
$ searchsploit -x 12345            # read an exploit's source

# Scan a project for known-vulnerable dependencies (OSV data)
$ osv-scanner scan source -r .     # older versions use: osv-scanner -r .
$ pip-audit
$ npm audit

# Scan a container image
$ trivy image nginx:latest

# Which pending updates are security updates (Debian or Ubuntu)?
$ sudo apt update && apt list --upgradable
$ sudo unattended-upgrade --dry-run -d

Example triage: a new critical CVE appears in libfoo. You check the inventory, find version 2.3 on one internal server and the image of a public API. KEV lists it and EPSS is high, so the public API is patched today; the internal server goes in this week's window.

Incidents worth reading in full

Each one teaches a lesson that is still current. Search the CVE or name for the original advisory and post-mortems.

Cross-reference the technique classes with 2. Web Application Security (injection, XSS, SSRF) and the supply-chain lessons with Open Source: Security and Supply Chain Hygiene.

Practising safely

Reading about exploits is better with practice, on targets built to be attacked:

• PortSwigger Web Security Academy: free browser-based labs for each web vulnerability class.
• OWASP Juice Shop and DVWA: intentionally vulnerable apps you run locally in Docker (docker run -p 3000:3000 bkimminich/juice-shop).
• TryHackMe, Hack The Box, OverTheWire, picoCTF: guided rooms, machines and capture-the-flag games.
• Your own lab: virtual machines on an isolated network, never your home or work LAN.

Responsible habits: stay inside written scope, never test other people's systems, report what you find through the vendor's disclosure process (see disclosure in Open Source: Security and Supply Chain Hygiene), and do not run public PoC code you have not read.

Reading list order

1. Learn the vocabulary above (CVE, CWE, CVSS, EPSS, KEV).
2. Read the OWASP Top 10 and one real write-up per category.
3. Follow two news sites and one research source for a month before adding more.
4. Pick one incident from the table each week and read the original advisory and the post-mortem.
5. Repeat the triage routine until it is a habit; add automation (Dependabot, OSV, Trivy) as the inventory grows.