Who publishes this site
Vulnpocalypse is published by ARPSyndicate Research, the research team at A.R.P. Syndicate, an internet intelligence company. A.R.P. Syndicate operates Exploit Observer, a vulnerability and exploit intelligence database, and Kenzer, a cyber assessment platform for organisations.
We started this site because most coverage of the Vulnpocalypse is written for executives. Developers get the patch notes and none of the context. Each advisory here is written for the person who has to run the check and ship the fix.
What an advisory contains
Every advisory follows the same structure, so you can skim to the part you need:
- What happened: the facts, dated and sourced.
- Am I affected?: the versions, files or settings to check, with commands you can run.
- What to do now: the fix first, then stopgaps, then how to look for signs of compromise.
- Why this is part of the Vulnpocalypse: how the event fits the wider trend.
- Sources: every primary source we relied on.
Severity labels (Critical, High, Medium, Low, Informational) are our editorial judgement of the risk to a typical development team. They are not CVSS scores. Where a CVSS score exists, we quote it and say which version it uses.
Editorial policy
- Sourced or not published. Every factual claim links to its source. We prefer primary sources: vendor advisories, project release notes, government notices and the original research. When we rely on a secondary report, we say so.
- Dated. Every advisory shows when it was published and when it was last updated. When facts change, we update the advisory and change the date.
- No fear for its own sake. The Vulnpocalypse is a real change in volume and speed, but most new CVEs are never exploited. We say so, and we put the numbers in context; see numbers we don’t quote.
- Corrections. If we get something wrong, email sales@arpsyndicate.io with “Correction” in the subject. We fix errors promptly and note material corrections at the end of the advisory.
- Independence. Advisories describe what happened and how to check and fix it with any tools. Where we mention our own products, it is in a clearly marked panel, separate from the advisory text.
Tips and disclosures
If you have a vulnerability, breach or supply-chain incident we should cover, email sales@arpsyndicate.io. Please don’t send us unpatched vulnerability details; report those to the affected project or vendor first.
Subscribe
New advisories appear in the RSS feed. Follow along on LinkedIn.