19 SEP 2026 · 15:00 MDT · ACTIVE EXPLOITATION: Pixel CVE-2026-58704 and two Linux kernel flaws are in KEV; Fortinet reports exploitation of Orkes Conductor CVE-2026-58138. Latest brief → · PM archive →
19 SEP 2026 · 06:00 MDT · AI EVALUATION BOUNDARY: Google confirmed a Gemini security test unintentionally reached three real organizations; entities were notified and procedures revised. Latest brief → · AM archive →
18 SEP 2026 · 15:00 MDT · AVIATION RESILIENCE: NATS attributes major UK disruption to a software defect—not a cyberattack—and is testing a permanent fix. Latest brief → · PM archive →
18 SEP 2026 · 06:00 MDT · AUTHORIZED AI-ASSISTED SECURITY RESEARCH: OpenAI reportedly remediated a third-party identity and repository-access chain disclosed through its bug-bounty program. Latest brief → · AM archive →
17 SEP 2026 · 15:00 MDT · PUBLIC-SECTOR AI GOVERNANCE: Federal Register removed Qwen-powered search; data-routing details remain undisclosed and no compromise is confirmed. Latest brief → · PM archive →
17 SEP 2026 · 06:00 MDT · ACTIVE EXPLOITATION: Cisco ISE CVE-2026-76460 and Acronis cPanel/Plesk plugin CVE-2026-87886 require immediate update and compromise review. Latest brief → · AM archive →
16 SEP 2026 · 15:00 MDT · AI AGENT + INFRASTRUCTURE: New reporting extends the Hugging Face activity timeline; Anthropic’s proposed 2.16-GW Australian campus remains planned, approval-pending capacity. Latest brief → · PM archive →
16 SEP 2026 · 06:00 MDT · AI-AGENT INCIDENT: Spain’s data-protection authority disclosed an ongoing investigation into a reported agent-linked breach. Technical causation and complete scope remain unresolved. Latest brief → · AM archive → · AI/HPC →
15 SEP 2026 · 06:00 MDT · SEV 1 STATUS CHANGE: CISA now records Cisco Secure Email Gateway CVE-2026-76461 as used in ransomware campaigns. Apple’s September 14 security releases are also tracked without blanket exploitation claims. Latest brief → · AM archive → · AI/HPC →
14 SEP 2026 · 15:00 MDT · SEV 1: CISA added actively exploited Cisco Secure Email Gateway CVE-2026-76461; Cisco provides fixed software and no workaround. Actor and ransomware attribution remain unknown. Latest brief → · PM archive → · AI/HPC →
12 SEP 2026 · 06:00 MDT · ACTIVE EXPLOITATION: CISA added JFrog Artifactory CVE-2026-42016/CVE-2026-42018 and ConnectWise ScreenConnect CVE-2026-84869 to KEV. Prioritize exposure removal, vendor fixes, identity review, evidence preservation and software-delivery integrity. Read the evidence →
02 SEP 2026 · 06:01 MDT · HPC CONTROL-PLANE ALERT: Active exploitation of end-of-life Proxmox VE 7 and a confirmed Virtualizor update-channel compromise require exposure review, MFA, supported versions, signed-update validation and incident hunting. Proposed guidance requires environment-specific validation. 11 SEP AM ARCHIVE11 SEP PM ARCHIVERead the evidence →
GAVIN LUJAN · ZIAWOLFEXECUTIVE BRIEFS →

SEC INTEL // EXECUTIVE SITUATIONAL AWARENESS

Threat + Exposure Command

Threat intelligence is only useful when it changes the remediation queue. This dashboard fuses active exploitation, exploit probability, asset context and vulnerability telemetry into decision-ready priorities.

LIVE PROTOTYPE · 01 SEP 2026

Mission Exposure Queue

Paste or enter vulnerability findings, add CVSS, EPSS, KEV, internet exposure and mission criticality, then watch the queue reorder with an explicit one-line rationale for every finding. This is decision support, not an opaque universal risk score.

OPEN INTERACTIVE QUEUE →

RISK-BASED VULNERABILITY PRIORITIZATION

From scanner noise to mission consequence.

Move beyond CVSS-only patching. Elevate CISA KEV, EPSS, reachability, asset criticality and mission consequence so teams fix the vulnerabilities most likely to become incidents.

OPEN SOURCE

  • OpenVAS / Greenbone
  • Trivy
  • Grype · EPSS + KEV context
  • OWASP Dependency-Track
  • DefectDojo · aggregation / workflow

COMMERCIAL

  • Tenable VPR
  • Qualys TruRisk
  • Rapid7 Active Risk
  • Microsoft Defender exposure score
DISCOVERscanner + SBOM findings
ENRICHKEV + EPSS + threat intel
CONTEXTreachability + criticality
PRIORITIZEmission risk + exploitation
PROVEremediate + rescan + evidence
READ THE EXECUTIVE BRIEF →

DECISION RULE

Known exploited beats merely scary.

A reachable KEV on a critical asset should normally outrank a disconnected CVSS 10 finding with no credible exploitation path. EPSS helps sort the gray zone between those poles.

GOVERNANCE

Keep the evidence visible.

Do not collapse CVSS, KEV, EPSS and business criticality into an unexplained magic score. Preserve each signal, document exceptions and make residual exposure auditable.

CURRENT SIGNAL · 14 SEPTEMBER 2026 · 06:00 MDT · NEXT UPDATE 12 SEP 15:00 MDT

Artifactory and ScreenConnect exploitation

SEV 1 CRITICAL · RED · CONFIDENCE · HIGH · STATUS · ACTIVE EDGE EXPLOITATION / RESILIENCE POLICY UPDATE

Three newly listed CISA KEVs affect software-delivery and remote-management trust boundaries. Patch applicable Artifactory and ScreenConnect deployments, review identities and sessions, preserve evidence and validate artifact integrity.

READ LATEST THREAT BRIEF →