Methodology
This page describes how advisories on this site are selected, sourced and checked. It exists so you can judge how much weight to put on anything here.
Sources
Only structured, machine-readable feeds published by the vendor or by CISA are used. Nothing on this site comes from scraping a listing page or from second-hand reporting.
| Source | What it provides |
|---|---|
| CISA Known Exploited Vulnerabilities catalogue (JSON) | The primary trigger. If CISA says a flaw is being exploited, that is the strongest signal available and it outranks the severity score. |
| Cisco PSIRT — per-advisory CSAF JSON | The richest structured data of any vendor: per-CVE CVSS, full product tree, and first-fixed release tables. |
| Fortinet PSIRT feed | Discovery, with CVSS in the advisory description. |
| Palo Alto Networks feed | Discovery, with CVE identifier and severity in the item title. |
| NVD 2.0 API | Enrichment. Authoritative CVSS base score, vector string and description. |
Three vendors worth naming explicitly — Juniper, Ivanti and F5 — publish no usable structured feed. Their advisories are covered here by CVE, through KEV and NVD, which catches the case that matters most: confirmed exploitation.
What gets published
An advisory is published if it meets at least one of:
- it has been added to the CISA KEV catalogue;
- it carries a CVSS base score of 9.0 or higher on network or edge infrastructure;
- it is a named vulnerability with industry-wide reach.
Everything else is recorded and not published. The point of a filter is that most things fall outside it.
Severity and scoring
Severity labels map directly to the CVSS v3.1 base score from the vendor or NVD: Critical 9.0–10.0, High 7.0–8.9, Medium 4.0–6.9, Low below 4.0. Where a vendor and NVD disagree, the higher score is shown and the vendor advisory is linked so you can see both.
Two axes are worth separating, because they are routinely conflated:
- PR (Privileges Required) is about credentials — does the attacker need an account?
- UI (User Interaction) is about tricking a person — does someone have to click something?
“No user interaction required” and “no login required” are different claims. Posts here are checked so they do not blur the two.
Exploitation is only ever claimed when CISA KEV says so. A flaw with a CVSS of 10.0 that nobody has exploited is described as unexploited, however alarming the score looks.
Drafting and checking
The severity banner, CVSS figures, KEV status, affected-product list and fixed-release tables are extracted programmatically from the source documents. They are not written by a language model and not retyped by hand.
The written analysis is drafted with AI assistance from those extracted fields — the model is never shown raw advisory HTML — and then verified. Three checks are deterministic and cannot be talked around:
- No invented identifiers. Every CVE in the text must appear in the source advisory list.
- No invented versions. Every version number in the text must appear verbatim in the source facts.
- No unsupported exploitation claims. Assessed per sentence, and aware of negation, so “no known exploitation” reads as the true statement it is.
A fourth pass, by a second model, looks for severity claims that contradict the data and for products or dates that do not appear in the source. A draft failing any check is discarded, not patched.
Corrections
If something here is wrong, email admin@phllaps.net. Corrections are made in place with a note on the post. The vendor advisory is always linked at the bottom of each article and always outranks anything written here.
What this site is not
It is not a threat intelligence feed, it does not do attribution, and it does not publish exploit code or proof-of-concept detail. If you need real-time detection content, this is the wrong site.