Pinned Tweet
I'm building Firetruck. Give it a package and version, and it tells you if it's on the KEV list: yes, no or unverified.
"Unverified" is a real answer. If we can't match it, we say so.
Open core, written in Go. GitHub Action is in beta: firetruck.dev
Underrated part of coding agents: the docs.
It writes better docs about the code it writes than I would.
The code still needs a proper review. I think.
Of the 362k CVEs I synced, 1.7k are also on the KEV list.
~1 in 200, do most CVEs get fixed before exploit or they don't make it on the list?
cisa.gov/known-exploited-vul…
Sign-in is open!
Calling Firetruck from your own code?
Generate an API Key (not required, just raises the limits).
There's also a Github Action. Still beta:
firetruck.dev
github.com/marketplace/actio…
Collabora CODE: exploited in September, on KEV Oct 23.
Plex2Shell: exploited Oct 17, on KEV Oct 20.
A KEV no means not listed yet, not that nobody's exploiting it.
I'm building a KEV lookup that answers yes, no or unverified.
cve.org/CVERecord?id=CVE-202…
securityweek.com/plex2shell-…
A good reminder to make sure you ping your actions to a full commit SHA. Make the GITHUB_TOKEN readily for good measure
🚨 GhostAction supply-chain attacks are much bigger than initially reported.
→ 22,964 GitHub repositories targeted
→ 72,000+ malicious commits pushed
→ 1,792 accounts compromised
→ 5 payload families targeting CI/CD secrets, developer machines, and cloud credentials
Researchers warn stolen GitHub tokens are still being reused.
Read: thehackernews.com/2026/10/gh…
Shipped: drop a lockfile on the homepage and get a KEV check right there.
No lockfile handy? Hit the sample.
firetruck.dev
LiteLLM 1.107.0 was on PyPI for about two hours on Oct 21.
It put a .pth file in site-packages, so the stealer ran on every Python start.
No import needed. Running pip was enough.Blocking install scripts doesn't help. Neither does "I never import it".
microsoft.com/en-us/security…
A coding agent started in ~/Downloads, read an AGENTS.md it found there, and tried to install a malicious npm package. Nobody typed npm install.
We review the code an agent writes. Who reviews the package it decided to add?
forever.security/blog/hijack…
CISA has added 272 CVEs to KEV so far this year. Same date last year: 210. All of 2025: 245.
Friday's two: Arista VeloCloud Orchestrator and Collabora Online. Both due Monday.
PHP2Shell still isn't on it.
Check the full build number. 1.43.3.10828 is still vulnerable; the fix is 1.43.3.10861. Censys counts lots of servers on early 1.43.3 builds.
Updating doesn't remove anything already dropped in Codecs. censys.com/advisory/cve-2026…
🚨 UPDATE: CISA ADDS PLEX2SHELL CHAIN, SITEGUARD WAF AND SIEMENS SOFTWARE CENTER FLAWS TO KEV
CISA added six exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct 20, 2026. When we covered Plex2Shell on Oct 18, the Plex CVEs were not in KEV. Now they are.
What's new:
• Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the four flaws chained in Plex2Shell (SSRF, plugin call injection, arbitrary file write that runs on load)
• Plex's own Oct 19 security update now confirms widespread exploitation: attackers are using the chain to install cryptocurrency miners and proxy software on internet-facing servers
• SiteGuard Server Edition: CVE-2026-106931 OS command injection that can run commands as root or SYSTEM; the vendor confirmed abuse on Oct 14
• Siemens Software Center: CVE-2026-110936 DLL sideloading (CWE-427); Siemens SSA-580366 refers to known active exploitation
• Federal due dates are Oct 23 (SiteGuard, two Plex CVEs) and Nov 3 (two Plex CVEs, Siemens); SiteGuard and CVE-2026-96656 are flagged for forensic triage
• Ransomware use is listed as unknown for all six
Fixed: Plex Media Server 1.43.3.10861 or later. SiteGuard Server Edition Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD) or the vendor patch. Siemens Software Center V4.0.9.8 (auto-updates on next startup).
⚠️ Analyst Note:
Plex servers exposed on port 32400 with a public PoC should be treated as possibly compromised if they ran older builds. Plex advises rebuilding from a clean installation when compromise cannot be ruled out; updating alone is not enough. For SiteGuard, save the Diagnostic information first, because patching can erase attack traces.
Sources:
cisa.gov/known-exploited-vul…
forums.plex.tv/t/important-s…
eg-secure.co.jp/siteguard/ne…
productcert.siemens.com/prod…
#DDW #Plex #SiteGuard #Siemens #KEV #CVE
nitter.gq/DailyDarkWeb/status/21…
Opened a Discord for Firetruck, the KEV lookup I'm building. Releases and updates land there first. If it says yes to something it shouldn't, there's a forum tag for that. Lookups need no account. The Discord does, sorry. discord.gg/gdS3nbwYEa
Due today is the whole point of KEV. Not "this is an interesting CVE" but "patch TODAY, clock is running." If Ivanti is in your estate, check firetruck.dev is a free yes/no KEV lookup if you need the catalog filter fast.
Another "exploited in the wild", is not a cvss ranking. If you run Confluence/Jira/Bitbucket/Bamboo Data Center, this is the filter that should jump the queue. I built Firetruck for that check: yes/no KEV lookup. Have a look in bio to get started
🛡️ We added CVE-2026-21589, an arbitrary file access vulnerability affecting multiple Atlassian products, to the KEV Catalog. Visit go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec
KEV isn't a new-bugs feed, it's an in-use-now feed.
A 2015 CVE showing up is why old backlog items deserve a recheck
