VulnMCP is an MCP server built with FastMCP that provides AI clients, chat agents, and other automated systems with tools for vulnerability management. It offers modular "skills" that can be easily extended or integrated, enabling intelligent analysis and automated insights on software vulnerabilities.

A new component in the galaxy of tooling of vulnerability-lookup.

Thanks to @cedric who is becoming an orchestrator for many AI tools nowadays.

#cve #gcve #vulnerability #vulnerabilitymanagement #opensource #ai #mcp #vulnerabilitylookup

🔗 https://github.com/vulnerability-lookup/VulnMCP

ICS[AP] Dashboards are updated with the 5 CISA Advisories released on 3/24/26:

Grassroots: 1 New
Pharos Controls: 1 New
Schneider Electric: 2 New
WHILL Inc.: 1 Update

www.icsadvisoryproject.com
#icssecurity
#otsecurity
#vulnerabilitymanagement

ICS[AP] updated CISA ICS Advisories Master File for 3/24/26 & the following year's CSVs:

CISA_ICS_ADV_2026_3_24.csv
CISA_ICS_ADV_2025_3_24_26.csv

Available @ ICS[AP] GitHub:
https://github.com/icsadvprj/ICS-Advisory-Project/tree/main

#opensource
#vulnerabilitymanagement
#icssecurity

🔴 New security advisory:

CVE-2026-33502 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-33502-wwbn-avideo-ssrf-vulnerability

#InfoSec #VulnerabilityManagement #CyberSec

The "Zero Day Clock" is a Masterclass in Bad Data Science.

I've heard this clock mentioned multiple times at #RSAC this week. It predicts an "exponential collapse" of the time-to-exploit (TTE) toward zero. It makes for a scary keynote slide, but the math is fundamentally broken.

The model suffers from:

Right-Censoring: It ignores that slow exploits for 2025 haven't happened yet, artificially forcing the "average" to zero.

Selection Bias: It only tracks the fastest 1.5% of vulnerabilities and ignores the "long tail."

Administrative Lag: It mistakes the growing NVD backlog for "attacker velocity."

We don’t need hyperbolic "scare-ware" statistics to justify our urgency. Defense is hard enough without distorting the data.

I’ve written a full technical audit on why this methodology fails a basic statistical peer review:

Technical Breakdown: https://gist.github.com/jgamblin/91f7843b62069616c951f32957c921cd

#RSAC #RSAC2026 #Infosec #CyberSecurity #DataScience #VulnerabilityManagement

🔴 New security advisory:

CVE-2026-32968 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-32968-com-mb24sysapi-module-rce-patch-immediately

#InfoSec #VulnerabilityManagement #CyberSec

🔴 New security advisory:

CVE-2026-3587 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-3587-linux-device-cli-escape-vulnerability

#InfoSec #VulnerabilityManagement #CyberSec

🔴 New security advisory:

CVE-2026-3587 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-3587-linux-device-cli-escape-vulnerability

#InfoSec #VulnerabilityManagement #CyberSec