About our Security Advisories news
Latest news on security advisories, covering vulnerability advisories, security alerts, security bulletins, CVE disclosures, CVSS scores, known exploited vulnerabilities (KEV), zero-day exploits, critical flaws, patches, ICS advisories (industrial control systems), CISA and CERT/CC warnings, Patch Tuesday and mitigation guidance.
A security advisory is an official notice that a flaw has been found in software, hardware or an online service. It normally names the affected products, rates the severity, says whether attackers are already exploiting the flaw and explains the fix or workaround. Advisories come from vendors, from national agencies such as CISA and the UK's National Cyber Security Centre, and from coordination bodies such as the CERT Coordination Center.
Many advisories use CVE identifiers, which give each publicly disclosed flaw a unique reference, and CVSS scores, which rate severity from 0 to 10, with 9.0 and above rated critical. CISA's Known Exploited Vulnerabilities catalogue, launched in November 2021, lists flaws that are being used in attacks, and US federal civilian agencies must fix them by set deadlines. CISA also issues ICS advisories covering products from vendors such as Siemens, Schneider Electric and Rockwell Automation. In October 2026 two critical flaws in PHP led to emergency patches and urgent advice for website owners.
For IT teams, advisories drive patch management by deciding which flaws to fix first, which systems to isolate and which workarounds to apply while a patch is prepared. Microsoft releases monthly security updates known as Patch Tuesday, while security teams use vulnerability scanners and asset lists to check what is exposed. Individuals can reduce their risk by turning on automatic updates.
Disclosure is itself a subject of debate. Coordinated disclosure gives vendors time to prepare a fix before details are published, while some researchers argue that users need warning sooner if attackers are already active. CVSS scores measure potential severity rather than real-world risk, and in April 2025 uncertainty over the contract funding the MITRE-run CVE programme prompted concern, although it was reported as fully funded by March 2026.
The first computer emergency response team, the CERT Coordination Center, was set up at Carnegie Mellon University in November 1988 after the Morris worm. The CVE naming system became public in September 1999. The Heartbleed flaw in OpenSSL was disclosed on 7 April 2014 alongside a fixed release, yet many administrators were slow to patch. In May 2017 the WannaCry outbreak disrupted at least 81 NHS trusts in England, and the National Audit Office said that basic measures such as keeping software up to date could have prevented it.
Knowing which flaws matter, and how fast to act, is the point of an advisory. Our NewsNow security advisories feed brings together the latest vulnerability alerts, CVE notices, patches, zero-day warnings and CISA and CERT/CC advisories from official sources, so you have a comprehensive, up-to-date view.
