About pwnd.co

AI disclosure

AI-written from the sources below. Verify before acting.

An AI model wrote this article from the sources listed below, and no person reviewed it before it went live. Automated checks compare it with those sources, but checks can miss errors, so confirm the details with the vendor before you act.

What pwnd.co is

pwnd.co lists the critical security events of the last 7 days. Each has a short card and a fix guide.

An AI model writes every article from the sources below. No person reviews it before it goes live. Automated checks compare it with the sources, but checks miss things. Verify before you act.

This is general guidance, not professional security advice. We don't know your systems.

What gets in

An event appears if any of these is true:

1. It is in the CISA KEV catalog. KEV (Known Exploited Vulnerabilities) is a US government list of security flaws (CVEs) that attackers are using. About 6 to 10 a week.
2. Exploitation is confirmed. A vendor advisory or reputable news report says attackers are using a CVE.
3. A major news event. A breach, ransomware campaign, supply-chain compromise or security-related outage. An AI model scores each for scale, harm, reach and novelty. We publish at most 5 news-only events a day, highest scores first.

Target: about 10 to 25 events a week.

Sources

We use these to write each article:

• CISA KEV catalog and CISA advisories.
• NVD (US NIST vulnerability database): descriptions, CVSS scores (0 to 10 severity) and references. Optional.
• FIRST EPSS: how likely a flaw is to be exploited soon.
• Vendor advisories: Microsoft, Cisco, Fortinet, Palo Alto Networks, Ivanti, SonicWall, Broadcom/VMware, Citrix, Apple, Google Chrome.
• News: The Record, The Hacker News, Dark Reading, Krebs on Security. Used to find events and add context.

Our news rules:

• We never republish news articles. We write from facts across sources and link to originals.
• Quotes of 25 words or fewer appear only with attribution.
• BleepingComputer and SecurityWeek block automated readers, so we use only their RSS headline and summary.
• We name a company in a news event only after two independent sources, or its own statement, confirm it.
• Our crawler identifies itself as pwnd.co-bot (+https://pwnd.co/about) and follows each site's robots.txt (the file that says what crawlers may visit).

How articles are made

1. Pull facts. We extract products, affected and fixed versions, exploitation status, scores, indicators of compromise (IOCs: file hashes, IP addresses, domains) and MITRE ATT&CK IDs (a standard list of attacker techniques).
2. Write. An AI model writes the card and fix guide from those facts and source text only.
3. Layer 1: code checks. Every CVE ID, version, patch ID, IP, domain, hash and link must appear word for word in the sources. Links must come from our source list. Commands appear only if a vendor published them.
4. Layer 2: second AI check. A separate model flags any claim that is unsupported or wrong. It must find no major problems.
5. If a check fails. The article is rewritten once. If it fails again, it is held: not published. The maintainer gets an alert with the reasons.

When sources disagree

• Vendor advisory wins on affected and fixed versions, workarounds and fix steps.
• CISA KEV wins on whether something is being exploited.
• CVSS scores are shown side by side, for example "7.1 (SonicWall) / 7.5 (NVD)". We do not pick one.
• No vendor advisory found? The fix guide says so. We do not guess version numbers.

Corrections and retractions

• Updates. If a source changes, the article is updated in place. It gets a dated "What changed" entry and an "Updated" label.
• Retractions. If an event is wrong, or should not have been published, we retract it. Its page stays at the same address with a notice that the earlier content was withdrawn and should not be relied on. It is removed from the feed, the archive and the RSS feed, and search engines are asked not to index it.

How to report an error

Every event has a Report an error link. Your report goes only to the maintainer.

Not advice: verify before acting

Check the vendor advisory before you change anything. Test patches before you apply them to production.

Contact

Use the Report an error link on any event.