Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Topic hub

Patch and vulnerability management

Daily CISO has 25 guides and 13 glossary terms on patch and vulnerability management, drawn from CISA's KEV catalog, NVD's CVE database, FIRST.org's EPSS scores and Microsoft's Security Update API. The newest guide, “CISA KEV additions, Nov 4 to Nov 6, 2026: Apple and SonicWall entries and what to triage”, was published November 7, 2026.

Updated

KEV additions, last 45 days
48
entries in the whole KEV catalog
1,769
entries with a known exploit lag
48
Patch Tuesday releases tracked
4

This hub adds no facts of its own: it gathers 25 Daily CISO guides and 13 glossary terms already on this site, plus four live trackers — must-patch now (snapshot November 8, 2026), the full KEV catalog (version 2026.11.06), exploit lag, and Patch Tuesday (snapshot Invalid Date). Every fact sits on its own linked page with its own sources.

Guides, newest first

  1. CISA KEV additions, Nov 4 to Nov 6, 2026: Apple and SonicWall entries and what to triage

    CISA added one Apple CVE on Nov 4 and one SonicWall SonicOS SSLVPN CVE on Nov 6, 2026. What the alerts say and how to set priorities.

    Published November 7, 2026

  2. Moving from KEV alerts to a documented remediation exception process

    What CISA's October 30 and November 3, 2026 KEV alerts and its October 26 strategy say about missed remediation, and what a CISO can record.

    Published November 5, 2026

  3. What a CISA KEV listing requires of non-federal organizations when a vendor patch is unavailable

    CISA's October 28, October 30 and November 3, 2026 KEV alerts say nothing about unpatched flaws. Here is what they do say and where they stop.

    Published November 5, 2026

  4. What CISA's KEV alerts say about the Nov 3 addition and the Ivanti deadline

    CISA's Oct 30 and Nov 3, 2026 KEV alerts list three CVEs. Neither alert states a due date, so here is what they do say and where to look.

    Published November 4, 2026

  5. Who must meet CISA's KEV deadlines, and what non-federal organizations can take from them

    CISA's Oct 28, Oct 30 and Nov 3, 2026 KEV alerts say BOD 26-04 binds only federal civilian agencies. Here is what they say others should do.

    Published November 4, 2026

  6. Reading CISA KEV alerts for ransomware-use and vendor-mitigation signals

    What four CISA KEV alerts from October 26 to 30, 2026 say about required actions, due dates, fallbacks and ransomware use, and what they leave out.

    Published November 3, 2026

  7. What a KEV listing means for exposed edge devices: deadlines and compromise checks

    What CISA's October 2026 KEV alerts, including the Ivanti Connect Secure entries, say about required actions, deadlines and checks for prior compromise.

    Published November 3, 2026

  8. Matching KEV alerts to your asset inventory: product names, CVE IDs and CPE strings

    What CISA's KEV alerts give you to match against assets, what they leave out, and what four CISA pages say (and don't say) about CPE strings.

    Published November 2, 2026

  9. Matching KEV entries to your asset inventory: names, versions, and CPE

    What three CISA alerts give you to match KEV entries to assets, where version data exists, and what the alerts say about CPE strings.

    Published November 2, 2026

  10. Patch Tuesday dates and how to schedule around KEV deadlines

    The three CISA alerts supplied do not state the Patch Tuesday date or any KEV due dates. Here is what they do say about BOD 26-04 and KEV priorities.

    Published November 2, 2026

  11. Reading CVSS vectors next to KEV: what CISA's documents say

    The CISA documents we have never define CVSS metrics. They do show how a KEV listing, exposure and post-exploitation control drive priority.

    Published November 2, 2026

  12. October 2026 KEV additions: patterns and what to change in remediation

    CISA's four KEV alerts from October 23 to 30, 2026 added Arista, PHP, VMware ESX, Linux kernel and Ivanti flaws. Here is what they support.

    Published November 1, 2026

  13. Patch Tuesday vs. KEV: when to break the monthly patch cycle

    What CISA's October 2026 PHP alert and KEV additions say about patching outside a monthly cycle, and what they leave unanswered.

    Published November 1, 2026

  14. CISA KEV additions, Oct 28 to Oct 30, 2026: Ivanti and what to triage

    CISA's Oct 28 and Oct 30, 2026 KEV alerts list four CVEs, two in Ivanti Connect Secure. Here is what the alerts say about triage and deadlines.

    Published October 31, 2026

  15. SBOMs and KEV: finding Brotli and PHP, and what CISA's alerts require

    CISA's Brotli and PHP alerts do not mention SBOMs, but the PHP alert says to inventory every system running the component. Here is what they require.

    Published October 30, 2026

  16. Sequencing patches in a heavy KEV week: KEV, CVSS and EPSS

    What CISA's October 2026 KEV alerts and PHP advisory support for patch order, and what they leave unsaid about CVSS and EPSS.

    Published October 30, 2026

  17. CISA KEV additions, Oct 26 to Oct 27, 2026: what was added and how to triage

    CISA's Oct 26 and Oct 27, 2026 KEV alerts list four CVEs in PHP, Adobe Commerce and Magento, and Google Brotli. Here is what they say and omit.

    Published October 29, 2026

  18. CISA's Brotli KEV listing: what the Oct 27 and 28, 2026 alerts say, and what they leave out

    CISA added Google Brotli and three other flaws to the KEV Catalog on Oct 27 and 28, 2026. Here is what the alerts say and where they stop.

    Published October 29, 2026

  19. CISA KEV additions, Oct 16 to Oct 23, 2026: what was added and how to triage

    Nine KEV entries across three CISA alerts, plus what BOD 26-04 says about prioritizing them. The alerts give no due dates.

    Published October 26, 2026

  20. Google Chrome's critical vulnerabilities, October 2026: what to patch now

    Chrome shipped five updates in October 2026. Google's own severity rating calls 19 of the fixed flaws Critical. None is yet on CISA's KEV catalog. Update now.

    Published October 26, 2026

  21. PHP2Shell: patching the critical PHP vulnerabilities CISA flagged

    CISA's guidance on CVE-2026-109618 and CVE-2026-109619: who is exposed, which PHP versions fix them, what to monitor, and how they sit beside new KEV entries.

    Published October 26, 2026

  22. BeyondTrust Remote Support flaw: what CISA says to patch, hunt and rotate

    CISA says CVE-2026-102764 in BeyondTrust Remote Support is under active exploitation. Here is its guidance on patching, compromise checks and credential rotation.

    Published October 24, 2026

  23. CISA on BeyondTrust Remote Support: patch, hunt and contain CVE-2026-102764

    CISA's October 16, 2026 alert on CVE-2026-102764 in BeyondTrust Remote Support: affected versions, patching, forensics and exposure limits.

    Published October 24, 2026

  24. CVE, CVSS, KEV, EPSS and 27 more: a sourced security glossary

    31 security terms CISOs run into daily — CVE, CVSS, KEV, EPSS, ransomware, phishing and more — each defined from NIST, the FBI, CISA, FIRST.org or Microsoft's own pages.

    Published October 11, 2026

  25. What is CISA KEV, and how do CISOs use it?

    CISA's KEV catalog lists flaws attackers are already exploiting. BOD 26-04 (June 10, 2026) replaced the old flat deadlines with a four-factor, risk-tiered patching clock.

    Published October 7, 2026

Glossary terms

Questions about this page

How many patch and vulnerability management guides and terms does Daily CISO have?
25 guides and 13 glossary terms, listed below, each sourced on its own page.
Where does the data on this page come from?
CISA's own Known Exploited Vulnerabilities JSON feed, NVD's CVE API, FIRST.org's EPSS API and Microsoft's own Security Update API, each read directly and refreshed on its own schedule; every guide and glossary term below lists its own sources.