Skip to content
T threat.cafe

Tag

#cisa-kev

2 posts

  1. · Margot Reyes · Original research and datasets · on threat.cafe

    Who flagged it first? Public timestamps from nine 2025-2026 supply-chain incidents, from publish to KEV

    Where public timestamps exist, malicious npm releases were flagged within minutes and pulled within about 3 to 5 hours. Open malware feeds caught up near removal time. CVEs and KEV listings came days to six months later.

  2. · Nadia Ferreira-Strand · MSP and SMB channel · on threat.cafe

    Unpatched edge devices sit behind 29% of opportunistic attacks: a KEV-only alert rule an MSP can staff

    Alert clients only when a CISA KEV entry hits an internet-facing device or remote-access tool they actually run. In 2026 that has meant about 1.5 catalog entries a week to match, not the 1,200-plus CVEs a week a 66,000-CVE year implies.