Endpoint vulnerability management beyond CVEs. Which CVEs are exploitable on each machine, what never gets a CVE, and a control when there is no patch.
Dripping Springs, TX, USA
Joined December 2021
- Tweets266
- Following6
- Followers15
- Likes1
Pinned Tweet
Both PaperCut CVE records published the fix as "24.1.10, 25.0.13, 26.0.5" in one field typed as semver.
NVD resolved that into ranges ending at 24.1.9, 25.0.12, 26.0.4.
One release short. A tool that takes those ranges as written calls a vulnerable server fixed.
Patching a critical takes a ticket. Not patching one takes a record.
Observed use on the host, or its absence, is that record. A scan has no field for it.
50 to 80% of critical CVEs turn out not to require action.
Node.js fixed ten vulnerabilities on Wednesday for lines 22, 24, and 26. Node 20 reached end of life in April. The project's rule for end-of-life lines: always affected, never fixed. A host still on 20 is a migration ticket dated Wednesday.
PHP2Shell by the clock: 28 days from report to acknowledgment, 58 to a fix, under a day from a leaked post to proof-of-concept code. The one clock you control is how fast you can say where PHP runs on each host.
FedRAMP says providers that follow its new vulnerability rules will meet BOD 26-04's timelines. Those rules are mandatory December 7.
Three days leaves no room to guess which hosts run the vulnerable software. Runtime evidence shows it, host by host.
A bank exam runs on a calendar. No incident has to happen first, and the record behind every deferred critical has to exist before the request arrives.
Joe Silva on the line in the examiner's procedures most deferral files cannot answer.
lnkd.in/p/gBPpwufC
Adobe published its CVE on day 120 of a 120-day disclosure window, after shipping the fix in July with no advisory. Citrix closed a report with no CVE at all. NetScaler was exploited for weeks before its bulletin.
Three windows. One queue that could not see into any of them.
What a queue records before an identifier exists:
Which process created the pipe, and who can write to it.
What privilege serves it, and whether another host can reach it.
Whether the behavior is gone after the vendor says it is fixed.
A version string answers none of those.
Spektion observed both pipes as the software ran. The vendor answers took months, and one never came with a CVE.
The vendor's calendar sets the disclosure. It does not set the exposure.
This Runtime Insights edition, adapted from Josh Skorich's piece:
linkedin.com/pulse/vulnerabi…
Three days to patch, and three days to establish nobody was already in.
Memory capture, retrieval, validation, and analysis across every affected host runs weeks to months. The three-day version is a keyword search of the logs.
A catalog match lists where the package is installed. That is a population, and the clock runs on all of it.
The evidence an examiner accepts says which hosts had the vulnerable code executing, with what privilege, reachable from where.
Joe Silva's three questions to ask about one host this week, before the deadline conversation starts:
lnkd.in/p/gHf2pn45
"If you're building a security program just to satisfy a compliance framework, then you're really not building a security program, you're just checking the compliance box."
Kyle Bubp, CISO at Avid, on Security Theater. The box gets checked either way.
spektion.com/podcast/episode…
Truffle Security tested credentials still sitting in public GitHub code. npm tokens, revoked automatically: almost none still worked. Postgres connection strings, which nobody revokes: 88% did.
A leaked secret never gets a CVE. Revocation is the fix.
trufflesecurity.com/blog/git…
Count the AI workloads that execute on your endpoints. Then count the ones the security team expected.
Early Spektion deployments find the first number runs 3 to 10x the second. The executables agents write for themselves have no vendor and get no CVE.
Patching a critical in software nobody runs closes one CVE on that host. Uninstalling it closes that one and takes the title out of every patch cycle after it.
Across Spektion deployments, about 70% of critical CVEs sit in software that does not execute.
An MCP server hands an agent the console: assets, findings, risk scores, exploit context, scan launch, tickets. That is the vendors' own description.
Nothing in it says whether the vulnerable code ran, with what privilege, or what it could reach.
Remediation teams were handed a catalog-ranked list once and learned not to trust it.
An agent drafting the plan from the same list drafts the same plan, faster, and the people who patch learn the same lesson in a quarter instead of a year.
The interface changed. The measurement under it is the scan you already had.
Joe Silva on the one question to ask before the first agent query runs:
lnkd.in/p/gH2msXre
Punto Switcher asks Windows for rundll32.exe and never says where it lives. Windows checks the app's own folder first.
One planted file with the right name, and a signed app runs it. CVE-2026-25865, no fix on record.
spektion.com/videos?utm_sour…
