Meta tags:
description=In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter.;

Headings (most frequently used words):

the, security, of, talos, intelligence, center, vulnerability, research, incident, response, resources, media, company, week, can, from, less, panic, patching, more, precision, one, big, thing, top, headlines, get, enough, upcoming, events, where, you, find, most, prevalent, malware, files, telemetry, over, past, why, do, care, so, now, what, close, encounters, human, kind, tale, two, eras, reporting, vegas, networking, ai, and, good, boys, related, content, share, this, post, support, follow, us,

Text of the page (most frequently used words):
the (52), and (32), talos (19), that (17), with (14), #security (13), this (12), source (11), vulnerability (10), can (10), cvss (10), #intelligence (9), you (9), for (9), cisco (8), threat (8), support (7), from (7), over (7), what (7), more (7), epss (7), company (6), newsletter (6), blog (6), media (6), open (6), are (6), detection (6), data (6), exploited (6), than (6), back (6), your (5), two (5), exploitation (5), kev (5), its (4), about (4), podcast (4), reference (4), resources (4), services (4), research (4), june (4), 2026 (4), week (4), why (4), while (4), md5 (4), rep (4), example (4), filename (4), exe (4), name (4), tool (4), https (4), talosintelligence (4), com (4), talos_file_reputation (4), sha256 (4), which (4), technical (4), based (4), github (4), cisa (4), evidenceforge (4), datasets (4), high (4), single (4), one (4), patching (4), broader (4), being (4), enrichment (4), systems (3), tools (3), incident (3), response (3), center (3), real (3), win (3), 1201 (3), most (3), files (3), may (3), his (3), using (3), vulnerabilities (3), heap (3), dicom (3), visibility (3), risk (3), attack (3), exploit (3), before (3), used (3), answers (3), teams (3), use (3), coming (3), but (3), probability (3), severity (3), gcve (3), cve (3), actually (3), how (3), score (3), our (2), privacy (2), careers (2), videos (2), takes (2), beers (2), secure (2), endpoint (2), naming (2), categories (2), emergency (2), proactive (2), reactive (2), microsoft (2), advisories (2), reports (2), email (2), spam (2), trends (2), search (2), live (2), here (2), complete (2), vegas (2), digital (2), latest (2), practices (2), theory (2), they (2), content (2), post (2), afc8a00883a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 (2), a2cf85d22a54e26794cbc7be16840bb1 (2), 5e6060df7e8114cb7b412260870efd1dc05979454bd907d8750c669ae6fcbcfe (2), 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f (2), 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 (2), telemetry (2), past (2), events (2), where (2), find (2), cybersecurity (2), philippe (2), keep (2), mediaarea (2), well (2), file (2), investigation (2), overflow (2), often (2), network (2), through (2), get (2), disclosure (2), have (2), likelihood (2), allows (2), web (2), websites (2), malicious (2), hosting (2), russia (2), infrastructure (2), cyber (2), attacks (2), workflows (2), designed (2), keys (2), other (2), secrets (2), repositories (2), lawmakers (2), agency (2), public (2), top (2), repository (2), feature (2), build (2), defenders (2), these (2), new (2), validate (2), pipelines (2), production (2), red (2), team (2), synthetic (2), realistic (2), causal (2), into (2), world (2), without (2), logic (2), model (2), thing (2), change (2), ones (2), surge (2), arrives (2), triage (2), faster (2), rather (2), only (2), because (2), decentralized (2), wait (2), queue (2), meaningfully (2), has (2), backlog (2), lens (2), global (2), default (2), tells (2), bad (2), very (2), patch (2), impact (2), next (2), will (2), different (2), questions (2), been (2), not (2), nobody (2), martin (2), less (2), panic (2), precision (2), inc, affiliates, all, rights, reserved, view, policy, follow, documentation, joe, ground, report, therapy, dog, pictures, tips, handling, conference, overstimulation, reporting, networking, good, boys, amy, reminisces, tech, toys, their, childhood, inspired, hilarious, lesson, shouldn, left, channel, tale, eras, hazel, channels, her, inner, spielberg, explore, humans, delightfully, irrational, reminding, best, simple, lot, harder, pull, off, when, busy, dealing, life, close, encounters, human, kind, related, subscribe, share, cc4d231df34e57f59eb970353c7d9de2, autopico, pua, kmsactivator, w32, 5e6060df7e, 100, sbx, 38de5b216c33833af710e88f7f64fc98, sample, procpatcher, 2915b3f8b703eb744fc54c81f4a9c67f, vid001, worm, coinminer, prevalent, malware, las, nevada, upcoming, memorable, experiment, green, onion, bypass, biometric, fingerprint, reader, experience, frontlines, shares, journey, led, him, breaking, things, them, safe, laulheret, produces, analysis, software, discovered, four, mediainfolib, provides, tag, video, audio, buffer, hospitals, rely, pacs, those, automatically, ingest, received, white, paper, presents, concrete, case, study, demonstrating, creation, format, pydicom, gdcm, orthanc, tour, really, happens, enough, adapting, focusing, increasing, detailed, information, critical, actively, higher, age, underminr, domain, fronting, actors, modify, requests, leverage, trusted, cloak, activity, dark, reading, hijacking, brand, opens, delivery, centers, established, feb, 2022, weeks, invaded, ukraine, was, allegedly, disinformation, campaigns, sanctions, evasion, linked, cybersecuritynews, authorities, seized, 800, servers, launch, campaign, relies, actions, containing, payload, steal, credentials, tokens, were, injected, 700, commits, pushed, impacted, securityweek, 500, infected, megalodon, supply, chain, demanding, after, contractor, intentionally, published, aws, govcloud, vast, trove, account, krebsonsecurity, leak, contain, demand, tries, headlines, head, clone, guided, conversation, custom, scenarios, then, newly, generated, robust, soc, analyst, training, programs, stress, test, siem, touch, environment, full, details, link, now, relying, heavily, scrubbed, engagements, leaves, incomplete, generators, spit, out, independent, fail, tell, coherent, story, injects, background, noise, herrings, proper, sequencing, mix, work, synchronized, accurately, mimic, compliance, headaches, care, released, generate, highly, correlated, logs, solves, chronic, shortage, quality, labeled, needed, train, hunters, canonical, event, assisted, scenario, authoring, ensures, temporal, consistency, across, log, formats, big, none, removes, workload, does, patches, sprint, ride, normal, cycle, worthwhile, right, pair, end, stack, informed, authoritative, list, makes, room, multiple, sources, evidence, surface, against, same, identifier, gives, outside, frankly, inside, too, picture, alone, signal, references, affected, products, indicators, doesn, practice, actionable, context, traditional, nvd, pipeline, visibly, struggled, years, speed, starting, take, shape, approach, identification, properties, matter, second, ingredient, knowing, many, catalog, excellent, quoted, numbers, times, count, contributes, authorized, publisher, adp, program, alongside, original, cna, works, also, structurally, centralized, conservative, admits, naturally, scoped, federal, surfaces, practitioner, writing, germany, notice, deserves, enriching, records, would, likely, happen, soon, together, drop, everything, pile, lowepss, probably, behind, medium, shrink, weakening, posture, prioritizes, remediation, assesses, primary, output, dynamic, updated, daily, static, usually, nature, focus, prediction, scoring, system, earns, place, between, given, days, signals, answer, honestly, speaking, still, prioritising, wrong, way, decade, question, could, something, exploiting, ever, problem, weaponised, wild, morning, sorted, purely, respending, finite, operations, capacity, hypotheticals, recently, closed, introduction, ready, time, much, chewing, rethinking, own, along, lines, raised, running, ideas, practitioners, warning, welcome, edition, thursday, thorsten, rosendahl,

Text of the page (random words):
less panic patching more precision blog intelligence center intelligence center back intelligence search email spam trends vulnerability research vulnerability research back vulnerability reports microsoft advisories incident response incident response back reactive services proactive services emergency support blog support more security resources security resources back security resources open source security tools intelligence categories reference secure endpoint naming reference media media back media talos intelligence blog threat source newsletter beers with talos podcast talos takes podcast talos videos company company back company about talos careers less panic patching more precision by thorsten rosendahl thursday may 28 2026 14 00 threat source newsletter welcome to this week s edition of the threat source newsletter recently martin closed his introduction with a warning ready or not the time of much patching is coming i ve been chewing on that one for a while because i m rethinking my own enrichment pipelines along these lines and the questions martin raised are the ones i keep running into with one or two ideas on what practitioners can actually do about it honestly speaking most of us are still prioritising the wrong way cvss has been the default for over a decade but it only answers one question how bad could this be in theory it s a severity score not a risk score a cvss 9 8 on something nobody is exploiting and nobody ever will is a very different problem from a cvss 7 2 that s being weaponised in the wild this morning if your patch queue is sorted purely by cvss you respending finite operations capacity on hypotheticals this is where epss exploit prediction scoring system earns its place next to cvss epss is a probability between 0 and 1 that a given cve will be exploited in the next 30 days based on real world signals the two answer different questions feature cvss epss focus severity impact risk likelihood of exploitation nature static usually dynamic updated daily output 0 0 to 10 0 score 0 0 to 1 0 probability primary use assesses technical impact prioritizes remediation cvss tells you how bad it would be if exploited epss tells you how likely it is to actually happen to you soon used together a high cvss and a high epss is your drop everything pile while a high cvss and a very lowepss can probably wait behind a medium with an epss of 0 7 that single change in triage logic can meaningfully shrink the patch backlog without weakening your posture the second ingredient is knowing what is actually being exploited and here many teams default to cisa s kev catalog kev is excellent and i ve quoted kev numbers in this newsletter more times than i can count cisa contributes as an authorized data publisher adp in the cve program enriching records alongside the original cna s data that model works well but it s also why kev is structurally centralized conservative in what it admits and naturally scoped to what u s federal visibility surfaces for a global practitioner and writing this from germany i notice is this being exploited deserves a broader lens that broader lens is starting to take shape with gcve global cve a decentralized approach to vulnerability identification and enrichment two properties matter for the surge that s coming speed of enrichment because gcve is decentralized enrichment data references affected products exploit indicators doesn t have to wait in a single queue in practice actionable context arrives meaningfully faster than the traditional nvd pipeline which has visibly struggled with backlog over the past two years broader exploitation signal rather than a single authoritative list of what is being exploited gcve makes room for multiple sources of exploitation evidence to surface against the same identifier that gives defenders outside the u s and frankly inside it too a more complete picture than kev alone pair that with epss on top of cvss and you end up with a triage stack that is faster broader and probability informed rather than only severity none of this removes the patching workload that is coming but it does change which patches you sprint on at 2 00 a m and which ones can ride the normal cycle before the surge arrives that s a worthwhile thing to get right the one big thing cisco talos released evidenceforge a new open source tool designed to generate highly realistic correlated synthetic security logs this tool solves the chronic shortage of high quality labeled datasets needed to train threat hunters and validate detection logic by using a single canonical event model and ai assisted scenario authoring evidenceforge ensures causal and temporal consistency across more than 20 log formats why do i care relying on heavily scrubbed public datasets or red team engagements often leaves security teams with incomplete telemetry while most synthetic generators spit out independent events that fail to tell a coherent story evidenceforge injects realistic background noise red herrings and proper causal sequencing into the mix this allows your team to work with synchronized datasets that more accurately mimic real world network visibility without the compliance headaches of using production data so now what security teams can head over to github to clone the evidenceforge repository and use its guided conversation feature to build custom attack scenarios defenders can then use these newly generated datasets to build robust soc analyst training programs stress test a new siem and validate detection pipelines before they touch a production environment you can find the full details and the link to the open source repository in the blog post top security headlines of the week lawmakers demand answers as cisa tries to contain data leak lawmakers are demanding answers from the u s cybersecurity infrastructure security agency cisa after a contractor intentionally published aws govcloud keys and a vast trove of other agency secrets on a public github account krebsonsecurity over 5 500 github repositories infected in megalodon supply chain attack the campaign relies on github actions workflows containing a payload designed to steal credentials keys tokens and other secrets the workflows were injected through over 5 700 malicious commits pushed to the impacted repositories on may 18 securityweek authorities seized 800 servers of hosting company used to launch cyber attacks the investigation centers on a web hosting company established on feb 10 2022 weeks before russia invaded ukraine the infrastructure was allegedly used to support cyber attacks disinformation campaigns and sanctions evasion linked to russia cybersecuritynews content delivery exploit opens websites to brand hijacking the underminr domain fronting attack allows threat actors to modify web requests and leverage trusted websites to cloak malicious activity dark reading cisco s risk based vulnerability disclosure in the age of ai cisco is adapting its vulnerability disclosure practices focusing on increasing the visibility of detailed technical information for vulnerabilities that are critical actively exploited or have a higher likelihood of exploitation cisco blog can t get enough talos dicom pydicom gdcm and orthanc a technical tour of what really happens in the heap hospitals rely on dicom based pacs systems and those systems often automatically ingest files received over the network our latest white paper presents a concrete case study demonstrating the creation of a heap overflow vulnerability through the exploitation of the dicom file format mediaarea heap based buffer overflow vulnerabilities mediaarea produces digital media analysis open source software as well as support tools for file investigation talos discovered four vulnerabilities in mediainfolib which provides a ui for technical and tag data for video and audio media files breaking things to keep them safe with philippe laulheret from his memorable experiment using a green onion to bypass a biometric fingerprint reader to his experience on the frontlines of cybersecurity philippe shares the journey that led him to vulnerability research upcoming events where you can find talos cisco live u s may 31 june 4 las vegas nevada most prevalent malware files from talos telemetry over the past week sha256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 md5 2915b3f8b703eb744fc54c81f4a9c67f talos rep https talosintelligence com talos_file_reputation s 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 example filename vid001 exe detection name win worm coinminer 1201 sha256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f md5 38de5b216c33833af710e88f7f64fc98 talos rep https talosintelligence com talos_file_reputation s 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f example filename sample exe detection name win tool procpatcher 1201 sha256 5e6060df7e8114cb7b412260870efd1dc05979454bd907d8750c669ae6fcbcfe md5 a2cf85d22a54e26794cbc7be16840bb1 talos rep https talosintelligence com talos_file_reputation s 5e6060df7e8114cb7b412260870efd1dc05979454bd907d8750c669ae6fcbcfe example filename a2cf85d22a54e26794cbc7be16840bb1 exe detection name w32 5e6060df7e 100 sbx tg sha256 afc8a00883a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 md5 cc4d231df34e57f59eb970353c7d9de2 talos rep https talosintelligence com talos_file_reputation s afc8a00883a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 example filename autopico exe detection name pua win tool kmsactivator 1201 share this post subscribe to threat source related content close encounters of the human kind june 18 2026 14 00 in the latest threat source hazel channels her inner spielberg to explore why humans are delightfully irrational reminding us that while security best practices are simple in theory they re a lot harder to pull off when you re busy dealing with real life a tale of two eras june 11 2026 14 00 in this week s newsletter amy reminisces on the tech toys of their childhood inspired by a hilarious lesson about why your digital privacy shouldn t be left on an open channel reporting from vegas networking ai and good boys june 4 2026 14 00 joe s on the ground report from cisco live u s is here complete with therapy dog pictures and tips on handling conference overstimulation intelligence center intelligence search email spam trends vulnerability research vulnerability reports microsoft advisories incident response reactive services proactive services emergency support security resources open source security tools intelligence categories reference secure endpoint naming reference media talos intelligence blog threat source newsletter beers with talos podcast talos takes podcast talos videos support support documentation company about talos careers cisco security follow us cisco systems inc and or its affiliates all rights reserved view our privacy policy