Tag

#vulnerability-management

Tagged “vulnerability-management”

3 articles

October's Node.js fixes have to land in Azure Pipelines more than once

Node.js shipped fixes for 10 vulnerabilities on October 21, and Microsoft's follow-up guidance for Azure DevOps shows that the agent, pipeline-selected Node.js versions, task extensions and deployed applications each need their own update.

Nov 7, 2026 · Maya Okonkwo Security & supply chain

Time-to-exploit went negative. Mandiant maps where AI helps the vulnerability queue, and where it fails silently.

Google Cloud's Mandiant team pins mean time-to-exploit at negative seven days and publishes a blueprint for aiming large language models at the vulnerability pipeline. The failure modes it lists are the ones that let the exploit through.

Jul 22, 2026 · Tomás Vega Security & supply chain

Chainguard's drop-in Java libraries trade a framework upgrade for an SLA

Chainguard is shipping drop-in remediated Java libraries for legacy shops carrying unpatched CVE backlogs, positioned as a package swap inside the build in place of a framework upgrade. The trade-off is who owns the patching SLA from then on.

Jun 25, 2026 · Tomás Vega