FASIHAA

Patch your shit today, bro.

Fine. Since you asked twice:

• On the KEV list and internet-facing: today. Hours to days, not weeks. VPNs, firewalls, and file-transfer apps go first, because that's where attackers go first.
• On the KEV list, internal: within days, and always before the CISA due date. "Internal" is a network location, not a force field.
• Critical or high, not (yet) exploited: within your normal cycle, ideally inside 2–4 weeks. That "(yet)" is doing a lot of work.
• Everything else: monthly. Microsoft's Patch Tuesday (second Tuesday of the month) is a fine heartbeat. It's literally on a calendar. You have a calendar.
• Browsers and endpoints: turn on auto-update, then actually check it's applying. "I clicked 'remind me tomorrow'" 47 times is not auto-update.

"Once a quarter" isn't a cadence, it's a hope.

The Known Exploited Vulnerabilities catalog: CISA's list of bugs that someone is already using to break into things. Not theoretical, not "could potentially," not a conference talk. Actual crimes.

Every entry has a CVE, what to do about it, and a due date. It's the best free "patch this first" list on the internet, and the government made it for you. When was the last time that happened?

They're deadlines for US federal civilian agencies under CISA's binding operational directive. You're not legally bound by them. Congrats on the loophole.

Unfortunately, ransomware crews don't check whether you're a federal agency before they encrypt you. Treat the date as a ceiling, not a target. If the feds get two weeks, you don't get "eventually."

Countdowns on this site run to the end of the due date in UTC, because time zones are also a vulnerability.

Because the catalog goes back to 2021, and deadlines on old entries came and went while everyone was "prioritizing."

Overdue doesn't mean dead. Years-old KEV bugs still get exploited constantly, because years-old unpatched boxes are still out there, humming along, waiting for their moment. Is one of them yours? Check My stack. Want only the live deadlines? Use the "Still ticking" filter and pretend the rest don't exist (they do).

CVSS tells you how bad a bug could be. KEV tells you someone is actually doing it. One is a weather forecast, the other is water coming under the door.

A medium-severity KEV entry beats an unexploited 9.8 basically every time. Then sort by exposure (internet-facing first) and by what you'd cry about losing (crown jewels first). Sorting a spreadsheet by CVSS and starting at the top is not a strategy, it's a screensaver.

Then you do the other stuff, which is more annoying, so pay attention:

• Apply the vendor's mitigations or workarounds. They're in the advisory. Read the advisory.
• Cut exposure: get it off the internet, lock down management interfaces, restrict who can reach it.
• Hunt for compromise. If it's on KEV, someone may have already been in.
• If it's end-of-life, CISA's advice is to stop using it. Yes, even that one. Especially that one.

"No patch" never means "no action." It means "more action, less clicking."

Then you'll have a bad afternoon. Ransomware is a bad quarter, a press release, and a very awkward board meeting.

Snapshot or back up first, test on a small pilot group, then roll out wide. Keep a rollback plan. And if the patch genuinely breaks prod, tell the vendor loudly, apply mitigations, and try again. "It might break" is a reason to test, not a reason to wait until 2031.

Look at you! Almost.

• Verify it landed. Check the version. "The ticket says done" is not a version number.
• Reboot if it needs one. A kernel patch you haven't booted into is a decorative patch.
• Look for compromise. Patching locks the door. It doesn't evict whoever walked in last Tuesday.
• Rotate credentials if the bug could have leaked them.

Then you're done. Until tomorrow. See you tomorrow.

Every hour, a robot pulls CISA's official KEV feed plus a pile of vendor advisories and security news, and caches it. The robot doesn't sleep, take PTO, or wait for a change advisory board. Be like the robot.

Every CVE links to NVD and CISA. Check our homework before you act on it. We'd check ours, if we were you.

No. I honestly don't care that much.

Are you seriously going to argue against this????? WTF bro.

Because "please consider applying security updates at your earliest convenience" has been tried for 25 years. Look around. How's that going?