Cyber security, in production

About the security coverage

Security news arrives as a flood: hundreds of CVEs a week, each with a severity score that says little about whether you need to act tonight. This section covers the small share that matters to teams running data platforms, AI tooling, and the infrastructure under them.

The Security Desk works from primary sources first: vendor security advisories, the CISA Known Exploited Vulnerabilities catalogue, the UK NCSC, and the researchers who disclose the flaws. Trade press is used to spot stories, never as the only source for a claim. A piece runs when a vulnerability is critical and exploited or likely to be, or when an incident changes how teams should configure, patch, or monitor something they run.

Each piece answers the same practical questions in its own way: what is affected, which versions, whether exploitation is happening, what the fix is, and what to do if you cannot patch yet. Where a vendor publishes indicators of compromise or a workaround, the piece links to it directly.

What you will not find here: breach gossip, vendor-sponsored threat reports presented as news, or speculation about attribution. When the facts about an incident are still moving, the piece says what is confirmed and what is not, and it is updated as advisories change.

All coverage is reviewed by the responsible editor before publication. If an advisory has changed since we wrote about it, or a version range here is wrong, the contact page lists the corrections address; fixes are logged publicly. The filters above group coverage into critical CVEs and major incidents.