A video call reaches the Android kernel on three Unisoc chipsets, and the vendor has not replied.
Four different things drive the 263%, and only one is bad news. The count measures workload, not software quality.
Exploitation is arriving before organisations can deploy. Patching in twenty days is worth less than surviving a compromised appliance.
Enrichment now covers 15–20% of incoming CVEs on published criteria. Sound criteria — and they are not your criteria.
1,596 disclosed, 97 patched. Discovery is now a capital expenditure; fixing is still one person in their own time.
27,000 entries with no analysis attached. Your scanner matches on metadata that, for these, does not exist.
Ten thousand critical findings in a month across operating systems, browsers and core libraries. Discovery funded at twenty-five times remediation.
The backlog was reclassified, not cleared. Your dashboard will improve because 29,000 entries left the denominator.
“Battle-tested” is used as a security argument. A defect that survived 27 years of review in OpenBSD undercuts it.
The head start was the entire point of coordinated disclosure. At an interval measured in hours, publication is a starting gun heard equally by both sides.
A private company placed monitoring code on machines it did not own, and published that it had.