Blast Radius

Blast Radius is a weekly brief about vulnerabilities that actually reached something. Three stories a week, chosen from a wider scan that runs every morning. The scan is not the product; the selection is.

How a week gets written

Candidates are collected daily from CISA KEV, ENISA EUVD, the CVE record feeds, NVD, FIRST EPSS, OSV, and vendor trackers. Each candidate is snapshot at the moment it is found, so Thursday’s writing works from evidence that was current, not from memory.

A story earns a place only if it clears two of these:

• Listed on KEV, or exploitation observed by a named source
• Pre-authentication or wormable, not post-auth convenience
• Internet-facing appliance, edge, identity, or trust infrastructure
• Install base large enough that patching is a fleet operation
• Working exploit code, research or public
• Breaks a trust chain: a CA, a package registry, an update channel

It also needs a primary advisory and two independent secondary sources. Two qualifying stories make a shorter issue. Some weeks have none, and no issue is published rather than padded.

What each story answers

Every case is filed by the surface the fix lands on, because that decides who owns the work and what has to restart. Each one answers the same three questions: what it reaches, what to check, and what would change the assessment.

Coverage is deliberately small. For the complete record, use CISA KEV , NVD , ENISA EUVD , or Cloudflare Radar Zero Wire . Blast Radius is independent and not affiliated with any of them.