Heldnote / Journal

Eleven notes · 9 Nov 2026

Written against the catalog, not against a template.

Longer than a row, shorter than a paper. If a sentence does not name a product, a date, or a check, it does not belong here.

09 Nov KEV Thirteen of thirty-eight rows are boxes at the edge Patch order Which perimeter products are in the set, why they keep coming back, and an order for a week with three advisories. 09 Nov KEV CVSS, EPSS and KEV answer three different questions Method Description, forecast, record. What each one cannot tell you, and how to combine them without calling any of them risk. 09 Nov KEV Read the due date before you read CVSS Method Product match, due date and triage flag first. Why the ransomware flag is rare, and closing rows you do not run. 09 Nov Vuln Patched is not the same as clean After the fix What to collect before the reboot, which window to search, and when to rebuild instead of clean. 09 Nov Vuln The WordPress fix is unpacked by the old code CVE-2026-119977 Match the branch release, not 7.1.4. Close the upgrade directory before you update. 09 Nov Vuln SAML is not the only door on SonicOS SSLVPN CVE-2026-19868 The precondition is a second credential, not "anyone on the internet". Inventory the other methods. 09 Nov Vuln Pointer authentication, added two years after the CVE number CVE-2024-27834 The CVE year is not the date added. A chained bug that needs read and write first. 09 Nov Detect A web server should not start a shell Process tree Parents, children, the logs you need, the exception list, and what the rule misses. 09 Nov Detect A session that did not come from the identity provider Detection An SSO-only account whose login never touched the IdP. Four fields and a two-week baseline. 09 Nov Malware Signed binary, unsigned intent Behavior Built-in Windows tools used to fetch, run and load. What to record and which controls remove the option. 09 Nov Malware A new hash is not a new behavior Behavior What expires with every repack, and three behaviors that usually survive it.

Heldnote journal · reproduction stays off the page