# Too many vulnerabilities. Only a few matter. We tell you which, instantly. Daily threat intelligence Last 24 hours: **713** vulnerabilities evaluated, **10** selected. Day and night we read reports from CERTs, vendors, labs, exploit repositories and technical communities. We discard the noise and deliver only what matters, checked by an AI agent, with an alert level you can read in one second. - No card required - Alerts on your products ## Current level: DEFCON 2 · Severe risk Check now whether it affects you, and update. - 9 vulnerabilities actively exploited - Reports collected in the last 24 hours: 1,907 - Vulnerabilities evaluated by our analysis system: 713 - Discarded after evaluation: 703 - Vulnerabilities selected now: 10 Updated Nov 10, 2026 · 14:25 UTC **3,858**vulnerabilities in the briefings of the last 12 months **1 in 59**of those we evaluate makes it into the briefing (last 30 days) **29**at DEFCON 1–2 in 12 months: real emergencies are rare Less noise. More intelligence. **The DefenceLevel Index is public.** The cyber threat level, day by day: a public reference that professionals and the press can consult and cite. [Open the DefenceLevel Index →](https://defencelevel.com/index) How it works ## You don't need more news. You need more selection. The service works for you, from collection to delivery. Nothing to install, nothing to configure. ### Collection Every 30–60 minutes we read hundreds of sources: NVD, the CISA catalogue, vendors, CERTs, research labs, GitHub, Mastodon and Bluesky. ### Verification Every report is checked against official sources. Nothing is sent without the go-ahead of an AI agent, which stops false alarms. ### Selection Four factors: severity, real-world exploitation, impact on widely used systems, specialist attention. Only what crosses the threshold passes. ### Delivery Every day at 05:00 UTC, the briefing by email. Immediate alerts: DEFCON 1 always, DEFCON 2 and 3 as you choose in My Defence. The DEFCON level ## In one second you know whether to act or finish your coffee. DEFCON stands for _DEFense readiness CONdition_.\ We use the original military scale: the lower the number, the more serious the situation. - DEFCON 5 **Low risk**: No serious vulnerabilities in widely used products in the last 24 hours. No urgency: routine maintenance. - DEFCON 4 **Moderate risk**: Serious vulnerabilities in widely used products, with no attacks under way. Update the affected products in your normal cycle. - DEFCON 3 **Substantial risk**: Attacks under way or imminent on widely used products. Immediate alert on your products in My Defence. If you use the products under attack, update them now. - DEFCON 2 **Severe risk**: Broad-impact threat: an attack campaign or near-universal systems. Immediate alert. Check now whether it affects you, and update. - DEFCON 1 **Critical risk**: Mass exploitation of a critical flaw in near-universal systems. Immediate alert. Mass attacks under way: act now. The briefing ## Six sections. Three minutes to read. ### Summary The state of the day in a few lines, with the level up front. ### New in the last 24 hours For each one: severity, impact, exploit status, what to do and why it matters now, with the sources from the last 24 hours. In your dashboard you also see why we selected it. ### Still ongoing Those already reported, with nothing new in the last 24 hours: one line each, for 3 days after the last news. ### Other exploited vulnerabilities The other exploited vulnerabilities in the news, one line each: to see at a glance whether you use those products. ### Worth watching Below the alert threshold, but worth following. If they get worse, the briefing flags it and, when needed, an immediate alert. ### Much discussed, but no cause for alarm today The widely discussed stories that, once verified, do not justify alarm. Knowing what to ignore is worth as much as knowing what to do. Excerpt from the briefing of Nov 9, 2026 · 04:00 UTC DEFCON 2 · Severe risk Check now whether it affects you, and update. DEFCON 2 · Severe risk · CVSS 8.1 OpenBSD OpenSSH: authentication bypass **Why now:** The level rises from DEFCON 3 to DEFCON 2: on 8 November at 15:44 UTC SANS ISC reported scans searching for servers exposed to this flaw. VulnCheck KEV has listed it as exploited since 6 November. - 8 Nov, 15:44 UTC · [SANS ISC](https://isc.sans.edu/diary/rss/33498): technical analysis Exploitation confirmed by VulnCheck KEV since 6 November, citing watchTowr and previdian.com; Help Net Security also reports attacks, and The Hacker News reported attackers gaining root on a honeypot. Not in the CISA KEV catalogue. Code on GitHub since 5 November, from unverified repositories. **Impact:** On Linux systems where sshd is built with musl libc and without PAM, such as Alpine Linux, a remote attacker without credentials can log in with password authentication by sending any password between 256 and 1024 characters, for some account configurations. **Exploit:** Exploited in the wild **What to do:** On Linux systems that use musl libc without PAM, update OpenBSD OpenSSH to 10.6p2 or later, or to your distribution's package that carries the fix, now; until then, disable password authentication in sshd. Review successful password logins since 5 November for signs of compromise. **Why it is here:** CVSS 8.1 · Active exploitation reported by VulnCheck KEV · Exploitable remotely without credentials, but only under specific conditions · Component present almost everywhere [CVE-2026-123158](https://nvd.nist.gov/vuln/detail/CVE-2026-123158) Real data: the first vulnerability in the November 9 briefing, exactly as subscribers received it. Today's briefing is for subscribers only. My Defence ## Your infrastructure. Your alerts. Draw the zones of your network and add the products you use: the briefing and the alerts tell you at once what concerns you. ### Draw your zones Perimeter, servers, cloud, workstations: your network as it really is, with the names you use. ### Add your products Vendors and products from the catalogue; if a name is missing, you type it in. ### Get what concerns you Alerts on your products, and the briefing every day or only on the days that concern you. DEFCON 1 always reaches everyone. Built for ## People responsible for real systems, with no time to waste. ### Developers You know when a dependency you use becomes a problem, before it becomes one for your users. ### Sysadmins and DevOps Firewalls, VPNs, mail servers, collaboration platforms: whatever is exposed to the internet comes first. ### Every business Without a security team, it tells you when to call your IT provider. With one, it shows where to start each day. ### Consultants and MSPs One verified source to start from every day, for every client you look after, instead of hundreds of bulletins. Pricing ## One plan. Everything included. 7 days free to see how it works. 1. **Today**Start with your email, no card. 2. **For 7 days**The full service, no limits: try it with your real products. 3. **On day 7**You decide. To continue, add a card from your dashboard; without one, the trial simply ends. Secure payment with Stripe · Cancel anytime €49 per month VAT included - Briefing in your inbox every day at 05:00 UTC - Immediate alerts, also at DEFCON 3 on your products - Dashboard with briefing archive - Nothing to configure, no commitment Questions ## Before you start **Do I need to set anything up?** No. Enter your email, start the trial and the next day you receive your first briefing. The service never accesses your systems. **Where does the information come from?** NVD and cve.org, the CISA KEV, VulnCheck KEV and ENISA EUVD catalogues of exploited vulnerabilities, EPSS, GitHub advisories, bulletins from vendors such as Microsoft, Google, Mozilla, Atlassian, Siemens and GitLab, national CERTs in Europe, the United States, Canada and Australia, independent research labs, Exploit-DB, Metasploit, Nuclei and the main technical communities. **How do you decide what matters?** Every vulnerability is scored on four axes: technical severity, real-world exploitability, impact on widely used systems, attention from specialists. A widely discussed story without official confirmation never raises the level: it goes into the noise section, with our assessment. **Do you use artificial intelligence?** Yes. Before sending, an AI agent checks every briefing and every alert against our data: it corrects wrong attributions, stops alerts that the data do not confirm and writes their texts. Nothing goes out without its go-ahead. The DEFCON level, on the other hand, is calculated only by explicit, verifiable rules, described in the public methodology: given the same data, the result is always the same. **Why is DEFCON 1 the most severe level?** It is the original military scale the term comes from: DEFCON 5 means normal, DEFCON 1 maximum alert. **How do I cancel?** From your dashboard, in two clicks. The trial needs no card: if you do not add a payment method, it simply ends, with no charge. If you cancel an active subscription, access stays until the end of the month already paid. **Is VAT included? What about businesses?** For individuals the price is €49 a month including VAT, wherever you are. Businesses with a VAT number pay €49 without VAT when the reverse charge applies: just enter your VAT number at checkout. In all other cases VAT is already included in the price. Every payment comes with an invoice. ## Tomorrow, your first briefing. 7 days free. Nothing to configure. The briefing goes out every day at 05:00 UTC. --- Web page: https://defencelevel.com/ Open data: [JSON](https://defencelevel.com/api/status?lang=en) · [CSV](https://defencelevel.com/api/trend?days=365&format=csv) · [Atom](https://defencelevel.com/index/feed.xml) · [OpenAPI](https://defencelevel.com/openapi.json) · [llms.txt](https://defencelevel.com/llms.txt)