cve.now is a free service that combines vulnerability records and security advisories from the CVE List, CISA’s Known Exploited Vulnerabilities catalog, EPSS, and OSV. Its purpose is to help teams respond faster to new threats by bringing fragmented information into a searchable feed, explaining entries in plain English, and helping users identify whether their software is affected. The launch is framed against a day of serious incidents, including PHP vulnerabilities, a malicious LiteLLM release, Node.js flaws, and a Railway breach. The central problem, Sazabi argues, is that teams face scattered data, delayed awareness unless someone prompts an agent, and a volume of vulnerabilities that makes relevant risks hard to spot.
The service refreshes data every five minutes and joins records using exact identifiers. It offers RSS, Atom, JSON, an API, and an MCP server for coding agents, with filters for technologies and package ecosystems and a lockfile-based dependency check. Its “critical” feed uses fixed rules: inclusion in CISA’s exploited catalog; a CVSS score of at least 9 affecting widely used technology; or a score of at least 7 combined with a high EPSS likelihood. AI writes summaries, but source records determine facts such as severity and affected versions. Current limitations include roughly 30 days of history, no Nix, SBOM, or operating-system package checks, and no coverage of incidents without CVEs. The service is free and requires no account, but is not meant to be a team’s sole security-alert source.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Canada’s proposed Bill C-22 would let officials compel digital services to assist surveillance and create law-enforcement access, raising concerns about security and privacy. Signal, NordVPN, Windscribe, and other companies say they could limit services or leave Canada if the bill passes. (btxx.org)
Chinese research vessels spent more time near Pacific undersea cables than vessels from any other country, according to an analysis of 200 ships. Their “lawnmower” survey patterns could map the seafloor for military operations or potential sabotage. (tomshardware.com)
A cross-request KV cache flaw in Cloudflare’s GLM-5.3 Workers AI model exposed data between requests. Cloudflare describes how it remediated the issue, which involved 155 responses. (blog.cloudflare.com)
ColdFusion servers can have PHP installed and running alongside ColdFusion, sometimes without administrators realizing it. The guide explains how to check for PHP and remove it if it is not needed. (gregoryalexander.com)
Rhode Island has sued Meta, alleging the company profited from scam ads on its platforms. The state is the first to bring this type of lawsuit against Meta. (rhodeislandcurrent.com)
Russian IT specialist Yuri Belenko was sentenced to 13 years for donating to a Ukrainian military fund. Investigators used customer data Binance provided in response to a Russian Investigative Committee request to prove the transfers. (meduza.io)
Today's best Hacker News stories, summarized and screenshotted, one email a day.