Security advisories in plain English
What the problem is, who should care and what to do about it. Written for small and medium businesses everywhere. Summaries a Securelyn engineer has not reviewed yet are labelled.
At a glance
10
Advisories on the site
2
Of them in the CISA Known Exploited catalogue
10
Published in the last 7 days
82,445
CVEs published in 2026 (January to October 2026)
8,314
Ransomware claims in 2026 so far (January to October 2026)
1,500
Organisations named by ransomware groups in 2026 in the latest list
83
Data breaches that happened in 2026 (Have I Been Pwned)
Latest advisories
All advisories-
- KEV status not in our sample
- EPSS not in our sample
React Server Components remote code execution (CVE-2025-55182, React2Shell)
CVE-2025-55182, widely called React2Shell, is a critical remote code execution vulnerability in React Server Components.
-
- Known exploited (CISA KEV)
- CVSS 7.7 High
- EPSS low (0.012)
nginx resolver off-by-one (CVE-2021-23017)
A security issue in the nginx resolver allows an off-by-one error. The CISA catalogue sample lists it as an off-by-one in the nginx resolver, and the required action is to apply updates per vendor…
-
- KEV status not in our sample
- EPSS not in our sample
PHP (CVE-2024-4577)
CVE-2024-4577 is a published vulnerability record for PHP. This draft does not describe the flaw yet. A Securelyn engineer adds the verified description, affected versions and fixed release from the…
Everything in one place
CVE tracker
Every CVE published this year, ranked by severity, active exploitation and likelihood of attack.
Ransomware activity
Monthly trends, active groups, industries and countries, as counts, with the steps that blunt these attacks.
Data breaches
Who had customer details exposed, how many people were affected and what to do about it.
Glossary
CVE, CVSS, KEV, EPSS and other terms in plain English.
Breach statistics
Yearly breach figures, each with its source, and what to do if it happens to you.
Plain-English advisories
What the problem is, who should care and what to do, written automatically from the sources and reviewed by a Securelyn engineer when they can. Unreviewed ones are labelled.
How it works
We watch the sources
CISA KEV, FIRST EPSS and the NVD are checked for new flaws and for signs attackers are using them.
We write it up automatically
Each advisory is written from the sources. A Securelyn engineer reviews it against the vendor page when they can, and ones not yet reviewed are labelled.
You get the action
Each advisory ends with what to do. The digest sends the top three, with one action for each.
The fortnightly digest
An email about every two weeks with the top three security issues for small and medium businesses everywhere and one action for each. You confirm your address first, and every email has a one-click unsubscribe.