Daily Brief
Standards & corrections
How the Daily Brief sources, checks and corrects what it publishes.
Sources
Every item links to its primary source: the vendor, researcher, agency or court that found, fixed or published the information. On story pages, news reports are labeled Reporting.
We summarize and link to the original advisories and reporting. We don’t republish articles.
Accuracy
We don’t publish CVE IDs, indicators or claims we can’t trace to a source.
Indicators of compromise are shown defanged, like 203.0.113[.]7, and are never linked.
Before an edition publishes, its CVE IDs are checked against the CVE List, and its In KEV labels against CISA’s catalog.
Review
Every edition is reviewed and edited by the editor before it publishes. If an edition can’t be reviewed, it doesn’t publish.
Labels
Items can carry these labels.
- Attacks confirmed
- Attacks seen in the wild, with no software flaw involved.
- Exploited
- Attackers are using the flaw, per a cited source.
- In KEV
- Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Public exploit
- Exploit code is public; no attacks reported.
Added to KEV
Every CVE that CISA added to its Known Exploited Vulnerabilities catalog during the period an edition covers is listed in that edition’s Added to KEV section, with the date CISA set for federal agencies to act by. Additions in widely used enterprise products also get a short write-up and a story page, unless the flaw is more than a year old and no new attacks are reported. A flaw CISA added is listed only there, not in another section as well.
Order
Items aren’t ranked. Added to KEV runs A to Z by product, the other news sections by vendor, and Worth reading by publisher.
Updates and corrections
Updates add new information, with a timestamp.
Corrections fix errors with a dated note. We never fix an error silently.
Report an error
Email address for corrections: coming before launch.