Sources and method

Source priority

Version numbers, fixed releases, affected conditions and interim controls come from the project or vendor that owns the software. Government and CERT advisories are used for action guidance and exploitation context. Original research explains mechanism and laboratory reproduction. Media reporting supplies timeline and context and is followed back to its primary source. Social posts are discovery leads, not a basis for a key conclusion.

What “read” means

• Full text read: the document was opened and the cited fact was checked in the text.
• Excerpt read: a specific section was read, not the whole document.
• Metadata only: title, publisher, date and link were used; the body was not treated as evidence.
• Not read: the source could not be accessed. It is retained with the failure note.

Time boundaries

Article publication time and event time are separate. A media report published on 22 October about a patch released on 21 October produces an event dated 21 October and a source dated 22 October. When a source gives only a date, the site displays only a date. When official pages disagree about a time, the site records the date and states the conflict rather than choosing a number.

Static-site boundary

This is a static publication. It does not update itself. New content requires a source refresh, a validation pass and a new build. A build does not change the content update time, and a failed refresh does not remove the last successful snapshot.

Known access limits

• The CISA KEV HTML catalog returned 403 to automated requests; the official JSON feed was used.
• The media feed is used for candidate discovery only. Article bodies are not stored or republished.
• Some official pages do not publish a modification time; the source record says so.
• Research cut-off is 23 October 2026, 15:45 UTC. Events after that time are not covered until the next refresh and review.