Prompt Injection Explained: How Attackers Manipulate AI Applications
Prompt injection has topped OWASP's LLM Top 10 for two consecutive editions, for a structural reason: instructions and data flow through the same …
All articles
Every FirewallSync article, newest first.
Linux Kernel CVE Records: Read Stable-Branch Affected Ranges
Every Linux kernel CVE record carries two product entries: git commit ranges and kernel version ranges. We read all 7,987 kernel CNA records published …
EPSS Scores for KEV CVEs: Why New Entries Score Low
An EPSS cutoff of 0.1 misses a quarter of CISA's KEV catalog today, and half of the entries added in the last 90 days. We tracked 113 KEV additions …
What Is Workload Identity and Why Should You Stop Using Static Cloud Keys?
A static cloud key stored on a server is a credential that works until someone remembers to rotate it. Workload identity replaces that with a …
EPSS v5: How Scores Shifted and What to Re-baseline
EPSS v5 (model v2026.06.15) replaced v4 in the daily feed on June 15, 2026. We diffed the last v4 file against the first v5 file: 26% fewer CVEs at or …
OpenVEX Products and Subcomponents: purl Matching Rules
An OpenVEX statement suppresses a finding only when its products, subcomponents and purls line up with what the scanner found. Here is how the go-vex …
Non-Human Identities: The Security Problem Behind Service Accounts and AI Agents
Most identity security programs were designed around human users logging in. Service accounts, API keys, and now AI agents don't fit that model, and …
CVE packageURL: Join CVE JSON 5.2 Records to SBOM purls
CVE Record Format 5.2.0 added an optional packageURL field to affected entries. We counted it across all 400,445 published records: 1.6% carry one, 12 …
CSAF VEX product_tree: Resolve Product IDs to SBOM purls
A CSAF VEX file never puts a purl next to a status. Product IDs in product_status point into the product_tree, often through relationships. Here is …
How to Audit Unused Cloud Accounts, Roles, and Service Identities
An unused identity with live credentials is functionally identical to a vulnerability sitting unpatched — nobody's using it, but it still works …
WordPress CVE-2026-119977: Patch the Upgrade Race RCE
CISA added CVE-2026-119977 to the KEV catalog on 3 November 2026. In WordPress 4.7 through 7.1.3, a full-package core update stages a copy of …
CVE cpeApplicability: CPE Match Nodes, Operators, Ranges
Since CVE Record Format 5.1.1, a CNA can put CPE Applicability Language statements in a cpeApplicability block. Here is how nodes, operator, negate, …