PatchDayAlert
Subscribe →

Free · Wednesday mornings

The weekly digest. Straight to your inbox.

Written for sysadmins. Not security researchers. Not CISOs. You: the person who just got 12 CISA tickets assigned with zero context and is expected to triage them by lunch.

One issue, every Wednesday. The week Microsoft ships Patch Tuesday, it's in the same issue.

New subscribers get the CVE triage cheat sheet, a printable one-pager for triaging fresh CVEs, in the welcome email.

What you get

  1. 01

    Plain-English CVE summaries

    If you can't read a CVE writeup cold and know what to do, the digest is for you. No CVSS jargon dumps.

  2. 02

    Patch urgency in one line

    Patch today, patch this week, or safe to skip. Every entry. No ambiguity about what the ticket needs.

  3. 03

    Exploited-in-the-wild front and center

    CISA KEV catches things NVD-severity alone misses. Anything actively exploited gets flagged before anything else.

  4. 04

    Rare alerts when it can't wait

    Most weeks, Wednesday is soon enough. When something is actively exploited and a fix exists, you get a separate heads-up. Only when it matters, never for filler.

Latest sample issue

Jul 30, 2026 · Subject: ClickHouse RCE (9.1) + 3 PCP flaws worth checking

ClickHouse SQLi hits 9.1, PCP ships four bugs including a root privesc chain

No zero-days today, but don't sleepwalk through this one. A CVSS 9.1 SQL injection in ClickHouse Server lets a remote attacker get code execution with minimal effort, and three separate PCP bugs chain together in ugly ways if your metrics infrastructure is exposed. None are exploited in the wild yet, so you've got time to be deliberate, but not to ignore them.

One item / urgency verdict

Patch this week

CVE-2026-16524

An attacker who can set the network.persocket.filter metric in PCP's linux_sockets PMDA can inject shell commands that run as the PMDA user whenever metrics refresh.

Update PCP to the latest patched release from your distro's package manager, or disable the linux_sockets PMDA until a fix is available.

Read the full issue Browse archive