Research area · Threat Intelligence
Putting vulnerabilities and threats in context — before the window closes
Vami Research puts new vulnerabilities and incidents in context promptly — with threat briefings that name affected versions, attack paths, and immediate actions. Prioritization is based on CVSS, EPSS, and CISA's KEV catalog. Dark web monitoring, attack detection, MDR, and resilience exercises close the gap between signal and action.
- Threat briefings
- CVSS · EPSS · KEV
- Dark Web Monitoring
- SIEM · EDR · NDR
- MDR
- Cyber resilience
- CACS methodology
- Deep Dives
- 7
- Whitepapers
- 0
- Solutions
- 1
More vulnerabilities, shorter response windows
According to the BSI's 2025 report on the state of IT security in Germany, an average of 119 new vulnerabilities per day became known between July 2024 and June 2025; exploitation attacks measured at BSI honeypots rose by 38 percent. A BSI IT security information bulletin rates the impact of AI development at criticality 2 (“yellow”): AI lowers the effort, time, and entry barriers for offensive capabilities. At these volumes, patching everything immediately is not a strategy.
For flaws that have become public, our role is prompt analysis and contextualization. The PHP2Shell flaws were disclosed by Wiz Research, Calif, OpenAI, and the PHP project on October 21, 2026; our threat briefing appeared the same day. A threat briefing on Brotli2Shell followed on October 27, 2026, and an analysis of the tampered Claude Code extension in the Cursor marketplace on October 31, 2026 — each with affected versions, verification steps, and concrete immediate actions.
This research area connects these threat briefings with day-to-day operations: risk-based vulnerability management, external attack surface management, dark web monitoring, attack detection with SIEM, EDR, and NDR, deception, MDR, and business continuity management in line with BSI Standard 200-4 and ISO 22301. For grid operators in the electricity sector, there is also the classification of cyberattacks using the CACS methodology.
Open questions in practice
- 01
Which vulnerability do you close first when more than a hundred new ones become known every day?
Our approach
We prioritize with three signals: CVSS 4.0 for technical severity, EPSS for the probability of exploitation within the next 30 days, and CISA's KEV catalog for proven exploitation. KEV-listed findings on reachable systems come first. We tier deadlines by risk, for example following the model of CISA directive BOD 26-04; for zero-days without a patch, compensating measures such as virtual patching come into play.
- 02
How does the announcement of a critical flaw become a plan that operations teams can implement right away?
Our approach
Our threat briefings on PHP2Shell and Brotli2Shell name the root cause, fixed versions, attack paths, and a 7-point plan, plus an exposure check. For Brotli2Shell, the plan works from the outside in: make visible where Brotli is decompressed, reject Brotli-encoded requests at the WAF or proxy, patch exposed services first, request reports from suppliers, document everything, and check reporting obligations.
- 03
Which signals from the underground and the external attack surface provide early warning instead of alert noise?
Our approach
Both need triage. We verify dark web hits and prioritize them by account type and exposed service; this is followed by password resets, terminated sessions, an MFA check, and the search for the source of the leak. EASM findings are attributed, validated, and prioritized by exposure, exploitability, and business criticality. The yardstick is the time until an effective measure is in place, not the number of hits.
- 04
What changes for detection and response when AI and agents accelerate attacks?
Our approach
Our basic stance is assume breach: patched zero-days are considered exploited until proven otherwise. We build detection as an engineering discipline — Sigma rules, coverage against MITRE ATT&CK, and SIEM, EDR, and NDR working together. We treat agentic systems with tools and APIs as attack targets in their own right; in defense, we use AI as a complement, never as a replacement.
Key takeaways
- 01
CVSS, EPSS, and KEV answer three different questions
Anyone who patches by CVSS base score alone treats many flaws as urgent that are never exploited and overlooks actively attacked ones with medium scores. CVSS measures severity, EPSS the probability of exploitation, and KEV shows whether exploitation is already demonstrably taking place. Only together, and applied to reachable systems, do they produce a risk-based order.
Source: Vulnerability Management
- 02
In the ongoing 2026 CVE cohort, around ten hours remain on average until exploitation
According to Zero Day Clock data retrieved on July 29, 2026, the mean time to first confirmed exploitation fell from 2.3 years in the 2018 CVE cohort to around ten hours in the ongoing 2026 cohort — a partial year with 97 confirmed cases. Classic vulnerability management remains necessary but needs continuous testing as a complement.
Source: Zero-Day-Monitoring
- 03
With Brotli2Shell, AI agents with web tools are at risk too
Brotli2Shell does not only affect servers that decompress incoming requests. Services that automatically decompress responses from third-party servers are also vulnerable — including webhooks, crawlers, and AI agents that fetch user-selected URLs. A WAF does not see this direction and therefore does not replace the patch.
Source: Brotli2Shell (CVE-2026-111497): What organizations need to know about Node2Shell and HTTP2Shell now
- 04
Leaked credentials often precede ransomware
According to the Verizon Data Breach Investigations Report 2026, 73 percent of the ransomware victims examined had an infostealer or credential-leak event in the year before the attack, half of them within 95 days. Those who detect and verify such hits early can break the attack chain at its first link.
Source: Dark Web Monitoring
How we work
Vami Research connects external signals with the state of your environment: What is known, what can be reached in your systems, what is already being exploited — and who has to report it, and when?
Prioritization with three signals
CVSS 4.0 for severity, EPSS for the probability of exploitation, CISA KEV for proven exploitation — weighted by reachability from the internet.
Threat briefing format
Root cause, affected and fixed versions, attack paths, action plan, and reporting obligations — dated, with sources and an exposure check.
External attack surface
EASM from DNS, Certificate Transparency logs, and scan data; Vamiset adds a read-only inventory across cloud and code plus the external scan, currently without AI features.
Managed zero-day monitoring
From the outside, VamiSec deploys VamiRedteam with three AI agents within the authorized scope; close to the code, VamiAppSec monitors the SBOM of every release for actively exploited vulnerabilities.
Detection engineering
Sigma rules, coverage against MITRE ATT&CK, and SIEM, EDR, and NDR working together; use cases as a portfolio with a lifecycle, calibrated against alert fatigue.
CACS classification
Classify cyberattacks in the electricity sector on the ENTSO-E scale: cause, potential impact, and severity along the ATT&CK kill chain.
How to get started
- 1Make visibleCapture assets, the external attack surface, and log sources; continuously evaluate advisories from vendors, CERT-Bund, and the KEV catalog.
- 2Put in contextCheck exposure, prioritize with CVSS, EPSS, and KEV, and record the threat briefing with date and sources.
- 3Act and reportPatch or compensate, update detection, and check reporting obligations under NIS2, the GDPR, DORA, and the Cyber Resilience Act.
Deep dives, whitepapers, and analyses
Deep Dives 7
Analyses & news
- October 27, 2026Brotli2Shell (CVE-2026-111497): What organizations need to know about Node2Shell and HTTP2Shell now
- October 31, 2026Claude Code extension tampered with in the Cursor marketplace: what developer teams need to know about the SSH backdoor
- October 21, 2026PHP2Shell (CVE-2026-109618, CVE-2026-109619): critical flaws in the PHP core allow code execution without authentication (opens external website)
From research area to implementation
Related research areas
A threat briefing for your environment?
We check whether you are affected, prioritize with CVSS, EPSS, and KEV, and support the implementation. If you suspect a compromise, you can reach our CSIRT around the clock at csirt@vamisec.com.