Field Manual
Security in plain English
Listen up. Security news is written in code words. This manual decodes them.
The basics
The words on every bulletin.
-
CVE
A CVE is a public ID for one specific security flaw, so everyone knows they are talking about the same bug.
-
CVSS
CVSS is a 0 to 10 score for how severe a security flaw is, not how likely it is to hit you.
-
Patch and advisory
An advisory tells you what is broken and which versions are hit. A patch is the fix.
Under attack
What it means when the shooting starts.
-
CISA KEV
The KEV catalog is the US government list of security flaws with reliable evidence of real attacks.
-
Exploited in the wild
Exploited in the wild means attackers are using a flaw on real targets, not just researchers in a lab.
-
Zero-day
A zero-day is a flaw that gets attacked while it is still unknown, so defenders had no warning.
-
Indicators of compromise
Indicators of compromise are the tracks an attacker leaves behind, like a rogue account, file or domain.
-
RCE and privilege escalation
RCE lets an attacker run their code on your system. Privilege escalation gets them more power once inside.
AI agent threats
What your coding agent reads, installs and runs.
-
Supply chain attack
A supply chain attack reaches you through something you already trust, like a package, extension or update.
-
Prompt injection
Prompt injection is when text an AI reads tricks it into following an attacker instead of you.
-
MCP server
An MCP server plugs outside tools and data into an AI agent, and those tools can do real things.
No term matches "". Try a shorter word, or show every term.
Life of a bug
How a flaw travels from discovery to your patch queue.
-
1. Flaw found
Someone spots a security flaw in a product.
-
2. CVE assigned
A CVE Numbering Authority gives it an ID, so everyone means the same bug.
-
3. Advisory
The official notice: what is broken and which versions are hit.
-
4. Patch
The update that repairs the flaw. Attackers read advisories too.
-
5. Exploited, added to CISA KEV
Attackers hit real targets. With reliable evidence and a clear fix, it goes on the list.
-
6. You patch
Move to the fixed version, then check for signs of compromise.
Real bugs do not always march in this order. A zero-day is attacked before any fix exists, and plenty of bugs never reach step 5.
CVSS severity scale
What the numbers mean. It rates how bad a flaw is, not how likely it is to hit you.
- None
- 0.0
- Low
- 0.1 to 3.9
- Medium
- 4.0 to 6.9
- High
- 7.0 to 8.9
- Critical
- 9.0 to 10.0
Agents and scripts can read /learn.md, /learn.json or /llms-full.txt.