Most zero-days come from surveillance vendors. NVD database issues. US sanctions Chinese state-sponsored hackers.

2023 saw a sharp increase in zero-days compared to 2022, but didn't beat the record of 2021. Most interesting though is the fact that over half of all zero-days have been attributed to so-called "commercial surveillance vendors" aka CSV's, like the NSO group. There's a short list of other such companies that Google calls out in the article. Booming business, clearly.

The National Vulnerability Database (NVD) is the central database where detailed information on vulnerabilities is analysed and offered for free. It's where CVE numbers come from, essentially, and a whole lot of security vendors rely on this information. I used it myself for several projects.

Lately, however, the NVD has mostly stopped adding new information, and nobody really knows why. The article explains some of the background on this, but we still don't know much. It seems to boil down to increased workload and stagnant budget, as I read it, which is understandable. The amount of CVE's has ballooned over the last few years, I always wondered how the NVD managed to keep up. I guess they can't anymore.

In order to fix the problems though, the head of the NVD wants to create a "consortium" of partners to tackle the issues as a group. This has led to criticism however, since adding more layers is not often the answer to productivity issues. To be continued.

The sanctioned individuals work for a company that is believed to be a front for APT31, a state-sponsored hacking group backed by the PRC. They've been prolific in their attacks on critical infrastructure and against the US government.

Interesting read on the fragmentation of US military cybersecurity forces.

I don't think most developers realise how valuable 1Password can be. It doesn't just hold passwords, it also hold your SSH keys, signs your Git commits, injects tokens and other secrets in CLI scripts, and much more. Worth checking out. (Sponsored)