I stopped reading security news and started reading bulletins — the difference showed up in week one

I put CERT-FR's weekly bulletin next to US security journalism. One explains the incident, the other hands me my queue. Plus the US patching mandate that quietly changed this year.

Bu yazının Türkçesi: Türkçe sürüm.

Security in a one-person studio is an odd job. There is no security team, but the surface that needs defending does not shrink to match the headcount: a server, code hosting, store accounts, a long dependency tree — all of it looking at the same person. The responsibility exists; the hours do not.

For a long time I thought I was handling it by reading security news. Then I asked myself a plain question: of the dozens of articles I read last month, how many turned into an action? The answer was embarrassing. Almost none.

So I changed the format rather than the effort. What follows is a comparison of the two, because the difference is not about content — it is about shape, and shape decides whether anything gets done.

What a bulletin looks like

France's national CERT publishes a weekly bulletin d'actualité. The one dated 31 August 2026, CERTFR-2026-ACT-037, covers 24–30 August. There is no narrative in it. There is this:

The most valuable column is not CVSS. It is the last one. "Exploited" pushes the 10.0 Metabase row below the 9.8 Gitea row. A score measures theoretical worst case; that column measures reality.

The first time I read one of these I stopped at a line naming a class of tool I actually use, and ten seconds later I was looking up a version number. No headline had produced that reaction in months.

Four doors, four levels of urgency

CERT-FR confused me at first, because it is not one feed but four publication types with different urgency built in:

• Alerte — active exploitation or imminent danger. Rare, and worth dropping things for.
• Avis — per-version lists of affected products, for matching against your inventory.
• Bulletin d'actualité — the weekly digest; the table above comes from one.
• CTI — threat intelligence reports, including the annual threat panorama.

That split is itself an advantage over a news feed. Urgency is encoded in the publication type rather than left to the reader. In a feed every headline renders at the same size; here the difference between "alerte" and "bulletin" sorts my queue before I have read a word.

What news looks like

News does a different job, and does it well. A good incident analysis — say, the hour-by-hour breakdown of August's npm supply chain compromise — gives you why: how the attacker thought, which mechanism worked, what is structurally broken. That is genuinely valuable; I wrote my last post by comparing exactly those kinds of sources.

But news has one property worth naming: it is not written as if it were about you. "Critical flaw in PaperCut" is trivia to someone who does not run PaperCut and an alarm to someone who does, and the headline does not distinguish them. It delegates that sorting to the reader, and across forty headlines a week nobody does the sorting.

Why not raw CVE feeds

The obvious objection: if tables are good, subscribe to a CVE feed directly. I tried. I lasted three days. The raw feed produces hundreds of records a day, and none of them answer "is this being exploited" or "how many real installations does it touch". Scoring does not rescue it either — CVSS describes a product's theoretical worst case, not your deployment.

The value a bulletin adds is not the list, it is the filtering. A human sat with that week's several hundred records and picked seven, weighted by deployment reality and evidence of exploitation. I cannot do that filtering myself; I have neither the time nor the visibility. That is precisely the work the bulletin is doing.

The thing that quietly changed in the US

The institutional equivalent in the US is CISA's KEV catalog — known exploited vulnerabilities. If you track it, something significant changed this year without much discussion.

For years the mandate behind KEV was BOD 22-01, with a simple rule: six months for CVEs assigned before 2021, two weeks for everything else. That directive was revoked on 10 June 2026 and replaced by BOD 26-04, "Prioritizing Security Updates Based on Risk".

The new model prices risk instead of age. As reflected in current catalog entries: records requiring forensic triage carry roughly a 3-day deadline, the rest 14 days. The old two-week floor survived, but a much sharper tier now sits above it. And where no mitigation exists, the guidance is blunt: stop using the product.

None of this binds me — it is a directive for US federal agencies. But the tiering idea is useful without being binding: once a vulnerability carries the "exploited" label, urgency replaces the calendar.

The weekly rota I ended up with

I compressed both into a 20-minute routine, same day each week:

1. Read the CERT-FR bulletin top to bottom, marking only the "exploited" rows.
2. Check new KEV additions — same logic, different source; the two do not fully overlap.
3. Intersect with your own inventory — whatever you run: server packages, code hosting, CI, reverse proxy, package dependencies. No match, and it ends here in three minutes.
4. If something matches, patch it that day, or write down why not. An unwritten deferral is a forgotten one.

I did not stop reading news. I moved it. News is now a context source, not a decision source. Sitting down once a month with a few good analyses teaches me more, in less time, than scrolling forty headlines.

What the bulletin cannot give you

To be fair to the other side: the format has a price. It explains nothing. The CERT-FR table showed me the row, but not how that class of flaw works or whether something similar is hiding in my own code. If you want to understand a vulnerability, a bulletin has nothing for you.

Which is why they are not competitors. The bulletin answers "what do I do this week"; the news answers "what should I learn so I stop shipping this class of bug". My mistake was spending years asking the second source the first question.

← All posts