A fix is critical if any of these is true: CVSS ≥ 9.0, actively exploited (including a CISA KEV listing), or rated Critical by the vendor.
Impact statuses
Investigating · Confirmed by the vendor · Workaround available (shown for vendor "Mitigated") · Fixed · Patch pulled/rolled back · Not reproduced.
Entry types
Each vendor entry is tagged Critical patch (it meets the critical definition above), Install impact (a confirmed known issue, breakage, regression or rollback after installing), or both.
AI attack status
Confirmed: in-the-wild exploitation is documented by CISA KEV or acknowledged by the affected vendor. Observed (research): seen in the wild by a named security research team (e.g. honeypot or telemetry data) but not yet in KEV or acknowledged by the vendor. Unconfirmed: reported only by community or press sources (e.g. Reddit, X, news) and not yet verified.
Sourcing rules
Every factual claim gets an inline link to a source the writer actually opened and confirmed says it.
Source priority: (1) vendor advisory / GHSA / CVE/NVD / CNA record / fix commit; (2) the original researcher's write-up; (3) reputable security press (e.g. SecurityWeek, BleepingComputer, The Record). Aggregators and auto-generated CVE sites are only for finding leads, never cited alone.
No invented quotes, numbers, or dates. Copy CVSS scores, versions, and dates exactly as published. If two sources disagree, cite both and say they disagree.
If it can't be verified, cut it.
Label analysis. Opinion and implications go under "Why it matters" / "MoonSec take" and carry no source link.
Exploitation claims ("exploited in the wild") need a primary source or CISA KEV. Otherwise write "no known exploitation reported by ".
Sponsorship: sponsored content is always labelled and never affects incident coverage.
Corrections: fix the post, add a dated correction note, and mention it in the next newsletter.