Vulnerability monitoring
We learn about exploited vulnerabilities before you have to
0-day pipeline
How it works
- 01
Feeds come to us, not to a cloud
CISA KEV, the NVD window, the Exploit-DB export and a GitHub PoC search sync into local storage. Customer data never goes to third-party services.
- 02
Matched to your stack
From Server / X-Powered-By banners and the declared stack of each stand we pick only the CVEs that concern your infrastructure, not “every CVE”. Fresh KEV entries and the ransomware flag are marked separately.
- 03
Alert and actions
A new KEV entry with a BOD 22-01 due date or a fresh PoC on GitHub, and you get a digest: what happened, what is at risk, what to do. With CVSS, EPSS and links to PoCs and advisories.
- 04
We fix it ourselves
No need to look for a contractor: the team that found the vulnerability fixes it at a fixed price and re-checks that the hole is closed.
What you get
Two formats
Start with a free check of one domain. If your stack is live and changing, add monitoring.
Express check
freeOne domain you have confirmed
- Safe checks with no payloads: banners, TLS, HSTS, CSP, cookies, version disclosure, .git and .env signatures
- Your infrastructure matched against KEV, NVD, Exploit-DB and the PoC archive
- Prioritised list of candidate CVEs: CVSS, EPSS, ransomware flag
- In plain words: what to close right now and what delay would cost
- An estimate for the fix: we can close what we found ourselves
CASM subscription
from ₽30,000/moContinuous monitoring
- An executive summary for every alert: the risk, what to do, the deadline
- Up to 20 stands, a product list (watch_products) for each
- Alert within 24 hours of a CVE being added to KEV
- Monthly HTML or Markdown digest for the CTO and security lead
- Fixes by our team at a fixed price, followed by a re-check
- Shared chat with your team and short consultations
- Fixed price within the agreed number of stands
Found it, fixed it
Most services send a report and leave you alone with a list of vulnerabilities. We are the same team that fixes what we find.
- Fixed priceAn estimate before work starts, no hourly billing.
- No hand-offsWhoever found it fixes it: no context is lost.
- Re-checkAfter the fix we verify the hole is closed.
In money
What a missed vulnerability costs
A breached site with a customer database is a personal data leak. Fines for a company under Russian law:
Depends on the number of people affected, Art. 13.11(12–14) of the Administrative Code.
For not notifying the regulator of a leak within 24 hours.
At least ₽20M if a leak happens again within a year.
A year of subscription starts at ₽360,000, eight times less than the minimum fine for one leak. Site downtime and ransomware recovery are not included in that.
All 152-FZ fines in 2026How we differ from a typical vendor
Exploited CVEs, not 25,000 a year
We cut the noise with KEV, NVD, EPSS and ransomware flags. The report shows what is being attacked now.
Findings with reasoning
We mark where a manual check is needed. No “everything is bad” without evidence.
The legal frame is built in
We only check stands you have authorised. The list lives in a verified configuration; someone else's domain cannot get there.
Data does not fly off to clouds
Feeds are kept in a local mirror and correlation runs on our side. Reports are not sent to third-party services.
Sample
This is what a digest looks like
A real alert from 27 Oct 2026. On top, an executive summary written by our engineer. Below it, technical details from the export for your administrator. The stand name is replaced.
Alert for your stands · 27 Oct 2026, 06:37 UTC
New KEV entries window: 30 days · New in catalogue in window: 32
- by 29 October, 2 days
The PHP your site runs on has a flaw that is already being used in attacks
CVE-2026-109618 · stand shop-prod
- The risk
- An attacker may take over the server and with it the customer and order database. That is a personal data leak: a fine from ₽3M. Write-ups of the flaw are already public, so attackers see them too.
- What to do
- Update PHP on the server to a fixed version. If that cannot happen at once, apply the vendor's interim mitigation.
We can fix it. We update PHP ourselves in an agreed window and check the site works and both flaws are closed. Fixed price agreed before we start.
Details for the technical team
- CVE
- CVE-2026-109618 - PHP Memory Corruption Vulnerabilitynew in KEV
- Product
- PHP Group PHP · stand shop-prod (stack: nginx, php)
- CVSS / EPSS
- - / - (no NVD data at export time)
- BOD 22-01 due date
- 2026-10-29 · In KEV since 2026-10-26
- CISA recommendation (original)
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
- PoC
- by 29 October, 2 days
A second flaw in the same PHP, fixed by the same update
CVE-2026-109619 · stand shop-prod
- The risk
- The same attack chain as above. Public tools check for both flaws at once.
- What to do
- Nothing beyond the update above. Afterwards we confirm both flaws are closed.
We can fix it. Part of the same update, no extra charge.
Details for the technical team
- CVE
- CVE-2026-109619 - PHP Stale Internal Request-State Vulnerabilitynew in KEV
- Product
- PHP Group PHP · stand shop-prod (stack: nginx, php)
- CVSS / EPSS
- - / - (no NVD data at export time)
- BOD 22-01 due date
- 2026-10-29 · In KEV since 2026-10-26
- CISA recommendation (original)
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
- PoC
- deadline passed in 2024 - check first[RANSOMWARE]
An old PHP vulnerability used by ransomware gangs
CVE-2024-4577 · stand shop-prod
- The risk
- Gangs that encrypt data and demand a ransom use it. The result is site downtime and restoring from backups.
- What to do
- Check the PHP version and how it is run. The match is by product name: if the version is already patched, there is no risk.
We can fix it. We check the version ourselves. If it is vulnerable, we close it with the update above.
Details for the technical team
- CVE
- CVE-2024-4577 - PHP-CGI OS Command Injection Vulnerabilitylong in catalogue
- Product
- PHP Group PHP · stand shop-prod (stack: nginx, php)
- CVSS / EPSS
- - / - (no NVD data at export time)
- BOD 22-01 due date
- 2024-07-03 · In KEV since 2024-06-12
- CISA recommendation (original)
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- deadline passed in 2022 - check first[RANSOMWARE]
A well-known nginx + PHP-FPM vulnerability, also used by ransomware gangs
CVE-2019-11043 · stand shop-prod
- The risk
- With a certain nginx configuration it lets an attacker run code on the server.
- What to do
- Update PHP-FPM and review the nginx configuration. As above, we check the version first.
We can fix it. We review and, if needed, fix the nginx configuration ourselves.
Details for the technical team
- CVE
- CVE-2019-11043 - PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerabilitylong in catalogue
- Product
- PHP FastCGI Process Manager (FPM) · stand shop-prod (stack: nginx, php)
- CVSS / EPSS
- - / - (no NVD data at export time)
- BOD 22-01 due date
- 2022-04-15 · In KEV since 2022-03-25
- CISA recommendation (original)
- Apply updates per vendor instructions.
Boundaries
- The digest lists candidates and priorities, not proof.
- Matching is by product name; versions may differ - check the advisory.
- No exploitation is run: the digest sends no attack requests to the stand.
Free
Check my domain
One domain, safe checks, report within 48 hours. If we find something critical, we attach an estimate for the fix.
Submitting = consent to check this exact domain. These are ordinary HTTP requests, like a user's browser makes. No payloads or exploits. The report arrives within 48 hours.
Who it is for
Web development studio
Dozens of client sites on a similar stack. One CMS CVE and all of them are exposed.
Hosting provider
Learn about an nginx or PHP issue before your customers do and fix it centrally.
E-commerce on a CMS
Payments and customer personal data. The patch deadline is counted in days.
Preparing the open-source CLI for release on GitHub
FAQ
Reports are for information only and are not a guarantee of security.