About Threat Pulse

A live picture of the AI-era cyber threat wave: scored, sourced, updated around the clock.

Threat Pulse turns the flood of security news into one number, one top item and a timeline anyone can read on a phone. It is published by Buy Low Sell High Club (Kansas City) and run by Data Whisperer LLC. It is not affiliated with any company, agency or person named on these pages.

It is a live, curated overview, not a complete list of every incident. It aims to catch what most people and small businesses should know about: exploited flaws, big breaches, outages and the vendor security releases worth installing (Chrome, Firefox, Apple, Microsoft, Oracle and the big network vendors). Smaller incidents, regional stories and routine patch notes may be missing or late. If something important is missing, use Add a threat below; for the full firehose, see Where else to watch.

How the index is scored

Each event gets a severity 0 to 10 from a rubric: impact (0 to 4), how easy it is to exploit (0 to 3), whether a critical sector is hit (0 to 2), plus one point while it is still open.
Heat is severity squared over ten, discounted by confidence (confirmed 1.0, reported 0.6, rumor 0) and, for the live index, by status (active or unknown 1.0, mitigated 0.8, patched 0.6, resolved 0.3).
The ratio reading compares the last 7 days of heat with the 90 days before. While our own baseline is thin it uses the published-CVE flow instead, a complete public series (NVD).
The absolute reading adds 10 points per open severity 8+ item in the last 7 days. The index is the higher of the two, 0 to 100, in five bands.
Theories and statements are shown but never move the index. Rumors never lead. Long views (10 and 50 years) show landmark events only, because the past is sampled and this month is not.

What runs on its own

Every ten minutes a job pulls a few of the free sources below (CISA KEV, national CERT feeds, Have I Been Pwned, the security press, Bing News searches, the AI labs' own posts). A government or CERT source can open an event on its own. A vendor's own security release (Chrome, Mozilla, Apple, Oracle, Cisco, Fortinet, Palo Alto Networks, Zero Day Initiative) can too when it is serious enough; routine ones wait for the daily review. Items more than two weeks old never open a new event, and repeat stories about the same company join the first one. A press story opens a candidate that goes public only when a second independent outlet reports it or a person approves it. Social posts only ever run on the raw wire. Nothing here calls a paid model.

Sources and attribution

Anthropic news (via Google News) (press): Anthropic, found through Google News (headline and link only)
Ars Technica security (press): Ars Technica (headline and link only)
Bing News: data breach (press): Bing News (headline and link to the publisher)
Bing News: cyberattack (press): Bing News (headline and link to the publisher)
Bing News: ransomware (press): Bing News (headline and link to the publisher)
BleepingComputer (press): BleepingComputer (headline and link only)
Cloudflare blog (press): Cloudflare (headline and link only)
CyberScoop (press): CyberScoop (headline and link only)
Dark Reading (press): Dark Reading (headline and link only)
DataBreaches.net (press): DataBreaches.net (headline and link only)
Exploit-DB, new exploits (press): Exploit Database by OffSec (title and link only)
Google Threat Intelligence blog (press): Google Threat Intelligence (headline and link only)
Help Net Security (press): Help Net Security (headline and link only)
Krebs on Security (press): Krebs on Security (headline and link only)
Malwarebytes Labs (press): Malwarebytes Labs (headline and link only)
METR (press): METR (headline and link only)
Microsoft Security Response Center blog (press): Microsoft MSRC (headline and link only)
OpenAI news (press): OpenAI (headline and link only)
Google Project Zero (press): Google Project Zero (headline and link only)
SANS Internet Storm Center (press): SANS Internet Storm Center (headline and link only)
Schneier on Security (press): Bruce Schneier (headline and link only)
SecurityWeek (press): SecurityWeek (headline and link only)
The Hacker News (press): The Hacker News (headline and link only)
The Record (press): The Record by Recorded Future News (headline and link only)
Palo Alto Unit 42 (press): Unit 42 (headline and link only)
Wiz research blog (press): Wiz (headline and link only)
Australian Cyber Security Centre alerts (via Google News) (primary): Australian Signals Directorate ACSC, found through Google News (headline and link only)
Apple security releases (via Google News) (primary): Apple, found through Google News (headline and link only)
Canadian Centre for Cyber Security (primary): Canadian Centre for Cyber Security
CERT-EU advisories (primary): CERT-EU
CERT-FR (primary): CERT-FR (ANSSI)
Chrome stable desktop releases (primary): Google Chrome Releases (version, fix counts and link)
CISA advisories and alerts (primary): CISA (public domain) last error: http 403
CISA Known Exploited Vulnerabilities (primary): CISA KEV catalog (public domain)
Cisco security advisories (primary): Cisco PSIRT (title and link only)
Fortinet PSIRT advisories (primary): Fortinet PSIRT (title and link only)
Have I Been Pwned, latest breach (primary): Breach data from Have I Been Pwned
JPCERT/CC (primary): JPCERT/CC
Mozilla security advisories (via Google News) (primary): Mozilla, found through Google News (headline and link only)
UK NCSC (primary): UK National Cyber Security Centre (Open Government Licence)
Oracle Critical Patch Updates (via Google News) (primary): Found through Google News (headline and link only)
Palo Alto Networks security advisories (primary): Palo Alto Networks PSIRT (title and link only)
Zero Day Initiative, published advisories (primary): Trend Micro Zero Day Initiative (title and link only) last error: The operation was aborted due to timeout
Bluesky author feed (example, off) (social): Bluesky public posts (author named, linked) paused
infosec.exchange public timeline (social): infosec.exchange public posts (author named, linked)
ransomware.live recent victims (social): Paused on purpose: the ransomware.live API terms are non-commercial. Linked under Where else to watch instead paused

More places worth watching beside this board, from the CISA list to CVE trackers and ransomware leak-site trackers: Where else to watch.

Series: NVD CVE counts by year and month; CISA Known Exploited Vulnerabilities; ITRC US data compromise reports; ransomware leak-site victim counts; monthly_series.cisa_kev_added; monthly_series.cve_published; ITRC US data compromise reports. Milestone dates use the public disclosure or first-observed date, so some incidents that began earlier (Heartland 2008 breach, Marriott 2014 intrusion, Yahoo 2013 and 2014 breaches, Salesloft Drift Aug 8 to 18 window) are plotted at disclosure. date_precision is 'month' or 'year' where only that is known. Severity is a hand-scored composite (impact 0-4, exploitability 0-3, critical sector 0-2, unresolved at peak +1, capped at 10), not a CVSS value. Locations are best-effort origin or main impact points; internet-wide events are placed at 0,0 'Global'. Dollar and record figures are the most-cited public estimates and vary by source; attacker-claimed figures (Canvas 275 million users, Charter, Stryker device counts) are marked as claims in the impact text. Several 2026 incidents are still under investigation (FBI surveillance system, FortiBleed, IDScan.net, Ledger implants, PHP2Shell) and are marked resolved=false; later facts may change them. The eMudhra, Laravel, PHP2Shell, LiteLLM and banks-versus-agents items were verified from October 2026 press coverage; PHP2Shell CVEs were not yet in the KEV feed as of catalogVersion 2026.10.23. cve_published counts come from the NVD API by NVD publication date and are higher than cvelistV5-based counts (for example 49,972 vs 48,185 for 2025) because NVD publication timing differs and rejected records are included; 2026 (88,584 through Oct 24) reflects the 2026 surge in AI-assisted vulnerability discovery and should be labelled year to date. us_data_compromises splices three ITRC vintages: 2005 to 2014 'breaches' from the 2019 multi-year chart, 2015 to 2020 'compromises' from the 2021 report, and ITRC's own later revisions for 2021 to 2023 (1,860; 1,801; 3,202), so year-over-year comparisons across 2014/2015 carry a methodology break. ransomware_leak_site_victims uses ransomware.live, whose 2020 coverage (247) is partial because the tracker began mid-2020 and other trackers count more; 2025 figures differ by vendor (ransomware.live 8,146, Emsisoft 8,000+, GuidePoint GRIT 7,515). 2026 values in every series are year to date as of 2026-10-24. ai_related_security_events is omitted because no sourced annual count of AI-related security incidents was found; filter milestones on ai_related=true instead.

Report a threat or ask for a correction

Tap Add a threat anywhere on the page and paste a link (an advisory, an article or an X post) with a line on why it matters. A person reads every submission before anything shows. For corrections or takedowns write to threatpulse@buylowsellhigh.club; we fix or remove the same day.

Badge for your site

A live badge that links back here: [![Threat Pulse](https://buylowsellhigh.club/threat-pulse/badge.svg)](https://buylowsellhigh.club/threat-pulse)

Not legal, financial or security advice. Every item links to its source; severities are our reading of public reports and can be wrong. Index 62 (High) as of Nov 5, 01:42 UTC.

Updated Nov 5, 01:42 UTC. Refreshes on its own.