iiinova — where your digital self keeps evolving

Josh Bressers

@josh.bressers.name

428 followers 476 following 201 posts

Mostly on Mastodon - Open Source Security opensourcesecurity.io - Hacker History hackerhistory.com - He/Him

Posts Replies Media

Josh Bressers @josh.bressers.name · 24/02/2025

Something you might want to filter for in your data is the business models for Wordfence, Patchstack, and WPScan These are wordpress plugin vuln bug bounties that currently account for a MASSIVE amount of the CVE data (and are all web based)

A graph of CVE data from 2025, it shows the top orgs assigning CVE IDS (called CNAs). The wordpress plugin focused CNAs are a gigantic number of IDs

100

Josh Bressers @josh.bressers.name · 01/02/2025

The mascot of 2025 should be the mean little dog thing from Star Trek

030

Josh Bressers @josh.bressers.name · 16/01/2025

Being on the "Top 10 CVE assigners of 2025" list probably isn't something fortinet is very excited about :)

240

Josh Bressers @josh.bressers.name · 22/12/2024

Post your favorite Star Trek character. Wrong answers only

010

Josh Bressers @josh.bressers.name · 10/12/2024

"the what" meme captioned

AMD believes exploiting the disclosed vulnerability requires an attacker either having physical access to the system, operating system kernel access on a system with unlocked memory modules, or installing a customized, malicious BIOS

000

Josh Bressers @josh.bressers.name · 08/12/2024

If the current growth keeps up, we should see more than 40,000 #CVE IDs published in 2024, vs just over 30,000 in 2023

A graph showing the growth of CVE IDs by year, 2021-2024. 2024 is clearly ahead

000

Josh Bressers @josh.bressers.name · 06/12/2024

There was a thread on Mastodon about how many open source projects there are earlier today, so I thought I would also post a graph here to help show how massive it is This is the data Ecosyste.ms tracks. There are over 10 million open source packages across the various ecosystems

A graph of open source packages, It's pretty impressive growth, there are now over 10 million open source packages tracked by Ecosyste.ms

020

Josh Bressers @josh.bressers.name · 27/11/2024

There was a thread over on Mastodon about why XSS was the top CWE this year infosec.exchange/@mttaggart/1... There's a reason for this, it's because there are 3 CNA that are also Wordpress Plugin Bug bounty platforms Wordfence, Patchstack, and WPScan So a few CNAs account for most of the growth

CVE IDs for 2023 and 2024

The two 2024 lines are all CVES (the top line)

and with Wordpress Plugin Bug Bounty CNAs removed (the middle line)

Those bug bounty programs (3 of them) account for a huge amount of CVE growth

020

Josh Bressers @josh.bressers.name · 26/11/2024

The drake yes meme captioned with "Argue with trolls" and "Block the trolls"

000

Josh Bressers @josh.bressers.name · 24/11/2024

000

Josh Bressers @josh.bressers.name · 23/11/2024

Tonight’s project was connecting a #Meshtastic node to a raspberry pi zero using GPIO The 4 pins I needed almost lined up exactly, which was nice Now it’ll run the BBS I’m working on github.com/joshbressers...

A Heltec V3 connected to a raspberry pi zero using GPIO

020

Josh Bressers @josh.bressers.name · 21/11/2024

Time to break this Christmas web comic back out

010

Josh Bressers @josh.bressers.name · 19/11/2024

But there's a secret hidden in that data. The extra growth this year is all the Linux Kernel. Here's the same graph if we remove all the kernel CVE IDs Now it looks like a mostly normal amount of growth (if anything it's down a bit when you compare 2022 to 2023)

A graph of CVEs for 2024, 2023, 2022, and 2021

But the kernel CVE IDs are removed for 2024

110

Josh Bressers @josh.bressers.name · 19/11/2024

One of my armchair hobbies is doing data analysis. Here's what the current CVE graph looks like compared to other years

A graph of CVE data for the years 2024, 2023, 2022, and 2021

110