CVE 101: The Unfolding Of A Zero Day Attack
summary
Explains how CVE IDs and CVSS scores work, shows timelines for Log4Shell and recent OpenSSL errors, and gives hard numbers: 30 days used to be average time to exploit now it’s minutes, only ~25% of orgs publicly report fixes and ~10% become CVEs, average Java project has ~150 dependencies with ~10 releases/year, 96% of known vulns have fixes but ~60% of developers still pull vulnerable versions. Demonstrates tool classes: static analysis, software composition analysis, and vendor tools like OSS Index and the Sonatype safety rating/BOM doctor.
AI-written summary · about
chapters (14)
- 0:00CVE 101 introduction
- 1:28Vulnerability threat and risk
- 4:21What are CVEs
- 7:14CVE controversies and limits
- 10:43Disclosure: private vs public
- 14:59Zero day explained with examples
- 19:15Vulnerability remediation challenges
- 21:51CWEs and OWASP Top 10
- 24:02Dependency management and supply chain
- 27:36Static analysis for dependencies
- 29:02Maven Central security tools
- 33:59Future security for Java projects
- 34:20Recap and call to action
- 35:54Q&A
related talks
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
44mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
15mKeynote
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards