The inventory, hour by hour: fixed, vulnerable, still under investigation

How to read it

• Vulnerable mostly means inherited. 184 of the 222 vulnerable rows are applications the inventory marks affected when deployed on an affected web-serving PHP runtime. Their fix is patching PHP underneath them, not a release from their maker, so they stay vulnerable in the list whatever the server does. That is why only 10 row moved from vulnerable to fixed.
• Fixes came from the people who ship PHP. Operating systems, container images, platforms and hosting panels: the 109 fixed rows are almost all runtimes, recorded from 15:30 UTC on 21 October.
• The investigation pile grew while it shrank. 217 rows were resolved to vulnerable and 64 to fixed, and 82 new rows arrived under investigation.
• The boxes in front run PHP too. Vulnerable: Check Point firewall web interfaces (Check Point), Cisco Expressway Select Series (Cisco), Cisco Expressway Series (Cisco), Cisco Ultra-Reliable Wireless Backhaul (URWB) (Cisco), Citrix NetScaler ADC and Citrix NetScaler Gateway (Citrix / NetScaler), BIG-IP APM PHP page templates (F5), BIG-IP TMOS platform PHP (F5), PAN-OS (Palo Alto Networks), Panorama (Palo Alto Networks), MyUTM portal (Sophos). Under investigation: Cisco (10), Fortinet (5), Juniper Networks (1).

Every change of status

Between consecutive commits, per row. A row added already fixed counts as added.

What kind of rows they are

Read from each row's own CVE assessment line by 11 rules, applied in order; the rules are in admin/build/inventory_history.py and in the data. The words matched are the inventory's; the grouping is this site's.

When each supplier was first recorded fixed

The time the inventory recorded the fix, not the time the supplier shipped it.

Where this comes from

a git clone; every count is from software/software_list_*.md at the commit named. Commits are content-addressed: anyone with a clone can check every number here against the commit named. The self-check: at cca173c64ec5 this parser agrees with data/software.json on all 674 rows the vault exported, status for status; it also finds 1 row the vault missed: iBabs / iBabs bestuursportaal (Not vuln). That one row is a correction to this site's earlier counts, on corrections. The vault holds the inventory at one commit; the history is not yet captured into it (board).