How Zero Radar works
Zero Radar collects new security flaws, attacks and leaks from 40 sources, merges reports about the same issue into one entry and explains it in plain words. It runs continuously: each source is checked on its own schedule, and the site updates within seconds of new information.
From first report to entry
- Watch. Every source is polled on its own interval, the fastest every minute. Unchanged feeds cost almost nothing, so we can ask often.
- Merge. Reports that name the same CVE are joined. Reports without a CVE are compared by an AI model and merged when they describe the same incident. Two different CVEs are never merged.
- Explain. For important entries an AI model writes the plain-language text, the attack diagram and the steps, using only the collected sources. Versions, dates and exploitation come from the sources themselves.
- Keep watching. Entries stay open for 30 days. When a source reports attacks or a patched version later, the entry changes right away and the timeline shows when.
How sure is an entry?
No report is thrown away, but each one is labelled by how well it is backed:
| Official source | At least one vendor, CERT or advisory database reports it. |
| Several sources | Two or more independent publishers report it. Overlap makes false alarms unlikely. |
| Single report | One researcher or newsroom so far. Probably real, but details may change. |
| Unverified | Only community posts. Shown so you hear early, ranked lower until someone confirms it. |
“Exploited in the wild” needs an official source such as CISA KEV or the vendor. If only researchers or the press report attacks, the entry says “attacks reported”.
Trust levels
| Official | Vendors, government CERTs and advisory databases. Their word on exploitation and fixes counts as confirmed. |
| Researchers | Security research teams and disclosure mailing lists. Often first, usually right. |
| Press | Established security newsrooms. Good for context, counted as a report, not as confirmation. |
| Community | Discussion sites. Used as an early hint only; never enough on its own to say “exploited”. |
Databases
| Source | What it adds | Checked every |
|---|---|---|
| GitHub Advisory Database | reviewed advisories with affected and fixed package versions | 1 min |
| NVD (NIST) | every new CVE, CVSS scores, patch links | 5 min |
| CISA KEV | official list of flaws known to be exploited | 5 min |
| OSV | fixed versions that appear after the first report | 15 min |
| FIRST EPSS | probability of exploitation in the next 30 days | 6 h |
| Have I Been Pwned | verified data breaches | 30 min |
| Hacker News | early signals, only with 25+ points | 3 min |
Feeds
| Source | Trust | Checked every |
|---|---|---|
| PHP | Official | 2 min |
| GitLab | Official | 2 min |
| Node.js | Official | 2 min |
| oss-security | Researchers | 2 min |
| BleepingComputer | Press | 2 min |
| The Hacker News | Press | 2 min |
| SecurityWeek | Press | 3 min |
| Google Chrome | Official | 5 min |
| Microsoft MSRC | Official | 5 min |
| WordPress | Official | 5 min |
| Kubernetes | Official | 5 min |
| Django | Official | 5 min |
| Python | Official | 5 min |
| GitHub Security Blog | Official | 5 min |
| Cisco PSIRT | Official | 5 min |
| Fortinet PSIRT | Official | 5 min |
| Palo Alto Networks | Official | 5 min |
| Debian Security | Official | 5 min |
| Ubuntu Security | Official | 5 min |
| CISA | Official | 5 min |
| CERT-Bund (BSI) | Official | 5 min |
| Full Disclosure | Researchers | 5 min |
| Socket | Researchers | 5 min |
| The Record | Press | 5 min |
| Dark Reading | Press | 5 min |
| DataBreaches.net | Press | 5 min |
| r/netsec | Community | 5 min |
| Rust | Official | 10 min |
| Jenkins | Official | 10 min |
| CERT-EU | Official | 10 min |
| NCSC UK | Official | 10 min |
| watchTowr Labs | Researchers | 10 min |
| Wiz Research | Researchers | 10 min |
What Zero Radar does not do
- It only reports issues that are already public. It never publishes undisclosed vulnerabilities or exploit code.
- AI text can be wrong. Every entry links its sources. Check the official advisory before you change production systems.
- Entries older than about 30 days drop off. For history use NVD or the GitHub Advisory Database.
Code and pipeline are open source on GitHub. To get entries in your tools, see Integrate.