Patrick Garrity

He tracks canary hits, notes when a flaw enters VulnCheck's known-exploited catalog and whether CISA's has caught up, and points readers to a free alert signup for new exploitation evidence. He also keeps confirmed activity separate from rumor: one post reporting a batch of remediation work mentions, as unconfirmed chatter, possible additional Citrix NetScaler zero-days.

A Node-RED canary caught in-the-wild exploitation of CVE-2026-58115, an unauthenticated admin API flaw.

• Node-RED is widely used for workflow automation in ICS/OT environments and embedded in commercial products, including Siemens SIMATIC IoT2050, the product the CVE was assigned against.
• The detection write-up was published October 27 and the first in-the-wild attempt hit the canary three days later, with continued activity from the same source.

Read original · Original 2 · Original 3

Garrity describes the aim as a more complete view of a vulnerability covering prioritization, mitigation, detection and testing, plus exploitation activity and internet exposure, and VulnCheck's releases pair each exploit with detection artifacts rather than a bare proof of concept.

The PHP2Shell post states the position directly: there is a lot more than a CVE record for enterprises to consider when understanding their exposure, and the record is a jumping-off point.

Read original · Original 2

The stated reason is that organizations which know what they run patch fastest.

Writing on a Friday night while fixes were still arriving from many vendors for PHP2Shell, Brotli and eMudhra certificates, Garrity singled out software that patching pipelines often miss when installed or bundled by hand: PHP on Windows, Node.js, .NET, Java, PowerShell 7, Visual Studio, Git for Windows and container images.

Read original · Original 2 · Original 3

VulnCheck's Initial Access Intelligence Community is described as a free, open collection of VulnCheck-authored exploits and detection artifacts published on GitHub and available through the VulnCheck API, with new items every Monday. Cadence is part of the argument: a predictable release rhythm is something a security team can build a routine around.

The launch post announced 40 exploits and detection artifacts, and another post that month counts 26 exploits with detection artifacts released by the initial access team in a single week.

Read original · Original 2

His posts separate what is affected from what is not, and credit the researcher who surfaced the finding rather than presenting it as his own.

A post confirms that the Anthropic Claude Code extension from the Cursor marketplace was compromised: version 2.1.313 carried a malicious 66-line loader inserted ahead of the legitimate extension code, while the @anthropic-ai/claude-code npm package, the OpenVSX extension and the Microsoft VS Code Claude extension were not affected.

• The finding is credited to Paul McCarty.
• Another post tracks a run of Anthropic Glasswing CVEs that all appear to concern one project, Bouncy Castle.

Read original · Original 2

A guest's views are the guest's, not his; these posts establish who took part and what a session was about, not what was argued in it.

He hosted Spencer McIntyre, VulnCheck's Director of Exploit Development, on the show In the Wild to discuss building an exploit for PHP2Shell. He also moderated a coordinated vulnerability disclosure panel at THREATCON1 with Shelby Cunningham, Caitlin Condon and Tod Beardsley, and recorded a THREATCON1 podcast episode with Johnny Shaieb on the history of vulnerability databases.

Read original · Original 2 · Original 3

This is the clearest single example of Garrity's detection-first way of working, and it is short enough to read in a minute.

Garrity reports that a Node-RED canary caught in-the-wild exploitation of CVE-2026-58115, an unauthenticated admin API flaw.

• Node-RED is widely used for workflow automation in industrial control environments and is embedded in commercial products, including Siemens SIMATIC IoT2050, the product the CVE was assigned against.
• The detection was published on October 27 and the first in-the-wild attempt hit the canary three days later, with continued activity from the same source.
• The flaw was added to VulnCheck's known-exploited catalog but had not yet reached CISA's.
• The post ends with concrete steps: check whether Node-RED is reachable from outside the network, apply updates, and add detections.

For brands planning a campaign

A concrete timeline like this anchors a webinar segment on watching for exploitation before patches are universal, and it shows the kind of primary evidence Garrity brings to a session.

Useful for anyone deciding how to talk about risk when no patch exists.

Garrity describes exploitation starting on Thursday across Rejetto HFS hosts through one CVE, then, within days, more exploitation on HFS2 canaries through a different CVE in an entirely different code base.

• The post quotes the HFS2 project's own site warning that version 2.x is vulnerable with no known fix and that users should consider HFS 3 instead.
• Garrity calls the two sets of observations 'receipts' that both code bases are being used in the wild, and points readers to a free alert signup for new exploitation evidence.

For brands planning a campaign

This is the strongest example for a segment on end-of-life software and unpatched infrastructure, where the recommendation is migration or mitigation rather than a patch deadline.

The structure of the post — what is malicious, what is not — is a model of making a fast-moving incident usable.

Garrity reports that Cursor confirmed the Anthropic Claude Code extension from its marketplace was compromised.

• A malicious version, 2.1.313, was published on October 29, 2026, identifying itself normally but carrying a malicious 66-line loader inserted ahead of the legitimate extension code.
• The post separates the affected marketplace extension from versions that are not malicious: the npm package, the OpenVSX extension, and the Microsoft VS Code extension.
• Garrity credits another researcher, Paul McCarty, for the work.

For brands planning a campaign

Supports a webinar angle on risks carried by AI developer tooling and package marketplaces, a topic that reaches beyond the security team.

Start here if you want Garrity's practical, non-alarmist operating advice.

Writing on a Friday night, Garrity notes that fixes were still arriving from many vendors for PHP2Shell and Brotli and that patching would continue.

• Garrity relays Microsoft guidance covering those issues and eMudhra certificates, then distills it: turn on automatic patching where possible, set recurring maintenance windows that can absorb out-of-band critical fixes, design workloads so restarts are routine, and keep an inventory of the open-source components in your software.
• Anything patched manually or bundled by the organization — PHP on Windows, Node.js, .NET, Java, PowerShell 7, Visual Studio, Git for Windows, container images — needs deliberate attention.

For brands planning a campaign

Gives a webinar a practical takeaway list about patch velocity and software inventory, which pairs well with the exploitation timelines in other posts.

This is the clearest statement of the principle behind much of Garrity's other work.

Garrity argues that enterprises have much more to consider than the CVE record when understanding their exposure, calling that record a starting point.

• The post describes VulnCheck's aim as a more complete view of a vulnerability, spanning prioritization, mitigation, detection, testing, exploitation activity, and internet exposure, and links to a write-up on PHP2Shell.
• It is a short post that states a position rather than walking through a technical case.

For brands planning a campaign

Frames the central argument for a session on beyond-the-CVE intelligence, and gives the partner vendor a natural place to show what their own data adds.

Useful for readers who want to test rather than just read.

Garrity announces an expansion of VulnCheck's Community Intelligence with an Initial Access Intelligence Community, described as a free, open collection of VulnCheck-authored exploits and detection artifacts published on GitHub and available through the VulnCheck API.

• The launch included 40 exploits and detection artifacts, with new ones promised every Monday.
• A separate post the same month mentions 26 exploits released in a single week alongside detection artifacts, which gives a sense of the cadence.

For brands planning a campaign

A recurring public release schedule is an easy hook for a recurring webinar or a standing co-branded series rather than a one-off event.

Start here to see Garrity hosting and drawing out technical detail.

Garrity describes hosting Spencer McIntyre, Director of Exploit Development at VulnCheck, along with kimber D., on a discussion show called In the Wild, covering the team's development of an exploit for PHP2Shell.

• The post is brief and points to a full YouTube recording; the conversation itself is not included in the available evidence, so the detail of what was said cannot be assessed.
• What the post does show is Garrity appearing alongside exploit developers in a conversational format rather than only posting updates.

For brands planning a campaign

The clearest available evidence that Garrity can carry a technical conversation on camera, which matters for a co-branded live session.

Relevant if the campaign involves a panel format.

Garrity writes about moderating a panel on coordinated vulnerability disclosure with Shelby Cunningham, Caitlin Condon, and Tod Beardsley at the THREATCON1 event, and says the video would be released later.

• The post is short and social in tone; it names the panelists and the event without describing the arguments made.
• It sits alongside other posts about the same event, including a podcast episode recorded with Johnny Shaieb on the history of vulnerability databases.

For brands planning a campaign

Supports a moderated or multi-guest webinar format, with the caveat that the recorded discussion is not part of the available evidence.

A Node-RED canary caught in-the-wild exploitation of CVE-2026-58115, an unauthenticated admin API flaw in a tool widely used for ICS/OT workflow automation and embedded in commercial products including Siemens SIMATIC IoT2050; the first attempt hit the canary three days after the detection write-up.

• Separate posts track Rejetto HFS exploitation via CVE-2026-61500 and, on a different codebase, HFS2 via CVE-2026-97359, and a weekly batch of 26 exploits with detection artifacts from the VulnCheck initial access team.
• Garrity notes when a CVE lands in VulnCheck's KEV catalog and whether CISA's KEV has caught up, and links free alert signups for new exploitation evidence.

Detection canaries plus exploitation telemetry, with CVE-to-KEV tracking and free email/API alerts.

For brands planning a campaign

A co-branded webinar can be framed around lived exploitation evidence and the gap between a published CVE and confirmed attacks, which is a more concrete hook than generic zero-day commentary.

Examples: Source 1 · Source 2 · Source 3

Posts note that fixes for PHP2Shell, Brotli and eMudhra certificates were still in flight across many vendors, then summarize Microsoft guidance: turn on automatic patching, set maintenance windows frequent enough to absorb out-of-band critical fixes, design workloads so restarts are routine rather than disruptive, and keep an inventory of the open-source components in your software. Manual and self-bundled software gets called out explicitly, including PHP on Windows, Node.js, .NET, Java, PowerShell 7, Visual Studio, Git for Windows and container images.

Checklist-style takeaways drawn from vendor guidance, aimed at teams that know what they run.

For brands planning a campaign

Supports a joint operational playbook or checklist asset that a vendor can hand out during or after a session.

Examples: Source 1 · Source 2 · Source 3

Garrity describes VulnCheck's aim as a more complete view of a vulnerability that goes beyond the record, covering prioritization, mitigation, detection and testing, plus exploitation activity and internet exposure. The same framing appears in the community release posts, where each published exploit comes with detection artifacts rather than a bare proof of concept.

Positioning research output around the decisions a defender has to make after reading a CVE.

For brands planning a campaign

A strong webinar spine: what enterprises still need once they have the CVE, and how detection and prioritization fit together.

Examples: Source 1 · Source 2

A post confirms that the Anthropic Claude Code extension from the Cursor marketplace was compromised, naming version 2.1.313 and a malicious 66-line loader inserted ahead of the legitimate extension code, and carefully separates what is affected from what is not: the @anthropic-ai/claude-code NPM package, the OpenVSX extension and the Microsoft VS Code extension for Claude. Another post tracks a run of Anthropic Glasswing CVEs, all apparently against one project, Bouncy Castle.

Source-attribution and clean-versus-affected breakdowns, with credit to the researcher who surfaced the Cursor finding.

The Cursor marketplace finding is credited to Paul McCarty rather than presented as Garrity's own discovery.

For brands planning a campaign

Gives a vendor a current, credible AI-supply-chain angle that reaches developer audiences as well as security teams.

Examples: Source 1 · Source 2

Garrity announced expansion of Community Intelligence with the Initial Access Intelligence Community, a free, open collection of VulnCheck-authored exploits and detection artifacts published on GitHub and available through the VulnCheck API, launching with 40 artifacts and new ones every Monday. Related posts point to an In the Wild episode with Spencer McIntyre, VulnCheck's Director of Exploit Development, discussing the team's work on a PHP2Shell exploit.

Recurring public release cadence paired with podcast discussion of how the exploits were built.

For brands planning a campaign

A partner can co-market around reusable, inspectable artifacts and a recurring release schedule rather than a one-off webinar.

Examples: Source 1 · Source 2 · Source 3

Posts also point readers to the In the Wild show and encourage registration for the Reston, VA event, and reference plans to be at THREATCON1 in person.

Moderated panels, podcast interviews and event promotion.

For brands planning a campaign

Signals comfort with live and recorded formats, useful if the proposed session is a panel or an interview rather than a scripted presentation.

Examples: Source 1 · Source 2 · Source 3 · Source 4

The posts show Garrity working from inside VulnCheck's threat-intelligence research, community intelligence releases, and event and podcast programming, including the In the Wild conversation with Spencer McIntyre; they do not state a job title, contract terms, or start date.

View example

Taylor's posts are full profiles of ransomware operations — the group Microsoft tracks as Storm-2697, and BLACKNET-00 — weighing public claims against what the tools can actually do and covering negotiation, extortion and sector targeting. Garrity's posts stay closer to vulnerability exploitation telemetry, catalog tracking and patching discipline, with less on actor economics and victimology.

Read original · Original 2

Ahmed's write-ups are framed around a sandbox vendor and its MTTR pitch, and range into scam-centre disruption and fraud infrastructure; Garrity's are tied to a vulnerability intelligence product and keep to exploitation evidence, release cadence and patch routine.

Read original · Original 2

Both reviewed posts are long-form synthesis: one pulls Microsoft, Check Point, Group-IB, Huntress and Trend Micro reporting into a single profile of a ransomware operation, covering how an intrusion unfolds, six known-exploited CVEs to patch first, a MITRE ATT&CK mapping, IOCs and hunting guidance; the other reverses a sold ransomware sample and pairs the technical finding with seven fixes. If the vendor's asset is a gated report, or a session where the case study is a named crew rather than a single vulnerability, this material is closer to the deliverable than Patrick Garrity's shorter exploitation alerts.

The tradeoff is format and focus.

• The reviewed posts are written analysis; neither shows a panel, recorded conversation or co-presented event, so a live co-branded session is a less evidenced format here.
• The first post is consolidation of other companies' published reporting, so attribution for the underlying research belongs to those sources rather than the creator.
• And the subject is actor profiles and patch lists, not the CVE-to-exploitation timeline Garrity's work shows — which gives a vendor selling vulnerability or detection data less of a natural opening to slot its own feed into the story.

Examples: Source 1 · Source 2

One reviewed post is a complete walkthrough of a Telegram Desktop flaw — severity and CVSS score, affected versions, the inter-process communication mechanism, the relevant CWE, the conditions required for the chain to work, the fix commit and release version, and a numbered list of actions for defenders — structured so a reader can act without leaving the post.

• A second covers an FBI disruption operation and moves from the headline numbers to what defenders are not given.
• For a sponsored one-flaw session or a detection-focused co-branded post, that teach-then-act shape travels well.

The tradeoff is that the second reviewed post is a vendor pitch: it names a sandbox product, claims a specific reduction in mean time to respond, and closes with the same question used in the first post.

• A co-branded campaign would sit beside existing promotional copy, so the vendor would need to agree where its message lands or risk the session reading as another ad.
• The Telegram write-up is also built on a public proof of concept rather than confirmed attacks, which caps how strongly it can be framed as an emerging-threat story.

Examples: Source 1 · Source 2

Both reviewed posts are climate and sustainability work from 2022 — an Accenture COP27 event series covering net-zero finance, Scope 3 supply chains and decarbonisation, and a GEP thought-leadership piece on the ocean freight sector's path to lower emissions. The brief that fits is a sustainability or supply-chain audience, not a vulnerability webinar.

For a zero-day detection campaign there is no tradeoff to weigh: nothing in the reviewed material covers exploitation, vulnerabilities or security operations, and these are the two earliest posts in the set, written years before the October 2026 activity the rest of the record draws on. Adding Dayani to a security vendor's shortlist would be a topical mismatch rather than a reach trade.

Examples: Source 1 · Source 2