Free · No spam · Built by operators, for operators
I monitor NVD, CISA KEV, vendor advisories, and active-exploitation feeds every hour. When something hits production stacks I care about (NGINX, cPanel, WordPress, PHP, MySQL, Redis, Docker, Kubernetes), I cut a short alert with the patch link, a self-check command, and a "should you panic" rating. Pick Telegram for live or email for a weekly digest.
Real-time alerts the moment I push them. You get the patch link, severity, and self-check before most security newsletters even drafted theirs. Best for hosting providers, agencies, and SRE teams running production.
Channel handle: @ping7cve. Don't have Telegram?
Get it here (free, 2 minutes).
One email per week. Every critical CVE I pushed to Telegram that week, plus a short "what to do this week" note. Good if you'd rather batch-process security news than get pinged hourly.
Privacy: your email is stored at Buttondown and nowhere else. Not shared, not sold.
Here's what an actual recent alert looked like in the Telegram channel:
Most security newsletters dump everything. That's noise. Here's the filter I apply before anything makes it into the channel:
If the score is below 7, it's a maintenance item, not an alert.
NGINX, Apache, cPanel, WordPress, PHP, MySQL/MariaDB, Redis, Docker, Kubernetes, OpenSSH, Postfix, Exim. Skip router firmware, niche industrial gear, and vendor-internal tooling.
If there's no fix and no public exploit, alerting just causes anxiety. I wait until at least one of those two things is true.
Anything on the CISA Known Exploited Vulnerabilities catalog jumps the queue and gets a red flag, even at lower CVSS.
The moment a working exploit hits GitHub, the window between "advisory" and "wild exploitation" usually collapses to days.
Before I push, I cross-check the CVE against at least one other source (Patchstack, WPScan, F5, vendor blog). Reduces the false-alarm rate.
Usually 2-4. Some weeks 0 (quiet), occasional weeks 8-10 (cluster disclosures). Telegram gets each one live. Email batches them on Friday.
The alerts are a top-of-funnel for paid services. If you find them useful and one day need someone to actually patch or recover for you, you'll have already seen what we know.
No. NVD publishes hundreds per week. Most don't matter to the average operator. I filter aggressively. If you want the firehose, NVD itself has an RSS feed.
Reply to any alert email or message the Telegram channel admin. If you tell me what you run, I'll keep an eye on it. The current coverage list grew exactly this way.
Yes. Every email has an unsubscribe link. Telegram you just leave the channel.
No. The list lives in Buttondown. No shared lists, no integrations, no resale.
Yes. We offer a paid private alert feed tuned to your exact stack (e.g. only CVEs that affect your specific WordPress plugin set or NGINX modules). $19-79/month. See services.
I track CVEs because I work cases. Ping7's services are recovery, hardening, and incident response for hosting providers and small operators. The same intel that powers the alerts also powers the work. If we miss something or alert on the wrong thing, you'll know within hours because clients are calling.
Recent coverage track record (since April 2026):