About VulnLens

A weekly read on notable security vulnerabilities — and the incentives of the people who create and use them. A Last Myle Engineering research product.

The two halves

The tracker. Each week, 3–5 notable vulnerabilities, curated. Selection bar: exploited in the wild, novel technique, or major vendor response. Not exhaustive — NVD is exhaustive. Each entry says what it is, why it matters, and its exploitation status.

The Incentive Dimension. The part you won't find in a standard advisory: who creates and exercises vulnerabilities, and what actually moves them. State programs. Organized crime. Hacktivists. The researcher economy. Coerced labor in scam compounds. The themes rotate weekly — exploit economics, state programs, coercion and labor, attacker psychology, defense economics — so over time the report builds a picture of the incentive landscape, not just incident coverage.

How it works

Every Thursday at 14:00 UTC, an automated research agent scans the week: CISA KEV additions, vendor advisories, and exploitation reporting — then researches the incentive context for the lead story from court documents, indictments, industry reports, and academic studies. Every factual claim cites a source. Uncertainty is labeled in the report, not hidden: each issue carries a "What we don't know" section covering attribution gaps and estimate-quality numbers.

Integrity rules

  1. Every factual claim cites a source — no exceptions.
  2. Psychological claims cite the actual study and state its limits.
  3. Attribution and motive only as far as official sources support.
  4. Coerced-labor topics covered factually via documented cases (UNODC, indictments) — never sensationalized.
  5. No exploit code; no PoC links beyond what vendors publish.
  6. Analytical, never operational.

The project

VulnLens is published by Last Myle Engineering, which researches the full AI-compute lifecycle — from land to inference. This report applies the same method to security: understand the actors, their incentives, and the system they move in. The machine-readable version of each report is at data/latest.json in the source repo.

Not security advice.

← Back to this week's report