Stackurity v0.13.7

Added

• Exploit prediction (FIRST EPSS) in priorities. A daily feed, epss:first, downloads FIRST's EPSS scores for every CVE (one bulk file from epss.empiricalsecurity.com, about 3 MB; STACKURITY_EPSS_URL for a mirror) and stores each CVE's probability of exploitation in the next 30 days, its percentile, the model version and the score date (migration 0056_epss). The risk policy gets an EPSS factor: epss points (1.5 by default) while a finding's CVE is at or above epss_threshold (10% by default), not for CVEs already in CISA KEV, and never more than the known-exploited points. So that daily movement does not churn priorities and alerts, the factor is all or nothing, its text names the threshold rather than the day's score, and a finding that crossed the threshold keeps it until its EPSS falls below 80% of it. Priorities read the scores directly every minute; nothing is re-evaluated when the file changes. Measured on 130,000 open findings and 400,000 scores, the prioritisation pass that runs every minute took about 4.7 s with or without EPSS (reading and scoring 0.8 s against 0.6 s), and three days of small score changes rewrote only findings that crossed the threshold (TestPrioritizeEPSSPerformance). See Predicted exploitation (EPSS).
• Findings carry epss, epss_percentile, epss_date and epss_model_version; GET /findings filters by epss_min (0 to 1). All issues has an EPSS column and an Exploit prediction (EPSS) filter, Settings → Risk policy the EPSS points and threshold, and Why this priority on the finding page, GET /findings/{id}/explain (risk.epss, why.epss) and the AI assistants' explain_finding say what EPSS predicts for the CVE and why it counts or not. list_findings takes epss_min and returns epss.
• Windows missing updates. Windows 10, 11 and Server 2016, 2019, 2022 and 2025 hosts are now checked for operating system vulnerabilities, not only end of life: the build and update revision the agent already reports (10.0.20348.4171) are compared with the fixed builds Microsoft publishes in its Security Update Guide, with no agent change. Each missing CVE is a finding naming the update that fixes it (KB, fixed build, link), with KEV and EPSS applied as for any finding; the action plan has one fix per host, Install Windows update KB…, the newest cumulative update among its findings, which fixes all of them. Fixes that come only with paid Extended Security Updates after a release's end of life are labelled and go to the release upgrade. The new feed msrc:Windows reads the last 24 months of monthly documents (STACKURITY_MSRC_MONTHS) from api.msrc.microsoft.com (STACKURITY_MSRC_URL for a mirror), checks for changes every 6 hours so a Patch Tuesday release is read the same evening, and rereads everything every 30 days. Hotpatched hosts (Azure Edition, hotpatch builds), Windows Server 2012 R2 and older (paid Extended Security Updates), .NET Framework, Office and servicing stack updates are not evaluated, and say so in the host's coverage and under Settings → Coverage gaps. Migration 0058_windows_updates. See Windows missing updates.
• Email preferences for bulk email (hosted installations; Stackurity Cloud turns them on). Product updates (Marketing) and Vulnerability news are the only email people can unsubscribe from: Your account → Email preferences has a switch for each and lists what is always sent (account and security, billing, the organisation's own notifications) and why. Every such email carries one-click unsubscribe headers (List-Unsubscribe, List-Unsubscribe-Post, RFC 8058), an unsubscribe link and an Email preferences link that work without signing in (signed for one person; an unsubscribe link only turns its own category off), and the sender's postal address. They are sent through one path that checks each recipient's choice just before their email goes, waits between emails, and records each recipient before sending, so a retry never sends twice. stackurity admin email-suppress unsubscribes an address on its owner's request. New endpoints GET/PUT /api/v1/auth/email-preferences, POST /api/v1/email/preferences, POST /api/v1/email/preferences/update and POST /email/preferences/one-click (migration 0057_email_preferences). See Email preferences.
• Stackurity Cloud: product emails. The sign-up form says that product updates and vulnerability news will follow and that people can unsubscribe at any time, and which wording was shown is recorded with each sign-up. A "what changed" email per release, built from this changelog, can be previewed, tested on an instance administrator and, once switched on, sent to subscribers. Nothing is sent to customers until the operator switches it on.
• Stackurity Cloud's sign-up page shows a refused email address (a disposable mail service, or a domain that takes no email) at the email field, with a link to contact us.

Changed

• Prioritisation writes in chunks. Every pass, including one that rewrites every open finding (a changed risk policy, such as the first pass after this upgrade), writes 1,000 findings per transaction instead of all of them in one, so it no longer holds a row lock on every open finding until it ends: evaluations, workflow actions and API writes wait for one chunk at most. A pass interrupted part way keeps the chunks it wrote, and the next pass, a minute later, finishes the rest without rewriting them. A chunk writes a finding only if it is still open and unchanged since the pass read it, so a finding resolved during a long pass keeps the priority it closed with, and an evaluation's fresher priority is not overwritten with one scored from older evidence; a finding changed meanwhile is scored by the next pass. Measured on 130,000 open findings (TestPrioritizeRewritePerformance, on a loaded machine): the rewrite was one transaction of 42 to 50 s, during which a workflow action on a finding waited up to 48 s; it is now 130 transactions of at most 0.63 s, and the longest wait was 0.25 s.
• An email the mail server accepted is no longer reported as failed (and sent again) when the connection drops while saying goodbye (QUIT) afterwards.

Upgrading

• Migration 0056_epss creates the epss_scores table and allows the new feed kind prediction; it rewrites nothing. The risk policy gains epss and epss_threshold with their defaults (a saved policy whose known_exploited is below 1.5 gets that value for epss), so its version changes once and the first prioritisation after the upgrade records the new version on every open finding. That pass writes in chunks of 1,000 findings, each its own short transaction, not in one transaction over every open finding (about 65,000 on a large installation). EPSS starts counting after the first epss:first sync, within minutes of the start; set epss to 0 in the risk policy to leave it out.
• Migration 0057_email_preferences only creates four new tables (email preferences, suppressions, campaigns and their recipients); it changes no existing rows.
• Windows hosts now get vulnerability findings and a new feed, msrc:Windows, which downloads about 140 MB from api.msrc.microsoft.com on its first sync (see network.md); disable it under Intelligence, or mirror it for air-gapped servers.