Elsewhere, a separate section not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence Research or story?

CVE-2015-5477: ISC BIND

old flaw, newly listed. server app. Rungs reached: 1, 3, 5 of 8. Part of Pulse, a separate section not about PHP.

Why Pulse tracks it: KEV catalog 2026.10.21: an old flaw newly listed on 8 October 2026. Evidence of exploitation now, not a new flaw.

The evidence of exploitation, rung by rung

1. A public proof of concept: reached 2015-08-01

  • Pulse's own check
    NVD lists references tagged "Exploit" (listed, not fetched)
    capture pulse: raw/us/registry/nvd/cve-2015-5477/20261024T055307Z/text.txt, 24 October 2026, 05:53 UTC, sha256 cc106a47bc6b63e0 original
  • Pulse's own check 2015-08-01
    Exploit-DB search lists 2 entries for the CVE
    capture pulse: raw/us/weaponisation/exploit-db/cve-2015-5477/20261022T221133Z/text.txt, 22 October 2026, 22:11 UTC, sha256 9bb1fa58797e9d42 original

2. A nuclei template that exploits rather than only fingerprints: not checked

not checked: every source for this rung was blocked or has not been fetched yet

3. A merged Metasploit module: reached

  • Pulse's own check
    In the Metasploit module index (master)
    capture pulse: raw/us/weaponisation/metasploit/modules-metadata/20261022T221133Z/text.txt, 22 October 2026, 22:11 UTC, sha256 2f68e2134c3c0104 original

4. Exploitation attempts reported by a named party: not reached

last checked 24 October 2026, 05:53 UTC

5. A KEV listing (the date added): reached 2026-10-08

  • Pulse's own check 2026-10-08
    KEV catalog 2026.10.23
    capture pulse: raw/us/registry/cisa-kev/kev-json/20261024T055307Z/text.txt, 24 October 2026, 05:53 UTC, sha256 c2c53427f552e3cf original

6. knownRansomwareCampaignUse: Known on KEV: not reached

last checked 24 October 2026, 05:53 UTC

7. A national CERT reporting compromises in its country: not reached

last checked 24 October 2026, 05:53 UTC

8. A named organisation saying it was compromised through that flaw: not checked

a victim's own statement is recorded by hand from a capture; none recorded

Measurements

The attention it gets

11 news items since 2026-09-24T06:09:45Z, counted over 53 of 137 feeds, in 19 languages and 29 countries; 0 front pages, 0 agency alerts, 0 pages advising taking systems offline.

Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count

Pulse vault 4klm5qlt, head c27972b6de6f, last pass 24 October 2026, 05:53 UTC.