About the presenter
Sunny Burns
Founder, SB Sentinel
Presented by Sunny Burns · SB Sentinel Breach Watch
Sunny Burns is the founder of SB Sentinel and the person who runs the alert desk. The work is straightforward to describe and demanding to keep up: every morning she reads the public record — national advisories, vendor disclosures, regulatory filings and named reporting — and decides what is worth your attention.
Nothing reaches these pages without a person having read it. Each item is checked against its source, labelled with a confidence tag, and given an attribution qualifier that stays exactly as the source stated it. Where the record does not say something — who was behind an incident, how many people were affected, what a company has not yet confirmed — the entry says so rather than filling the gap.
The desk also publishes its own limits, which is unusual in this field and deliberate. SB Sentinel reads public disclosures. It cannot see inside your accounts, it cannot detect a breach, and a quiet week is not evidence that you are safe. Saying that plainly is what makes the rest of the record worth trusting.
Ahead of the wire means published earlier than the typical news cycle. It never means unverified, and it never means first to know.
Recent briefings
- 14 Oct 2026 — Ivanti Connect Secure and Windows Shell updates added to the exploited list
- 8 Oct 2026 — Five updates pass their federal deadline
- 4 Oct 2026 — Citrix NetScaler flaw under active exploitation
- 2 Oct 2026 — Zammad pair chains to full administrative control
- 1 Oct 2026 — Fortinet FortiMail arbitrary file write
- 30 Sep 2026 — Cisco SD-WAN reachable without signing in
- 29 Sep 2026 — Apple CoreGraphics flaw across iOS, macOS and iPadOS
- 27 Sep 2026 — Two Citrix NetScaler flaws exploited before a patch existed
Frequently asked questions
Can you tell me if my own accounts have been hacked?
No. We read the public record — advisories, vendor disclosures and filings. We cannot see inside anyone's accounts and we do not monitor yours. If you believe an account is compromised, contact your bank or the provider directly rather than waiting for a disclosure.
What is the difference between Confirmed and Reported?
Confirmed means an official body or the company itself has stated it — an agency catalogue, a vendor advisory, a regulatory filing. Reported means a named outlet is reporting it. Both are published. Unverified and Claimed items are shown on the site as claims but never sent out as alerts.
Where does the information come from?
National advisories, vendor security advisories, regulatory filings, and named-outlet reporting. Every item on the site carries its source and the date, so you can check it yourself.
Why do you publish what you cannot do?
Because a limit you state yourself is one a reader can trust. A service that claims to see everything cannot be checked. Ours can.
How often do briefings go out?
The desk is reviewed every morning at 07:00 Mountain Time, with the email digest following shortly after. Alerts go out only when something qualifying has actually been disclosed — never on a schedule just to fill the space.
Can I reach you with a question or a correction?
Yes. Corrections and questions go to the address listed on the site's About page. If we publish something wrong, we want it fixed.