If you're a one-person IT department, you probably felt it this month. According to Krebs on Security, Microsoft's September Patch Tuesday shipped fixes for nearly 1,000 vulnerabilities — a record 974 CVEs in a single release. A separate report confirms the damage: two of those flaws are already being actively exploited, and 58 more are flagged as likely targets soon. That's not a patch cycle. That's a flood.
Enterprises have entire teams dedicated to triaging that volume. Small businesses have you — and maybe a part-time MSP contact. The good news is that you don't need a six-figure threat intel platform to keep up. You need the right free and low-cost tools, used consistently, so you're never the last to know about a vulnerability that's actively being exploited in the wild.
Why 'Patch When You Notice' No Longer Works
The PaperCut incident from this month is the clearest illustration of why reactive patching fails small businesses. According to The Hacker News, PaperCut — a print management tool common in small office environments — had to replace its own emergency patches after two flaws were found being actively exploited. Then it got worse: a follow-up report from The Hacker News revealed that an attacker used hundreds of coordinated AI agents to compromise more than 440 PaperCut instances before most admins even knew a patch existed.
That speed isn't an outlier anymore. As Schneier on Security points out, AI is compressing the timeline between vulnerability disclosure and active exploitation from weeks down to days or hours. A similar pattern played out with JFrog Artifactory, a tool many small dev shops rely on for build pipelines — according to The Hacker News, attackers chained already-patched flaws to gain admin control on servers where the patch simply hadn't been applied yet. Not because the fix wasn't available — because nobody was watching for it. We've covered this exact failure pattern in our breakdown of zero-day exploits vs. unpatched vulnerabilities.
5 Tools to Track Vulnerabilities Without a Security Team
1. CISA's Known Exploited Vulnerabilities (KEV) Catalog (Free) This is the single highest-signal, lowest-noise resource available. Instead of tracking every CVE, KEV only lists vulnerabilities confirmed to be actively exploited — meaning if something's on this list, it's not theoretical. This month's entry is a good example: The Hacker News reported CISA flagging exploited Cisco, Citrix, and Fortinet flaws, including a CVSS 10.0 vulnerability with a 48-hour federal patch deadline. Subscribe to KEV's RSS feed and check it weekly at minimum.
2. Vendor Security Advisory Mailing Lists (Free) Microsoft MSRC, Cisco PSIRT, Fortinet PSIRT, Citrix, and yes, PaperCut all publish direct advisory feeds. If a tool touches your network, subscribe to its advisory list. This is how you'd have heard about the PaperCut emergency patch the day it dropped instead of after 440 servers were already compromised.
3. NVD / CVE.org RSS Feeds (Free) The National Vulnerability Database and CVE.org both offer free, filterable feeds. You won't read all 974 entries from a single Patch Tuesday, but you can filter by vendor or product to surface only what's relevant to your actual stack.
4. OSV.dev and GitHub Dependabot Alerts (Free) If your business writes or maintains any custom software, open-source dependency vulnerabilities are a blind spot most owners don't think about until it's too late — the JFrog Artifactory incident above is a perfect example. OSV.dev and Dependabot both scan your dependency tree and alert you automatically when a library you use gets a new CVE.
5. A Recurring External Vulnerability Scan (Low-Cost) Advisory feeds tell you what could be a problem. A scan tells you what is a problem on your actual network. This is the layer most small businesses skip because dedicated scanning tools are priced for enterprises. That's the gap Oscar Six Security's Radar was built to close — a $99 scan that checks your external attack surface against current CVEs, including the kind of print servers and remote tools that keep showing up in these headlines. For a deeper look at how scanning fits alongside advisory monitoring, see our comparison of vulnerability scanning vs. penetration testing.
Turning Alerts Into a Habit, Not a Panic
Tools only help if you build a rhythm around them. Set a recurring 15-minute block — weekly, not monthly — to check KEV, skim your vendor advisory inboxes, and review any Dependabot alerts. If you manage print servers, remote access tools, or firewalls, treat those advisories as priority reading; they're the categories showing up repeatedly in 2026's exploit reports. If your stack includes print infrastructure specifically, our print server zero-day emergency response playbook walks through what to do the moment an advisory like PaperCut's lands in your inbox.
The volume of CVEs isn't going down. If anything, 974 in a single month is the new normal, and AI-accelerated attackers are only going to get faster at weaponizing them. The businesses that avoid becoming a headline aren't the ones with the biggest budgets — they're the ones with the tightest feedback loop between 'a patch exists' and 'we applied it.'
Take Action
Advisory feeds and free tools tell you what's out there. A scan tells you what's actually exposed on your network right now — before an attacker's AI agent finds it first. Oscar Six Security's Radar gives you an affordable, $99 external vulnerability scan so you're not relying on luck between Patch Tuesdays. Check out our Solutions page to get started. Focus Forward. We've Got Your Six.