Words: Jody Williams
A 10/10 vulnerability doesn’t always top Francesco Masala’s to-do list. Ahead of his webinar for GÉANT’s Small Habits. Big Impact campaign, the Eurac Research and unibz security specialist explains how he prioritises instead, and shares the 10-minute security habit he fits in on the bus.
Earlier in his career, when Francesco Masala saw a vulnerability with a severity score of 10, he assumed the worst. Anyone could exploit it, surely, and with ease. “I’d think, ‘Oh wow, that’s really bad.’”
These days, he often hears the same reaction from a friend when they meet for a beer every week or so. “He’ll say, ‘I’ve seen that new vulnerability. It’s a 10. Now I’m a bit anxious.’ And I’ll say, ‘Okay, but think about everything. Don’t just focus on the severity score.’”
Francesco works in the IT department that serves both Eurac Research and the Free University of Bozen-Bolzano (unibz). He spends much of his time on security: vulnerability management, monitoring and incident response. Figuring out which vulnerabilities need addressing first, and why, is part of his everyday work.
Look beyond the severity score
Like most universities and research institutes, unibz and Eurac Research run a wide range of software, from commercial systems to open-source research tools. Any of it could appear in tomorrow’s vulnerability reports. In the first half of 2026 alone, 35,872 vulnerabilities received CVE identifiers, nearly 200 a day. The challenge, especially for a small team, is deciding which ones need attention.
“If you can read all the vulnerability scores, and quickly, you get a much clearer idea of what you’re dealing with. For example, if a new vulnerability comes out for Linux, I know straight away which part of my infrastructure it affects.”
The CVSS severity score is typically the headline number. However, a new vulnerability now comes with several other risk indicators: an exploitation probability (EPSS), the vendor’s own rating, and often a listing in a catalogue of flaws already under attack.
Focus on one score alone, and “you risk overdoing your response, or doing nothing at all when you should act.”
“To get a complete idea of the risk, you have to mash up all the data. I’m not saying you should ignore a vulnerability with a severity of 10 and no exploit or proof of concept. But maybe don’t give it as much attention as an 8 with a public exploit.”
Scores also move. Francesco recalls a recent vulnerability that started with a low severity score, which jumped a few days later after it was examined properly. “Scores change. It happens and it’s fine, but it means you have to keep checking back.”
Dirty Frag: an 8 — or is it?
Dirty Frag is an 8 with a public exploit. The Linux kernel flaw went public in May 2026, when an unrelated third party broke the disclosure embargo. A working exploit came out with the leak, before patches were ready.
The flaw lets anyone logged in to an affected machine become root, yet its severity score rates it High, not Critical. Universities and research institutes run shared Linux systems, from teaching servers to compute clusters, where large numbers of students, staff and researchers hold accounts. In this environment, a flaw that needs “only” an account poses a bigger threat. Francesco would rate it higher.
“I believe the Dirty Frag score should be a bit higher, because someone with access to an account could get inside your machine and become root and then do anything. The exploitation risk is very high, because a lot of bad people try to use this vulnerability.”
After Dirty Frag came out, Francesco recalls, some vendors took a week or more to release updates. Meanwhile, he and his team weighed up the risks and decided what to do, as he will talk through in his webinar.
“I chose Dirty Frag as a worked example because I wanted to talk about the vulnerability and what happens after it’s disclosed. Patches aren’t all released instantly, and information changes.”
Two small habits for staying ahead of vulnerabilities
Security teams can’t control when a vulnerability goes public or when patches arrive, but they can control how fast they find out and how up to date their systems are. Francesco addresses both these areas with two small habits.
Habit one: check new CVEs for 10 minutes daily
Each day, Francesco spends a few minutes catching up on the latest CVEs.
“I do a quick skim every day to check for new CVEs, when I’m on the bus or before I go to sleep. It’s just 10 minutes of scrolling, and it’s very useful for getting an idea of what’s going around, because you might find something really critical for your infrastructure.”
His go-to source is Vulnerability-Lookup, run by Luxembourg’s CIRCL, which puts the severity scores, exploitation data and vendor advisories for each CVE on one page: “It’s a website I love.”
Habit two: patch regularly
The most common mistake Francesco sees in vulnerability management? “Updating at the last minute, to be honest.”
Instead, he recommends frequent smaller patching sessions. “Try to patch regularly: not every day, but every week. Or twice a month if you aren’t a patch person.”
Reading the signals well and patching regularly work together. The scores and other indicators tell you which flaws can’t wait for the next scheduled session, and the regular rhythm takes care of everything else. An update agent can carry much of the routine work.
Regular patching is worthwhile, Francesco believes, even though a fix sometimes accidentally breaks other things. (“The game of a vendor releasing yet another patch to fix the bugs introduced by their last patch can go on for days; it’s very funny.”)
“It’s better to patch things often and have a couple of things break than to rebuild everything after an incident because you didn’t update a machine.”
Don’t panic, but don’t underestimate
As Francesco tells his friend over a beer, a 10 isn’t automatically a disaster — and the bigger risk is underestimating a vulnerability by looking only at the severity score.
He sums up his approach with an Italian saying, non prendere tutto sotto gamba: don’t take things lightly. “Don’t take a vulnerability lightly,” he says.
Fortunately, teams in higher education and research don’t have to work out how to weigh up the risks alone. “In the academic world, we have everything open. That’s a strength, because you can help other people.” His webinar does just that, sharing how his team weighs up the signals and uses them to make practical decisions.
Tune in on 22 October 2026 for Francesco’s webinar — 9.8 out of 10. Now what? — to learn what different vulnerability indicators tell you, what they don’t tell you, and how to use them to make better-informed decisions about managing vulnerabilities in an academic and research environment.
About Francesco Masala
