Writing on coordinated vulnerability disclosure, CNA operations, OT/ICS security, and security research.https://miguelpereira.org/https://blog.siemens.com/2026/08/siemens-sets-standards-how-data-transforms-cybersecurity/https://blog.siemens.com/2026/08/siemens-sets-standards-how-data-transforms-cybersecurity/When a vulnerability hits multiple kernels, vague alerts don't help. Supplier Authorized Data Publisher (SADP) delivers precise vulnerability details fast, directly from vendors.Mon, 10 Aug 2026 00:00:00 GMThttps://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access.Fri, 17 Jul 2026 00:00:00 GMThttps://www.siemens.com/en-us/content/cert-services-sadp/https://www.siemens.com/en-us/content/cert-services-sadp/How the Supplier Authorized Data Publisher (SADP) role lets vendors publish precise, first-party vulnerability data directly into the CVE ecosystem.Tue, 14 Apr 2026 00:00:00 GMThttps://miguelpereira.org/blog/what-is-a-psirt/https://miguelpereira.org/blog/what-is-a-psirt/A plain-language breakdown of what a Product Security Incident Response Team does, why it exists, and how it fits into the broader vulnerability ecosystem.Mon, 06 Apr 2026 00:00:00 GMThttps://miguelpereira.org/blog/cna-operations-at-scale/https://miguelpereira.org/blog/cna-operations-at-scale/Hard-won lessons from running CVE Numbering Authority operations in a large enterprise environment.Mon, 10 Feb 2025 00:00:00 GMT