1. Introduction §

Keeping an eye on published vulnerabilities is part of my work, but there are now too many CVE published every day to read them all, and the delay between the publication of a vulnerability and its first exploitation also became very short. In my opinion, this work cannot reasonably be done by hand anymore.

My infrastructure is already updated automatically for nearly all its components, so most of the time a fix arrives without me doing anything. But sometimes, I need to react faster than the update, for example to set up a workaround while waiting for a patched version. For this, I need to know quickly when a vulnerability affecting me is published.

In this blog post, I share the small setup I made to receive alerts about vulnerabilities that affect my infra, with issues tracking and maybe a fix created as a PR automatically when possible. There is nothing exceptional here, but it may give ideas to some readers.

2. How it works §

My infrastructure is described entirely as code in a git repository hosted on my Forgejo instance. Forgejo is a self-hosted "forge", like Gitlab, and it comes with a CI compatible with GitHub Actions.

This CI job runs three times a day, in the morning before I wake up, at noon before I go back to work, and in the evening just before the end of my work day, in case it is useful for my job. It does the following:

• build an inventory of what runs in my infrastructure from the repository (container images and system packages)
• fetch the recent announcements from a list of security feeds
• send the inventory and the announcements to a language model, which keeps only the serious vulnerabilities affecting my setup
• for each new alert, ask the model to create a fix as a pull request if possible
• open an issue in Forgejo to keep track of the alert
• warn me over XMPP

The model only sees a high level view of the infrastructure, which is enough to know which software runs where and how it is updated. The prompt asks it to ignore what does not matter to me (denial of service only, XSS, products I do not use) and also to suggest a workaround, like the commands to run or a configuration change such as disabling the vulnerable feature or blocking a path in the reverse proxy.

The issue title contains the CVE identifier that is checked before opening a new issue to avoid duplicates, and I close the issue when it is handled or if it is a false positive.

The pull requests are never merged automatically, they are only here to save me time, especially when the fix is trivial like changing the version of a container image. Of course, they must be reviewed before merging.

3. Sources §

Here are some of the feeds I use:

• the CISA KEV catalog, the list of vulnerabilities known to be actively exploited
• the GitHub security advisories with critical and high severity, most of the projects I am using are published on GitHub so it works fine
• the Ubuntu security notices, for the packages of my Ubuntu containers
• the oss-security mailing list, where open source projects often announce issues before other sources

CISA Known Exploited Vulnerabilities Catalog

GitHub Advisory Database

Ubuntu Security Notices

oss-security mailing list

4. The language model §

I use the Mistral API with the model ministral-14b, it is available with their free offer. From my experience, a 14B model (14 billions parameters) is good enough for this task, because it does not have to be smart, it only needs to read announcements and compare them with my inventory.

I chose Mistral because I need to improve my skills about AI, it is a provider I had never used before, and it is the only one I found with a free offer giving access to an API. This would work with any other provider without problem. A 14B model also runs on hardware that an individual can have at home for a reasonable price, so this could run on-premise.

5. Notifications §

I chose XMPP for the alerts because I have an XMPP client on all my systems and the notifications work well everywhere. The message is sent with go-sendxmpp from a dedicated account. This is really a personal choice, it could have been Matrix, SMS, a Mattermost, Slack or Teams webhook, whatever floats your boat.

go-sendxmpp project page

For each alert, I get two things:

• an issue in Forgejo explaining why the vulnerability was classified as relevant, with its severity and a link to the source
• an XMPP message with a link to the issue, a short summary and the affected components

6. Conclusion §

It has not been running for long, so it is still being tuned, but it already caught CVE-2026-111497 quickly, a serious remote code execution vulnerability.

This setup does not replace my usual cybersecurity watch, I still read security advisories and releases feeds. It completes it, especially on days where I am really busy and that I could have missed something important.