Security advisories

When a security alert reaches the news, Helios tells you which clients are affected. It checks each advisory against the software list every agent already sends. Then it names the machines, the version found and the update.

Where to find it

Open Security, then Advisories. The first line answers the question your clients will ask: does any current advisory touch your machines? Below it, each advisory that does is listed worst first. Open one for the clients, the machines and what to do.

Recent advisories that touch nothing are listed too, under Checked, not found. That is the answer to "are we affected?" when it is no.

Where the advisories come from

• CISA's Known Exploited Vulnerabilities list. Flaws that are being used in real attacks. Helios reads it every day and keeps the entries for software it can see on a machine. Affected versions come from the US National Vulnerability Database where it has them.
• National and vendor alerts, added the day they land. The Helios team adds alerts such as NCSC's PHP warning of 21 October 2026. That is often before a CVE score exists. Every workspace is checked within a minute.

No scanner, extra licence or Microsoft Defender plan is needed. If a client does have Defender's vulnerability data connected, its CVEs still show on the Security page as before.

What it checks

• Windows: the installed programs list.
• Linux: the installed packages, and whether an update is waiting for each one.
• macOS: the installed apps.

Some products carry another inside them. XAMPP, WampServer, Laragon, MAMP, AMPPS and EasyPHP all carry PHP. XAMPP's version is its PHP version, so Helios reads it. The others number themselves, so Helios marks them to check.

What each status means

• Affected. The version on the machine is in the published affected range, or Linux has an update waiting for the package.
• Check version. The product is there, but the version cannot settle it. Perhaps no fixed version is named yet, or a bundle hides the version. Or Linux may have fixed it without changing the version number. Each machine says which.
• Up to date. For advisories added by hand: the version is at or past the fixed one.

Helios never marks a machine affected on a guess, and never invents a fixed version. When the vendor names one, the advisory is updated and every machine is checked again.

The alert

Each advisory raises one alert per workspace, through the Security advisory matches your machines rule. It is on by default, in every alert profile, and emailed. Switch it off or change who hears in Alerts, Profiles.

• One email per advisory, ever. Several new advisories in one check arrive as one summary.
• An engineer limited to some clients hears only about those clients.
• Advisories published more than 14 days before they reach your machines show on the page without an email. That keeps old news out of your inbox.
• The alert clears by itself when no machine carries the affected version any more.

Fixing it

Each advisory says what to do and links the vendor's fix. On Windows, a waiting winget update can be installed with Queue the update. It installs exactly that package on the client's machines. Linux updates install from Patches. A product inside XAMPP, WampServer or MAMP, or on a Mac, is updated by hand. The page says so.

Telling your clients

Your clients can see these results in their portal, in plain words. Turn on Show clients in their portal on this page. It is off until you do. Each client sees recent advisories as checked, being updated or updated, for its own machines only. Machine names and versions stay with you. See Client portal.

Limits, said plainly

• Software that never registers itself is not seen. PHP unpacked from a zip file is one example. So are Homebrew packages on a Mac.
• A Chromium flaw on CISA's list is matched to Google Chrome only. Edge, Brave and Opera carry Chromium too, but their versions are numbered differently, so they are not matched yet.
• Windows and Office security updates are covered by Patches, not here.
• A machine that has not sent a software list yet is counted as not checked, never as clear. The page shows how many.
• Sample machines never count. The public demo shows a made-up example.

Spotted an advisory we have not added? Email support@heliosmsp.io with the link.