141 results for “CISA”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types141 Articles64 Advisories48 Threads12 Write-ups8

More types3

Repos7 Other1 Papers1

“CISA”

x.comthread🛡️ Security

Dark Web Intelligence (@DailyDarkWeb) on X

CVE-2026-102764 is an unauthenticated RCE in BeyondTrust Remote Support, already exploited and in CISA KEV. Rapid7 published an analysis and opened a Metasploit pull request on 30 October 2026, showing code execution on version 24.1.2 via a forged "local" message origin, the native file-transfer service and a PHP file written to the web root. BT26-05 (CVSS 4.0 9.3) is fixed by patch BT26-05-RS; SaaS was patched by 9 October.

BeyondTrust Remote SupportMetasploitPHP+1

CVE-2026-102764CISA KEVRapid7+2

Offensive Security, Threat Intel, AppSec· Added 1 Nov 2026, published 31 Oct 2026

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October 2026, citing evidence of active exploitation: CVE-2026-111357 (missing authentication for a critical function) and CVE-2026-118527 (generation of predictable numbers or identifiers). The alert restates BOD 26-04, which requires federal civilian agencies to remediate KEV-listed flaws on exposed assets and check for prior compromise. It also links the KEV nomination form.

Ivanti Connect SecureCISA KEVVPN

CVE-2026-111357CVE-2026-118527BOD 26-04+1

Threat Intel, GRC· Published and added 30 Oct 2026

bleepingcomputer.comarticle🛡️ Security

CISA says max severity GitLab flaw now exploited in the wild

CVE-2026-97229 is a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler, caused by an integer overflow, that lets unauthenticated attackers run code via a crafted regular expression. CISA added it to the KEV Catalog and ordered federal agencies to patch under BOD 26-04. GitLab fixed it in CE/EE 19.4.2, 19.3.5 and 19.2.8, and Shadowserver tracks about 2,800 exposed CE instances.

GitLab

CVE-2026-97229CVE-2026-0723CVE-2026-110264+10

AppSec, DevSecOps, Threat Intel· Published and added 30 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Drupal warns of critical Commerce Core flaw exploited in attacks

Drupal Commerce Core has a critical missing-authorization flaw, CVE-2026-118539, that unauthenticated attackers exploit in the wild. It affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Drupal urges upgrading to 3.3.13 (or 8.x-2.41 on the older branch) and auditing orders for inconsistencies. The article also recalls CVE-2026-9082, exploited in May and added to CISA KEV, and two RCE patches (CVE-2026-108097, CVE-2026-108099).

DrupalDrupal Commerce Core

CVE-2026-118539CVE-2026-9082CVE-2026-108097+3

AppSec, Threat Intel· Published and added 30 Oct 2026

securityweek.comarticle🛡️ Security

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

CVE-2026-97229 is a CVSS 10 code execution flaw in Onigmo, Ruby's regular expression engine, reachable through crafted CI/CD configuration in GitLab. Attackers used it against Alpine Linux's GitLab on 20 and 21 October 2026 and failed; Alpine rebuilt the instance and found no tampering with aports or packages. Self-managed installs with their own Ruby need Ruby 3.3.13, 3.4.12 or 4.0.9, not just GitLab 19.3.6. CISA added it to KEV.

GitLabRubyOnigmo+2

CVE-2026-97229CISA KEVBOD 26-04+1

AppSec, Threat Intel, DevSecOps· Published and added 30 Oct 2026

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA alert of 29 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities catalog on evidence of active exploitation: CVE-2026-97229, an integer overflow in GitLab CE/EE, and CVE-2026-76418, a NULL pointer dereference from an unchecked return value in Cisco Secure Firewall ASA and FTD. It restates BOD 26-04 remediation duties for federal civilian agencies and links the KEV nomination form.

CISA KEVGitLabCisco Secure Firewall ASA+1

CVE-2026-97229CVE-2026-76418BOD 26-04+3

Threat Intel, GRC· Published and added 29 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

A quiet week in infosec <.<

Cisco Talos Threat Source newsletter for the week of the PHP and Node.js vulnerability news cycle. It summarises NIK C2, a Go-based Windows implant that dumps credentials, streams keystrokes, deploys screen-locking ransomware and uses a victim's hijacked OpenAI API keys to analyse stolen data. It also lists weekly headlines (CISA KEV PHP bugs, Brotli flaw, Gheist GitHub token theft), Talos links and top malware hashes.

GoWindowsOpenAI+3

NIK C2PHP2ShellNode2Shell+7

Threat Intel, AI Security· Published and added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

Fragnesia (CVE-2026-46300) is a Linux kernel XFRM ESP-in-TCP logic bug in the Dirty Frag class that gives local attackers root, with a public PoC. CISA added it to the KEV catalog and ordered federal patching under BOD 26-04. Attackers chain it with PHP2Shell (CVE-2026-109618, CVE-2026-109619) to implant PHP webshells. Dream Security tied the chain to 25 rooted servers in the US, Japan, Taiwan and South Korea.

Linux kernelLinuxPHP+1

CVE-2026-46300CVE-2026-109618CVE-2026-109619+9

Threat Intel, Offensive Security· Added 30 Oct 2026, published 29 Oct 2026

securityweek.comarticle🛡️ Security

Over 41,000 DHS Employee Records Leaked Online

A hacker using the handle Department of Peace leaked more than 41,000 US Department of Homeland Security employee records, which the hacker says came from an Okta single sign-on system. The data covers names, work emails, phone numbers, job titles, office locations and per-account system access, mostly for CBP, ICE and HSI staff plus about 1,000 CISA employees. Okta says it has no evidence of compromise. Distributed Denial of Secrets calls the dataset 'Icepick'.

Okta

Department of PeaceDistributed Denial of SecretsIcepick+8

Threat Intel, Identity & Access· Published and added 29 Oct 2026

securityweek.comarticle🛡️ Security

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CVE-2026-41709 is a low-severity insufficient-logging flaw in VMware ESXi that lets a logged-in administrator perform operations without audit entries. CISA added it to the KEV catalog, and CrowdStrike reported that China-nexus actor Warp Panda used it as a zero-day against US organizations, including law firms, to cut audit visibility. The article also covers exploitation of vCenter bugs CVE-2026-59309 and CVE-2026-59310 and lists the fixed ESXi builds.

VMware ESXiVMware vCenterCrowdStrike

CVE-2026-41709CVE-2026-59309CVE-2026-59310+10

Threat Intel· Published and added 29 Oct 2026

endorlabs.comarticle🧠 AI

What is an AIBOM? AI bill of materials explained for security teams | Endor Labs

An AIBOM is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with evidence of origin, license, integrity and evaluation. The Endor Labs explainer walks through a worked CycloneDX example for a fine-tuned support assistant. It compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM project and the May 2026 CISA/G7 guidance, and lists what an AIBOM cannot show: runtime behavior and agent actions.

CycloneDXSPDXSBOM+5

Endor LabsOWASPCISA+3

ai-policy, ai-infra· Published and added 29 Oct 2026

endorlabs.comarticle🛡️ Security

What is an AIBOM? AI bill of materials explained for security teams | Endor Labs

AIBOM explainer from Endor Labs: an AI bill of materials is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with origin, license and integrity evidence. It walks through a CycloneDX entry for a fine-tuned model, compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM Generator and the May 2026 CISA/G7 minimum-elements guidance, and lists a six-step build process. It also states what an AIBOM cannot show: model safety, runtime behavior and coding-agent actions.

CycloneDXSPDXSBOM+2

EU AI ActISO/IEC 42001CISA+5

Supply Chain, AI Security, GRC· Published and added 29 Oct 2026

wired.comarticle🛡️ Security

Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents

Icepick is a leaked archive of records on more than 41,000 Department of Homeland Security employees and contractors, published by Distributed Denial of Secrets in 2026 and said to come from DHS's Okta login system. WIRED's analysis covers CBP, ICE, HSI, USCIS and CISA staff, plus over 55,000 permission groups that reference undercover programs, Palantir Falcon, PenLink, Signal and Mobile Fortify. Okta says it has no evidence of compromise.

OktaPalantirPenLink+3

IcepickDistributed Denial of SecretsDepartment of Peace+10

Threat Intel, OSINT, Identity & Access· Added 29 Oct 2026, published 28 Oct 2026

cisa.govadvisory🛡️ Security

Hitachi Energy CoreTec Product

CISA advisory ICSA-26-302-03, republished from Hitachi Energy PSIRT 8DBD000258, covers OS command injection (CVE-2026-13162) and the Dirty Frag vulnerability (CVE-2026-43284) in Hitachi Energy CoreTec. CoreTec5 up to 3.4.0 and 5.0.0 are affected by both, and CoreTec4 up to 3.4.0 by CVE-2026-13162. The advisory was released 27 October 2026 and lists generic ICS mitigations. SSVC rates exploitation as none.

Hitachi Energy CoreTec

CVE-2026-13162CVE-2026-43284Dirty Frag+5

Hardware & RF· Added 29 Oct 2026, published 28 Oct 2026

cisa.govadvisory🛡️ Security

Hitachi Energy TRO600 series products

ICSA-26-302-02 is a CISA republication of Hitachi Energy PSIRT advisory 8DBD000224 on the TRO600 series. It covers CVE-2026-10756 and CVE-2026-106087, which allow remote code execution and disclosure of sensitive information. Affected versions are TRO600 up to 9.2.1.6 and 9.1.1.0, plus 9.2.2.1 and 9.1.2.0. The page gives no per-CVE detail or CVSS scores, only general ICS hardening advice. Released 27 October 2026.

Hitachi Energy TRO600

CVE-2026-10756CVE-2026-106087Hitachi Energy PSIRT 8DBD000224+1

Hardware & RF· Added 29 Oct 2026, published 28 Oct 2026

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA alert of 28 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities Catalog on evidence of active exploitation: CVE-2026-41709 (Broadcom VMware ESX insufficient logging) and CVE-2026-46300 (Linux kernel missing variable initialization). It restates BOD 26-04, which requires federal civilian agencies to prioritize fast remediation of KEV CVEs on exposed assets and to check for prior compromise. It also links the KEV nomination form.

CISA KEVVMware ESXLinux kernel

CVE-2026-41709CVE-2026-46300BOD 26-04+1

Threat Intel, GRC· Added 29 Oct 2026, published 28 Oct 2026

x.comthread🛡️ Security

Christiaan Stoudt (@cstoudt) on X

Thread on CVE-2026-97631, a critical (9.5) flaw in TianoCore EDK II UEFI firmware, found by Alex Matrosov and Dan Holmes-Mitra. It is exploitable only while a machine is PXE network booting and the attacker sends an oversized ICMP error from the same network. Code execution also needs the exact firmware build, and Secure Boot does not help. The fix landed in EDK II main on 15 October but is not in a stable release. No known exploitation, and not in CISA KEV.

EDK IIUEFITianoCore+2

CVE-2026-97631Alex MatrosovDan Holmes-Mitra+3

Hardware & RF· Added 30 Oct 2026, published 28 Oct 2026

securityweek.comarticle🛡️ Security

Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Four vulnerabilities in EPICS Base 7.0.10 and earlier, the control-system toolkit used at ITER and the Advanced Photon Source, were disclosed by CISA. CVE-2026-114595 (CVSS 9.8) is an integer overflow that could allow remote code execution, though only an out-of-bounds heap write and crash were demonstrated. All flaws sit in Channel Access and pvAccess handling (TCP 5064 and 5075), need no authentication, and are fixed in 7.0.11.

EPICSChannel AccesspvAccess+3

CVE-2026-114595CVE-2026-114596CVE-2026-114597+10

Hardware & RF, AppSec· Published and added 28 Oct 2026

securityweek.comarticle🛡️ Security

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

CVE-2026-111497 (Node2Shell, also HTTP2Shell and Broccoli2Shell) is an out-of-bounds write in the Brotli decoder, affecting versions 1.0.3 through 1.2.0. CISA added it to the KEV catalog on 27 October 2026 with a federal deadline of 10 November. Previdian and ELLIO logged exploitation attempts; ELLIO found the observed exploit broken but achieved code execution itself, and Broadcom's VMware SDDC Manager patches are pending.

BrotliNode.jsVMware Cloud Foundation+2

CVE-2026-111497Node2ShellHTTP2Shell+9

Threat Intel, AppSec· Published and added 28 Oct 2026

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA alert of 27 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog on evidence of active exploitation: CVE-2026-48356, an unrestricted upload of a dangerous file type in Adobe Commerce and Magento, and CVE-2026-111497, an unchecked return value in Google Brotli. It restates BOD 26-04, which makes federal civilian agencies prioritise KEV flaws on exposed assets and check for prior compromise. No technical detail or IOCs are given.

Adobe CommerceMagentoBrotli

CVE-2026-48356CVE-2026-111497CISA KEV+2

AppSec, GRC· Added 29 Oct 2026, published 27 Oct 2026

securityweek.comarticle🛡️ Security

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

This SecurityWeek commentary covers the September 2026 Citrix NetScaler ADC and Gateway zero-days, exploited from mid-month and patched on 27 September as unauthenticated RCE flaws CVE-2026-88771 through CVE-2026-88778. The author argues the fast response shows stronger defence. Cited evidence: Citrix disclosure time fell from about 40 days to 17 in 2026 after it set up a NetScaler CNA, and CISA made a rare Sunday KEV addition.

Citrix NetScaler

CVE-2026-88771CVE-2026-88772CVE-2026-88773+9

other, Threat Intel· Published and added 27 Oct 2026

securityweek.comarticle🛡️ Security

Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems

Blue Initiative is a free public vulnerability database for maritime IT and OT, built by Cydome, ClassNK, Bureau Veritas, MTS-ISAC and Rakuten Maritime. It holds nearly 30,000 entries, over 2,000 rated critical by CVSS and more than 580 known exploited. Only 37 affect ship and port products. Most entries are pulled from CISA ICS advisories and the KEV catalog and mapped to maritime systems.

CISA KEVCVSS

Blue InitiativeCydomeClassNK+5

other· Published and added 27 Oct 2026

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on 26 October 2026: CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request state). It also updated its PHP alert on critical vulnerabilities requiring immediate patching. The alert restates BOD 26-04, which requires federal civilian agencies to prioritize fast remediation of KEV CVEs on exposed assets and to check for prior compromise.

PHPCISA KEV

CVE-2026-109618CVE-2026-109619BOD 26-04+1

AppSec, GRC· Added 29 Oct 2026, published 26 Oct 2026

cisa.govadvisory🛡️ Security

Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

CISA advisory ICSA-26-300-02 covers four vulnerabilities in Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. CVE-2023-4863 (CWE-787 out-of-bounds write) allows code execution; CVE-2026-16436 and CVE-2026-16437 allow authentication bypass; CVE-2026-16438 allows arbitrary operations. Fixes are 10.97.3, 10.98 and GENESIS 11.04. MC Works64, GENESIS32 and BizViz are affected in all versions, and MC Works64 has no fix planned. Mitigations include removing the ClientChallengeTable.dat or SecurityChallenges.dat file contents. The fetched text was truncated, so later content is not covered.

GENESIS64ICONICS SuiteHyper Historian+3

CVE-2023-4863CVE-2026-16436CVE-2026-16437+6

Offensive Security, Identity & Access· Added 29 Oct 2026, published 26 Oct 2026

cisa.govadvisory🛡️ Security

EPICS Base

CISA ICS advisory ICSA-26-300-01 (October 27, 2026) covers EPICS Base release 7.0.10 and earlier, with CVE-2026-114595 through CVE-2026-114598. Flaws include integer overflow, length parameter inconsistency and type confusion, allowing denial of service, memory corruption, information disclosure or remote code execution (CVSS v3.1 9.8). The fix is EPICS Base 7.0.11, with patches in epics-base and pvDataCPP pull requests.

EPICS BaseCVSS

CVE-2026-114595CVE-2026-114596CVE-2026-114597+5

AppSec· Added 29 Oct 2026, published 26 Oct 2026

cisa.govarticle🛡️ Security

CISA Publishes Significant Updates to ScubaGear and ScubaGoggles

ScubaGear v2.0 and ScubaGoggles v1.1.0 are CISA's updated SCuBA assessment tools for Microsoft 365 and Google Workspace secure configuration baselines. ScubaGear now uses direct REST API calls, adds Power BI coverage, a consolidated Security Suite baseline and app severity scoring. ScubaGoggles adds a GUI, Policy API integration and Gemini controls. The release supports BOD 25-01 compliance.

ScubaGearScubaGogglesMicrosoft 365+3

CISASCuBABOD 25-01+1

Cloud & Infra, GRC· Added 29 Oct 2026, published 26 Oct 2026

securityweek.comarticle🛡️ Security

Stolen AI Reasoning Could Help China Build Cheaper Rivals

Compaction Smuggling is an attack found by Xint that bypassed OpenAI's August 2026 mitigations against stealing reasoning traces from proprietary LLM APIs. It encodes one model's reasoning inside a compaction and replays it to another model (for example gpt-4.1 or gpt-4o), which outputs it verbatim. OpenAI fixed it and paid a $6,000 bounty on 23 October 2026. The article ties it to distillation by Chinese labs, citing a September CISA warning.

OpenAILLMDeepSeek+3

Compaction SmugglingXintCISA+8

AI Security, Threat Intel· Published and added 26 Oct 2026

securityweek.comarticle🛡️ Security

PHP2Shell Exploitation Moves From Probes to Working Shells

PHP2Shell exploitation (CVE-2026-109618, CVE-2026-109619) reached working shells on 24 October 2026, when Perplexity researcher Adel Karimi's honeypots (PHP 8.4.26, Apache mod_php, single worker) logged 35 shells across three servers. Attackers used a four-stage HTTP chain: memory exhaustion, memory leak, then shell command execution, matching a public PoC. No second-stage payload was seen, and CISA had not added the flaws to KEV as of 26 October.

PHPApache

CVE-2026-109618CVE-2026-109619PHP2Shell+4

Threat Intel, AppSec· Published and added 26 Oct 2026

x.comarticle🛡️ Security

lee1981 (@lee1981b) on X

CyberForge Weekly CVE Rundown #007 covers six CVEs from 19 to 24 October 2026: SiteGuard command injection (CVE-2026-106931), DB-GPT (CVE-2026-77932), Siemens Software Center DLL side-loading (CVE-2026-110936), Cisco Expressway (CVE-2026-76466), Node.js Brotli (CVE-2026-111497) and Arista VeloCloud (CVE-2026-114625). Each entry gives defender actions, fixed versions, exploitation status and primary-source links. Updated 25 October 2026 with CISA KEV and EPSS findings.

SiteGuardDB-GPTSiemens Software Center+4

CVE-2026-106931CVE-2026-77932CVE-2026-110936+10

Blue Team & Detection, AppSec, Threat Intel· Added 27 Oct 2026, published 25 Oct 2026

cisa.govadvisory🛡️ Security

CISA: Critical Vulnerabilities in PHP Require Immediate Patching

CISA alert on CVE-2026-109618 and CVE-2026-109619 ("php2shell"), unauthenticated remote code execution flaws affecting PHP installations serving web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updated 23 October 2026 with a Sigma rule, partner advisories (NSA, NCSC-UK, ASD ACSC, NCSC-NL, NCSC-NZ, Cyber Centre) and guidance to inventory PHP, patch internet-facing systems first, and watch for PHP workers spawning shells. No in-the-wild exploitation had been observed.

PHPApachePHP-FPM+3

CVE-2026-109618CVE-2026-109619PHP2Shell+2

AppSec, Blue Team & Detection· Added 24 Oct 2026

Showing 30 of 141