64 results for “CISA”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types141 Articles64 Advisories48 Threads12 Write-ups8

More types3

Repos7 Other1 Papers1

📄 Articles “CISA”Clear all

bleepingcomputer.comarticle🛡️ Security

CISA says max severity GitLab flaw now exploited in the wild

CVE-2026-97229 is a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler, caused by an integer overflow, that lets unauthenticated attackers run code via a crafted regular expression. CISA added it to the KEV Catalog and ordered federal agencies to patch under BOD 26-04. GitLab fixed it in CE/EE 19.4.2, 19.3.5 and 19.2.8, and Shadowserver tracks about 2,800 exposed CE instances.

GitLab

CVE-2026-97229CVE-2026-0723CVE-2026-110264+10

AppSec, DevSecOps, Threat Intel· Published and added 30 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Drupal warns of critical Commerce Core flaw exploited in attacks

Drupal Commerce Core has a critical missing-authorization flaw, CVE-2026-118539, that unauthenticated attackers exploit in the wild. It affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Drupal urges upgrading to 3.3.13 (or 8.x-2.41 on the older branch) and auditing orders for inconsistencies. The article also recalls CVE-2026-9082, exploited in May and added to CISA KEV, and two RCE patches (CVE-2026-108097, CVE-2026-108099).

DrupalDrupal Commerce Core

CVE-2026-118539CVE-2026-9082CVE-2026-108097+3

AppSec, Threat Intel· Published and added 30 Oct 2026

securityweek.comarticle🛡️ Security

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

CVE-2026-97229 is a CVSS 10 code execution flaw in Onigmo, Ruby's regular expression engine, reachable through crafted CI/CD configuration in GitLab. Attackers used it against Alpine Linux's GitLab on 20 and 21 October 2026 and failed; Alpine rebuilt the instance and found no tampering with aports or packages. Self-managed installs with their own Ruby need Ruby 3.3.13, 3.4.12 or 4.0.9, not just GitLab 19.3.6. CISA added it to KEV.

GitLabRubyOnigmo+2

CVE-2026-97229CISA KEVBOD 26-04+1

AppSec, Threat Intel, DevSecOps· Published and added 30 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

A quiet week in infosec <.<

Cisco Talos Threat Source newsletter for the week of the PHP and Node.js vulnerability news cycle. It summarises NIK C2, a Go-based Windows implant that dumps credentials, streams keystrokes, deploys screen-locking ransomware and uses a victim's hijacked OpenAI API keys to analyse stolen data. It also lists weekly headlines (CISA KEV PHP bugs, Brotli flaw, Gheist GitHub token theft), Talos links and top malware hashes.

GoWindowsOpenAI+3

NIK C2PHP2ShellNode2Shell+7

Threat Intel, AI Security· Published and added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

Fragnesia (CVE-2026-46300) is a Linux kernel XFRM ESP-in-TCP logic bug in the Dirty Frag class that gives local attackers root, with a public PoC. CISA added it to the KEV catalog and ordered federal patching under BOD 26-04. Attackers chain it with PHP2Shell (CVE-2026-109618, CVE-2026-109619) to implant PHP webshells. Dream Security tied the chain to 25 rooted servers in the US, Japan, Taiwan and South Korea.

Linux kernelLinuxPHP+1

CVE-2026-46300CVE-2026-109618CVE-2026-109619+9

Threat Intel, Offensive Security· Added 30 Oct 2026, published 29 Oct 2026

securityweek.comarticle🛡️ Security

Over 41,000 DHS Employee Records Leaked Online

A hacker using the handle Department of Peace leaked more than 41,000 US Department of Homeland Security employee records, which the hacker says came from an Okta single sign-on system. The data covers names, work emails, phone numbers, job titles, office locations and per-account system access, mostly for CBP, ICE and HSI staff plus about 1,000 CISA employees. Okta says it has no evidence of compromise. Distributed Denial of Secrets calls the dataset 'Icepick'.

Okta

Department of PeaceDistributed Denial of SecretsIcepick+8

Threat Intel, Identity & Access· Published and added 29 Oct 2026

securityweek.comarticle🛡️ Security

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CVE-2026-41709 is a low-severity insufficient-logging flaw in VMware ESXi that lets a logged-in administrator perform operations without audit entries. CISA added it to the KEV catalog, and CrowdStrike reported that China-nexus actor Warp Panda used it as a zero-day against US organizations, including law firms, to cut audit visibility. The article also covers exploitation of vCenter bugs CVE-2026-59309 and CVE-2026-59310 and lists the fixed ESXi builds.

VMware ESXiVMware vCenterCrowdStrike

CVE-2026-41709CVE-2026-59309CVE-2026-59310+10

Threat Intel· Published and added 29 Oct 2026

endorlabs.comarticle🧠 AI

What is an AIBOM? AI bill of materials explained for security teams | Endor Labs

An AIBOM is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with evidence of origin, license, integrity and evaluation. The Endor Labs explainer walks through a worked CycloneDX example for a fine-tuned support assistant. It compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM project and the May 2026 CISA/G7 guidance, and lists what an AIBOM cannot show: runtime behavior and agent actions.

CycloneDXSPDXSBOM+5

Endor LabsOWASPCISA+3

ai-policy, ai-infra· Published and added 29 Oct 2026

endorlabs.comarticle🛡️ Security

What is an AIBOM? AI bill of materials explained for security teams | Endor Labs

AIBOM explainer from Endor Labs: an AI bill of materials is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with origin, license and integrity evidence. It walks through a CycloneDX entry for a fine-tuned model, compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM Generator and the May 2026 CISA/G7 minimum-elements guidance, and lists a six-step build process. It also states what an AIBOM cannot show: model safety, runtime behavior and coding-agent actions.

CycloneDXSPDXSBOM+2

EU AI ActISO/IEC 42001CISA+5

Supply Chain, AI Security, GRC· Published and added 29 Oct 2026

wired.comarticle🛡️ Security

Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents

Icepick is a leaked archive of records on more than 41,000 Department of Homeland Security employees and contractors, published by Distributed Denial of Secrets in 2026 and said to come from DHS's Okta login system. WIRED's analysis covers CBP, ICE, HSI, USCIS and CISA staff, plus over 55,000 permission groups that reference undercover programs, Palantir Falcon, PenLink, Signal and Mobile Fortify. Okta says it has no evidence of compromise.

OktaPalantirPenLink+3

IcepickDistributed Denial of SecretsDepartment of Peace+10

Threat Intel, OSINT, Identity & Access· Added 29 Oct 2026, published 28 Oct 2026

securityweek.comarticle🛡️ Security

Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Four vulnerabilities in EPICS Base 7.0.10 and earlier, the control-system toolkit used at ITER and the Advanced Photon Source, were disclosed by CISA. CVE-2026-114595 (CVSS 9.8) is an integer overflow that could allow remote code execution, though only an out-of-bounds heap write and crash were demonstrated. All flaws sit in Channel Access and pvAccess handling (TCP 5064 and 5075), need no authentication, and are fixed in 7.0.11.

EPICSChannel AccesspvAccess+3

CVE-2026-114595CVE-2026-114596CVE-2026-114597+10

Hardware & RF, AppSec· Published and added 28 Oct 2026

securityweek.comarticle🛡️ Security

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

CVE-2026-111497 (Node2Shell, also HTTP2Shell and Broccoli2Shell) is an out-of-bounds write in the Brotli decoder, affecting versions 1.0.3 through 1.2.0. CISA added it to the KEV catalog on 27 October 2026 with a federal deadline of 10 November. Previdian and ELLIO logged exploitation attempts; ELLIO found the observed exploit broken but achieved code execution itself, and Broadcom's VMware SDDC Manager patches are pending.

BrotliNode.jsVMware Cloud Foundation+2

CVE-2026-111497Node2ShellHTTP2Shell+9

Threat Intel, AppSec· Published and added 28 Oct 2026

securityweek.comarticle🛡️ Security

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

This SecurityWeek commentary covers the September 2026 Citrix NetScaler ADC and Gateway zero-days, exploited from mid-month and patched on 27 September as unauthenticated RCE flaws CVE-2026-88771 through CVE-2026-88778. The author argues the fast response shows stronger defence. Cited evidence: Citrix disclosure time fell from about 40 days to 17 in 2026 after it set up a NetScaler CNA, and CISA made a rare Sunday KEV addition.

Citrix NetScaler

CVE-2026-88771CVE-2026-88772CVE-2026-88773+9

other, Threat Intel· Published and added 27 Oct 2026

securityweek.comarticle🛡️ Security

Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems

Blue Initiative is a free public vulnerability database for maritime IT and OT, built by Cydome, ClassNK, Bureau Veritas, MTS-ISAC and Rakuten Maritime. It holds nearly 30,000 entries, over 2,000 rated critical by CVSS and more than 580 known exploited. Only 37 affect ship and port products. Most entries are pulled from CISA ICS advisories and the KEV catalog and mapped to maritime systems.

CISA KEVCVSS

Blue InitiativeCydomeClassNK+5

other· Published and added 27 Oct 2026

cisa.govarticle🛡️ Security

CISA Publishes Significant Updates to ScubaGear and ScubaGoggles

ScubaGear v2.0 and ScubaGoggles v1.1.0 are CISA's updated SCuBA assessment tools for Microsoft 365 and Google Workspace secure configuration baselines. ScubaGear now uses direct REST API calls, adds Power BI coverage, a consolidated Security Suite baseline and app severity scoring. ScubaGoggles adds a GUI, Policy API integration and Gemini controls. The release supports BOD 25-01 compliance.

ScubaGearScubaGogglesMicrosoft 365+3

CISASCuBABOD 25-01+1

Cloud & Infra, GRC· Added 29 Oct 2026, published 26 Oct 2026

securityweek.comarticle🛡️ Security

Stolen AI Reasoning Could Help China Build Cheaper Rivals

Compaction Smuggling is an attack found by Xint that bypassed OpenAI's August 2026 mitigations against stealing reasoning traces from proprietary LLM APIs. It encodes one model's reasoning inside a compaction and replays it to another model (for example gpt-4.1 or gpt-4o), which outputs it verbatim. OpenAI fixed it and paid a $6,000 bounty on 23 October 2026. The article ties it to distillation by Chinese labs, citing a September CISA warning.

OpenAILLMDeepSeek+3

Compaction SmugglingXintCISA+8

AI Security, Threat Intel· Published and added 26 Oct 2026

securityweek.comarticle🛡️ Security

PHP2Shell Exploitation Moves From Probes to Working Shells

PHP2Shell exploitation (CVE-2026-109618, CVE-2026-109619) reached working shells on 24 October 2026, when Perplexity researcher Adel Karimi's honeypots (PHP 8.4.26, Apache mod_php, single worker) logged 35 shells across three servers. Attackers used a four-stage HTTP chain: memory exhaustion, memory leak, then shell command execution, matching a public PoC. No second-stage payload was seen, and CISA had not added the flaws to KEV as of 26 October.

PHPApache

CVE-2026-109618CVE-2026-109619PHP2Shell+4

Threat Intel, AppSec· Published and added 26 Oct 2026

x.comarticle🛡️ Security

lee1981 (@lee1981b) on X

CyberForge Weekly CVE Rundown #007 covers six CVEs from 19 to 24 October 2026: SiteGuard command injection (CVE-2026-106931), DB-GPT (CVE-2026-77932), Siemens Software Center DLL side-loading (CVE-2026-110936), Cisco Expressway (CVE-2026-76466), Node.js Brotli (CVE-2026-111497) and Arista VeloCloud (CVE-2026-114625). Each entry gives defender actions, fixed versions, exploitation status and primary-source links. Updated 25 October 2026 with CISA KEV and EPSS findings.

SiteGuardDB-GPTSiemens Software Center+4

CVE-2026-106931CVE-2026-77932CVE-2026-110936+10

Blue Team & Detection, AppSec, Threat Intel· Added 27 Oct 2026, published 25 Oct 2026

securityweek.comarticle🛡️ Security

PHP2Shell Exploitation Started Days Before Patches

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP remote code execution flaws. Amazon saw the first exploitation on 17 October 2026, four days before patches on 21 October, and Cloudflare logged millions of attempts after disclosure. Censys, VulnCheck and VirusTotal counted over 1 million unpatched PHP hosts, and CISA urged updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

PHPCloudflareVirusTotal+1

CVE-2026-109618CVE-2026-109619PHP2Shell+4

Threat Intel, AppSec· Published and added 22 Oct 2026

x.comarticle🛡️ Security

lee1981 (@lee1981b) on X

CVE-2026-110936 is an uncontrolled DLL search path flaw (CWE-427) in Siemens Software Center below V4.0.9.8, listed in CISA KEV on 20 October 2026. The post covers CVSS v4.0 8.4 and v3.1 6.7, Siemens' Romulus ClickFix campaign indicators (IPs, domain, hashes, file leads) and a six-step SOC trail using Sysmon, EDR and network records. It separates delivery from DLL load and from compromise.

Siemens Software CenterWindowsSysmon+3

CVE-2026-110936CWE-427DLL search order hijacking+10

Blue Team & Detection, Threat Intel· Added 24 Oct 2026, published 21 Oct 2026

securityweek.comarticle🛡️ Security

US Agencies Detail Incident Response Practices for Rogue AI Agents

SecurityWeek summarizes the NIST, NSA and CISA report "Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation". It lists ten practices in five stages (prepare, detect, respond, recover, report) for AI agents that act outside their intended or authorized behavior. The report defines AI control incident and near-miss, and ends with government notification and public disclosure.

NISTNSACISA+3

AI Security, GRC, Blue Team & Detection· Published and added 20 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

There's only so much code: the rise in vulnerability numbers

Cisco Talos analysis of why Microsoft Patch Tuesday advisories rose from about 100 a month before June 2026 to 975 in September and 1,415 in October, as frontier models such as Mythos mine old code. CVEs grew 105% year over year while CISA KEV additions grew 37%, and only three September advisories were exploited in the wild. It covers pressure on 90-day coordinated disclosure and open-source maintainers, the format string bug-class precedent, and defender advice.

SnortWindows

CVE-2021-44228MythosCISA KEV+8

AI Security, AppSec, Blue Team & Detection· Published and added 20 Oct 2026

madrobot.blogarticle🧠 AI

The US orders every civilian agency to rip out DeepSeek, even tools built on it

DHS Exclusion and Removal Order #2026-01, signed by Secretary Markwayne Mullin and dated 24 July 2026, bars every federal civilian agency from buying or running DeepSeek products and third-party tools built on DeepSeek implementations. The order does not list affected products or address DeepSeek models hosted by US firms. Agencies have 60 days to request exceptions through CISA, and military and intelligence systems are excluded.

DeepSeek

Hangzhou DeepSeek Artificial IntelligenceDepartment of Homeland SecurityMarkwayne Mullin+6

ai-policy· Added 20 Oct 2026, published 19 Oct 2026

madrobot.blogarticle🛡️ Security

The US orders every civilian agency to rip out DeepSeek, even tools built on it

DHS Exclusion and Removal Order 2026-01, signed by Secretary Markwayne Mullin on 24 July 2026 and noticed in the Federal Register on 20 October 2026 (docket DHS-2026-0628), bars civilian agencies from buying or running DeepSeek products and third-party products built on DeepSeek. Agencies have 60 days to request exceptions through CISA and must meanwhile monitor traffic, increase logging and add data-exfiltration controls. Military and intelligence national security systems are excluded.

DeepSeek

Exclusion and Removal Order 2026-01DHS-2026-0628Hangzhou DeepSeek Artificial Intelligence+4

Supply Chain, GRC, AI Security· Added 20 Oct 2026, published 19 Oct 2026

securityweek.comarticle🛡️ Security

Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

UNC5820 (tracked by Palo Alto Networks as CL-STA-0954) breached a telecom in September 2024 using FortiManager flaw CVE-2024-47575 (FortiJump) and path traversal CVE-2025-61624, then deployed PeerStitch, a memory-resident ARM64 FortiGate implant. PeerStitch patches FortiOS log and IKE/IPsec daemons to build a covert bridge without listening ports. The actor also impersonated FortiManager over FGFM, using CVE-2024-26008. CISA added CVE-2025-61624 to KEV.

FortiGateFortiManagerFortiOS+1

CVE-2024-47575CVE-2025-61624CVE-2024-26008+8

Threat Intel, Malware & RE· Published and added 19 Oct 2026

en.cryptonomist.charticle🧠 AI

U.S. jobs data challenges fears about the future of artificial intelligence

Reports Stephen Messer's October 2026 essay arguing that US unemployment (4.3–4.5% through 2025–2026) and studies from Anthropic economists, PwC and a Danish dataset show no mass AI job destruction. It also covers Yann LeCun's rejection of LLMs as a route to human-level intelligence and open-weight competition, notably Moonshot's Kimi K2 to K3 and Harvey's Tenet model post-trained on Kimi K3 (benchmark 11% to 19.7%, inference cost under a quarter). It closes with the September 2026 FBI/NSA/CISA advisory on Chinese distillation campaigns against US models.

LLMKimi K3Claude

Stephen MesserAnthropicYann LeCun+22

ai-policy, models· Published and added 16 Oct 2026

securityweek.comarticle🛡️ Security

Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution

Palo Alto Networks patched CVE-2026-0322, a high-severity zero-day in the PAN-OS management interface that lets an authenticated attacker with network access run arbitrary code as root. It affects PA-Series, VM-Series and Panorama with no special configuration needed, and "very limited" exploitation has been seen. The vendor published a few IP-based IoCs, CISA added the flaw to KEV with an October 17 deadline, and a dozen other medium/low advisories were released the same day.

PAN-OSPalo Alto NetworksPanorama+1

CVE-2026-0322CISA KEVCISA

Threat Intel, Cloud & Infra· Published and added 15 Oct 2026

securityweek.comarticle🛡️ Security

Cisco Warns of Exploited Secure Email Gateway Vulnerability

Cisco warned that CVE-2026-76519 (CVSS 9.8), an unauthenticated arbitrary file write in the Advanced Malware Protection feature of Secure Email Gateway, is exploited in the wild. Crafted email attachments can lead to root command execution when file reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Fixes shipped September 14 in AsyncOS 15.5.5-014 and 16.5.0-780. Cisco published IoCs, advises rebuilding virtual appliances and rotating credentials, and CISA added the flaw to KEV. It is the second exploited SEG bug since mid-September, after CVE-2026-76461.

Cisco Secure Email GatewayCisco AsyncOSCVSS

CVE-2026-76519CVE-2026-76461CVE-2026-76440+3

Threat Intel, Blue Team & Detection· Published and added 15 Oct 2026

securityweek.comarticle🛡️ Security

ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

Roundup of ICS Patch Tuesday advisories. Siemens published 17 advisories, including critical flaws in Simatic S7-1500 CPUs (400+ flaws in the GNU/Linux subsystem), Industrial Edge and Ruggedcom Crossbow SAC. Rockwell fixed a critical 1732E ArmorBlock flaw that lets an unauthenticated attacker change the web server password and take over the admin account, plus a DoS bug. Also covered: two high-severity Schneider Electric advisories (Pro-Face STW6000/Harmony STW6 and Sage RTUs), CISA and CERT@VDE advisories, and other vendor advisories since the last Patch Tuesday. ABB's dynovaPRO credential-reset bypass came with 26 password change events across 9 customers that may indicate reconnaissance.

Simatic S7-1500Ruggedcom1732E ArmorBlock+2

SiemensSchneider ElectricRockwell Automation+13

Hardware & RF, other· Published and added 14 Oct 2026

securityweek.comarticle🛡️ Security

Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

SecurityWeek reports Microsoft's October 2026 Patch Tuesday fixed a record 1,413 CVEs (1,102 in Windows, 134 Office, 36 SharePoint), more than all of 2025, with the surge attributed largely to AI-driven discovery. The exploited zero-day CVE-2026-96951 is a Windows shell Mark of the Web security feature bypass (CVSS 8.8), added to CISA KEV with an October 16 deadline. Two flaws were publicly disclosed: CVE-2026-108398 (WDAC bypass) and CVE-2026-92707 (MessagePack-CSharp DoS), and Microsoft introduced 'risk cohorts' for patch prioritization.

WindowsWindows Defender.NET+2

CVE-2026-96951CVE-2026-108398CVE-2026-92707+5

Threat Intel, Blue Team & Detection· Published and added 14 Oct 2026

Showing 30 of 64