Tag: cisa
-
CISA gives feds 3 days to patch actively exploited BeyondTrust flaw
CISA ordered U.S. government agencies on Friday to secure their BeyondTrust Remote Support instances against an actively exploited vulnerability within three days. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-beyondtrust-flaw-within-three-days/
-
Critical Airleader Vulnerability Exposes Systems to Exploitable Remote Attacks
Tags: attack, cisa, control, cve, cvss, cyber, flaw, infrastructure, remote-code-execution, risk, software, vulnerabilityA critical security vulnerability in Airleader Master software has been disclosed by CISA, exposing industrial control systems across multiple critical infrastructure sectors to potential remote code execution attacks. The flaw, tracked as CVE-2026-1358, affects versions up to and including 6.381 and carries a maximum CVSS score of 9.8, indicating severe risk to affected systems. The…
-
CISA Issues Alert on ZLAN ICS Flaws Enabling Full Device Takeover
Tags: advisory, cisa, cyber, cybersecurity, flaw, infrastructure, network, technology, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical advisory regarding significant security flaws discovered in industrial networking equipment manufactured by ZLAN Information Technology Co. The alert, identified as ICSA-26-041-02, focuses on the ZLAN5143D serial-to-Ethernet device server, a component widely utilized to bridge legacy serial devices with modern network infrastructure. These vulnerabilities pose…
-
Don’t panic over CISA’s KEV list, use it smarter
In this Help Net Security video, Tod Beardsley, VP of Security Research at runZero, explains what CISA’s Known Exploited Vulnerabilities (KEV) Catalog is and how security … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/16/cisa-kev-catalog-video/
-
Security Affairs newsletter Round 563 by Pierluigi Paganini INTERNATIONAL EDITION
Tags: attack, breach, cisa, data, data-breach, email, fintech, flaw, international, phishing, WeeklyReviewA new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Fintech firm Figure disclosed data breach after employee phishing attack U.S. CISA adds a flaw in…
-
U.S. CISA adds a flaw in BeyondTrust RS and PRA to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BeyondTrust RS and PRA to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an BeyondTrust RS and PRA vulnerability, tracked as CVE-2026-1731 (CVSS score of 9.9), to its Known Exploited Vulnerabilities (KEV) catalog. This week BeyondTrust released security updates to…
-
U.S. CISA adds a flaw in BeyondTrust RS and PRA to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BeyondTrust RS and PRA to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an BeyondTrust RS and PRA vulnerability, tracked as CVE-2026-1731 (CVSS score of 9.9), to its Known Exploited Vulnerabilities (KEV) catalog. This week BeyondTrust released security updates to…
-
CISA orders federal agencies to patch exploited SolarWinds, Apple, Microsoft bugs within weeks
The Cybersecurity and Infrastructure Security Agency (CISA) added ten new vulnerabilities to its catalog of exploited bugs this week, forcing all federal civilian agencies to resolve the issues by the first week of March. First seen on therecord.media Jump to article: therecord.media/cisa-orders-federal-agencies-to-patch-solarwinds-microsoft-apple-bugs
-
CISA orders federal agencies to patch exploited SolarWinds, Apple, Microsoft bugs within weeks
The Cybersecurity and Infrastructure Security Agency (CISA) added ten new vulnerabilities to its catalog of exploited bugs this week, forcing all federal civilian agencies to resolve the issues by the first week of March. First seen on therecord.media Jump to article: therecord.media/cisa-orders-federal-agencies-to-patch-solarwinds-microsoft-apple-bugs
-
CISA flags critical Microsoft SCCM flaw as exploited in attacks
CISA ordered federal agencies on Thursday to secure their systems against a critical Microsoft Configuration Manager vulnerability patched in October 2024 and now exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-flags-microsoft-configmgr-rce-flaw-as-exploited-in-attacks/
-
U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws…
-
CISA Alerts Users to Notepad++ Flaw Allowing Code Execution
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the popular Notepad++ text editor to its Known Exploited Vulnerabilities catalog, warning users of a flaw that could allow attackers to execute malicious code on affected systems. Tracked as CVE-2025-15556, the vulnerability affects Notepad++’s WinGUp updater component and stems from downloading code without…
-
CISA Issues Urgent Warning on Microsoft Configuration Manager SQL Injection Vulnerability Under Active Exploitation
Tags: cisa, cyber, cybersecurity, exploit, flaw, infrastructure, injection, kev, microsoft, risk, sql, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SQL injection vulnerability in Microsoft Configuration Manager to its Known Exploited Vulnerabilities (KEV) catalogue. The threat actors are actively exploiting the flaw in the wild. The addition signals immediate risk to organisations using the enterprise management platform. SQL Injection Enables Command Execution Tracked as…
-
Breach Roundup: CISA Flags OT Risks After Polish Grid Hack
Also: Spanish Hacker Granted Russian Asylum, Microsoft Patches Zero-Days. This week, a CISA warning, Nest footage in Nancy Guthrie case, Signal phishing. Spanish hacker, Russian asylum. Spanish ministry services offline. BYOVD ransomware. The Conduent breach hit Volvo. Microsoft patched zero-days. ZeroDayRAT targeted devices. The SmarterMail breach. Another Fortinet flaw. First seen on govinfosecurity.com Jump to…
-
CISA will shutter some missions to prioritize others
Tags: cisaThe agency has lost roughly one-third of its workforce since January 2025. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-cybersecurity-division-reorganization/812155/
-
Microsoft’s February Patch Tuesday Fixes 6 Zero-Days Under Attack
Microsoft patches 58 vulnerabilities, including six actively exploited zero-days across Windows, Office, and RDP, as CISA sets a March 3 deadline. The post Microsoft’s February Patch Tuesday Fixes 6 Zero-Days Under Attack appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-patch-tuesday-six-zero-days-february-2026/
-
CISA to host industry feedback sessions on cyber incident reporting regulation
One industry official told CyberScoop the town halls are probably not what CIRCIA needs right now. First seen on cyberscoop.com Jump to article: cyberscoop.com/cisa-circia-town-halls-cyber-incident-reporting-rule/
-
CISA seeks infrastructure sector consultation on incident reporting rule
The agency is particularly interested in feedback on several aspects of the long-awaited regulation. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-circia-incident-reporting-regulation-town-halls/812092/
-
DHS Funding Lapse Would Sideline Federal Cyber Staff
Acting Chief Tells Lawmakers Most Staff Would Be Furloughed Amid Partial Shutdown. More than half of the U.S. cyber defense agency’s workforce would be furloughed under a DHS funding lapse, the agency’s acting chief warned Wednesday, pausing incident reporting rulemaking, security assessments and proactive cyber programs while significantly limiting operations. First seen on govinfosecurity.com Jump…
-
Acting CISA chief says DHS funding lapse would limit, halt some agency work
Acting Director Madhu Gottumukkala said it could affect everything from responding to threats to finalizing CIRCIA regulations. First seen on cyberscoop.com Jump to article: cyberscoop.com/cisa-shutdown-impact-dhs-funding-testimony/
-
Interim CISA chief: ‘When the government shuts down, cyber threats do not’
A shutdown would “degrade our capacity to provide timely and actionable guidance to help partners defend their networks,” acting CISA Director Madhu Gottumukkala told the House Appropriations Homeland Security subcommittee. First seen on therecord.media Jump to article: therecord.media/interim-cisa-chief-tells-congress-threats-continue-during-shutdown
-
Interim CISA chief: ‘When the government shuts down, cyber threats do not’
A shutdown would “degrade our capacity to provide timely and actionable guidance to help partners defend their networks,” acting CISA Director Madhu Gottumukkala told the House Appropriations Homeland Security subcommittee. First seen on therecord.media Jump to article: therecord.media/interim-cisa-chief-tells-congress-threats-continue-during-shutdown
-
Interim CISA chief: ‘When the government shuts down, cyber threats do not’
A shutdown would “degrade our capacity to provide timely and actionable guidance to help partners defend their networks,” acting CISA Director Madhu Gottumukkala told the House Appropriations Homeland Security subcommittee. First seen on therecord.media Jump to article: therecord.media/interim-cisa-chief-tells-congress-threats-continue-during-shutdown
-
Polish power grid hack offers lessons for critical infrastructure operators, CISA says
The agency listed several steps businesses could take to prevent similar cyberattacks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-critical-infrastructure-warning-poland-energy-hack/811819/
-
After major Poland energy grid cyberattack, CISA issues warning to U.S. audience
Tags: attack, cisa, control, cyberattack, cybersecurity, infrastructure, technology, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency said the attack highlighted threats from vulnerable edge devices to operational technology and industrial control systems. First seen on cyberscoop.com Jump to article: cyberscoop.com/cisa-warning-russian-cyberattack-poland-power-grid/
-
US Agencies Told to Scrap End of Support Edge Devices
CISA has issued a new directive requiring federal agencies to decommission all end of support edge devices within 12 months to reduce ongoing exploitation risks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/us-agencies-scrap-end-of-support/
-
Security Affairs newsletter Round 562 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Italian university La Sapienza still offline to mitigate recent cyber attack CISA pushes Federal agencies to…
-
CISA pushes Federal agencies to retire endsupport edge devices
CISA ordered U.S. federal agencies to improve management of edge network devices and replace unsupported ones within 1218 months. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) instructed U.S. federal civilian agencies to strengthen how they manage edge network devices throughout their lifecycle. According to Binding Operational Directive 26-02,”¯Mitigating Risk From End-of-Support Edge”¯Devices, agencies must…
-
CISA warns of SmarterMail RCE flaw used in ransomware attacks
Tags: attack, cisa, cve, cybersecurity, flaw, infrastructure, ransomware, rce, remote-code-executionThe Cybersecurity & Infrastructure Security Agency (CISA) in the U.S. has issued a warning about CVE-2026-24423, an unauthenticated remote code execution (RCE) flaw in SmarterMail that is used in ransomware attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-smartermail-rce-flaw-used-in-ransomware-attacks/
-
Data Tool to Triage Exploited Vulnerabilities Can Make KEV More Useful
A disconnect exists between the organization’s cybersecurity needs and lists like CISA’s KEV Catalog. KEV Collider combines data from multiple open source vulnerability frameworks to help security teams quickly assess which are important, based on their priorities. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/data-tool-triage-exploited-vulnerabilities-make-kev-catalog-more-useful