Tag: cisa
450 articles
US Weakens Foreign Influence Tracking Ahead of Midterms
As the midterm elections approach, the US is scaling back its efforts to track foreign influence, despite assurances that election security remains a top priority. The Cybersecurity and Infrastructure Security Agency will still work closely with partners to monitor threats, but several officials say federal relationships crucial to detecting foreign campaigns are dwindling.
CISA Warns of Actively Exploited Ivanti Connect Secure Vulnerability
Warning: a high-severity vulnerability in Ivanti Connect Secure is under active exploitation, putting your systems at risk of remote attacks - don't wait to patch! Federal agencies must apply fixes by October 16, 2026, to stay secure.
CISA Warns of Ivanti Flaw Exploited in Zero-Day Attacks
A high-severity security flaw in Ivanti Connect Secure, known as CVE-2026-104935, has been exploited in zero-day attacks since October 1st, allowing hackers to remotely execute malicious commands without authentication. CISA is urging security teams to patch immediately and hunt for signs of compromise to protect their networks.
CISA Warns of Active Ivanti Connect Secure Exploit Attempts
Warning signs are flashing: 105 attempted hacks have targeted Ivanti Connect Secure systems in a short span, exploiting a severe authentication-bypass bug that lets attackers run malicious commands remotely. This zero-day vulnerability, tracked as CVE-2026-104935, is under active attack, putting unpatched systems at risk.
CISA Warns of Flax Typhoon Exploiting Five Vulnerabilities
Chinese government-affiliated hackers, known as Flax Typhoon, are exploiting five newly identified vulnerabilities to gain a foothold in critical infrastructure networks, including operational technology systems, with the potential to disrupt essential functions at a later time. This has prompted CISA to add these flaws to its Known Exploited Vulnerabilities catalog, triggering a federal remediation requirement.
New Federal Rules to Tighten Contractor Cybersecurity Reporting
Get ready for a seismic shift in cybersecurity reporting: new federal rules will soon require contractors to report unauthorized access to sensitive information within a tight 72-hour window. This stricter timeline aligns with upcoming CISA regulations, putting companies on notice to strengthen their incident response game.
Coalition Pushes CISA for Mandatory OT Security Rules
The Operational Technology Cybersecurity Coalition is urging CISA to set mandatory security rules for operational technology used in over 8,000 federal facilities, including labs, hospitals, and ports, to protect critical systems like HVAC, power, and water. A binding directive would establish much-needed minimum security practices for federal OT systems.
Coalition Urges CISA to Mandate OT Security Standards for Agencies
The Operational Technology Cybersecurity Coalition is urging CISA to set mandatory OT security standards for federal agencies, ensuring the government practices what it preaches when it comes to cybersecurity. By doing so, agencies will have clear responsibility for OT cybersecurity and a baseline for protection.
US Water Systems Face Growing Cyber Threats
US water systems are under siege by cyber threats from hostile nations like China, Russia, Iran, and North Korea, as well as ransomware groups, putting our critical infrastructure at risk of a nationwide public-health crisis. This summer's alarming attacks on water systems in 12 states by Iranian hackers exposed the vulnerability of our water infrastructure to foreign adversaries.
AI Agents Expose New Cybersecurity Risks
As we enter a new era of cybersecurity, CISA warns that AI is supercharging hackers, allowing them to exploit vulnerabilities at lightning speed and putting our country and economy in the crosshairs. It's time for organizations to adapt to this new wave of faster, smarter threats.
CISA Flags Exploited Cisco SD-WAN Flaw
A critical vulnerability in Cisco SD-WAN Manager, known as CVE-2026-76504, has been flagged by CISA and is being actively exploited, allowing hackers to gain admin-level access with a CVSS score of 9.8. This hex encoding flaw could let unauthenticated attackers remotely access and control affected systems.
CISA Warns of Pre-Auth Flaw in MikroTik RouterOS
A critical vulnerability in MikroTik RouterOS, known as CVE-2026-84411, can be exploited with a single crafted request, allowing attackers to execute code with root privileges or cause a denial-of-service condition, even without authentication. This flaw puts your network at risk, and it's essential to take immediate action to protect yourself.
Water Sector Grapples with Cyber Threats as Attacks Persist
The water sector is facing a harsh reality: cyber threats are on the rise, and threat actors are intensifying their attacks as global conflicts escalate. Recent attacks on water facilities have exposed glaring technical and organizational gaps that leave the sector vulnerable.
US Agencies Accelerate 5G for Mission-Critical Operations
US agencies are revolutionizing 5G for mission-critical operations, shifting its purpose from a consumer upgrade to a robust, secure infrastructure. Top officials from the Navy, Department of War, CISA, and industry leaders shared insights on harnessing 5G's potential at the Federal Executive Forum.
CISA Warns of Global Exploitation of Citrix NetScaler Flaws
Threat actors are actively exploiting critical vulnerabilities in Citrix NetScaler ADC and Gateway worldwide, warns the U.S. Cybersecurity and Infrastructure Security Agency (CISA). These flaws, with a near-perfect CVSS score of 9.5, could allow attackers to execute arbitrary commands and wreak havoc on your systems.
Citrix Warns of Critical Vulnerabilities Under Active Attack
Critical vulnerabilities in Citrix NetScaler appliances are under active attack globally, and the Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to patch quickly despite the potential complexity of the update process.
CISA Mandates Patching of Exploited Citrix Flaws
The US government has stepped in, mandating that federal agencies patch two critical Citrix flaws by September 30 to prevent exploitation by malicious actors. This swift action follows the discovery of over 23,000 Internet-facing IP addresses vulnerable to these Citrix NetScaler flaws.
CISA Warns of Active Exploits Targeting SharePoint, MikroTik Flaws
Hackers are actively exploiting critical flaws in Microsoft SharePoint and MikroTik RouterOS, allowing them to gain unauthorized access and take control of systems. Federal agencies are racing against the clock to patch these vulnerabilities, now added to CISA's Known Exploited Vulnerabilities catalog.
CISA Warns of Widespread Exploitation of SharePoint, Adobe Commerce Flaws
Don't wait until it's too late - with nearly 1,000 customers across critical sectors like banking, government, and telecommunications at risk, organizations can't afford to delay action against widespread exploitation of SharePoint and Adobe Commerce flaws. A critical authentication-bypass vulnerability, CVE-2026-5430, is already being exploited, putting multiple WSO2 products at risk.
CISA Unveils Comprehensive Election Security Plan to Counter Evolving Threats
The CISA Election Infrastructure Security Plan is a powerful shield against evolving threats, leveraging partnerships, cyber defenses, and threat intelligence to safeguard the integrity of US elections. By working together, stakeholders can ensure the security and public trust that's fundamental to a healthy democracy.
CISA Flags WSO2, Adobe Commerce Flaws as Actively Exploited
Stay ahead of cyber threats: Federal agencies must patch WSO2 and Adobe Commerce flaws by September 27, 2026, to avoid exploitation, as CISA flags these vulnerabilities as actively exploited. The high-severity bugs, including a path traversal flaw and an authorization issue, can lead to remote code execution and unrestricted file uploads.
Lawmakers Push CISA to Bolster Biotech Cyber Defenses
US lawmakers are taking a crucial step to safeguard America's biotech sector by introducing bills that would boost cyber defenses for this rapidly evolving industry, deemed vital to the nation's economic and national security. The proposed legislation aims to fortify protections for biotech infrastructure, biomanufacturing, and sensitive biological data.
CISA Overhauls CVE Program with Quality-Focused Framework
The CVE Program is getting a major overhaul with a quality-focused framework, marking a new era of prioritizing reliability, responsiveness, and top-notch vulnerability data. CISA is leading the charge by defining quality across four key dimensions: program governance, ecosystem participation, data infrastructure, and CVE record content.
Agencies Flout CISA Cloud Security Directives, Heightening Cyber Risk
A recent report by the DHS Office of Inspector General found that a staggering 86% of federal agencies are failing to comply with cloud security directives, leaving them vulnerable to preventable cyberattacks. This widespread non-compliance puts the entire national cloud security posture at risk.