Tag: cisa
450 articles
CISA Exposes Security Lapse with Open GitHub Repository
The US's leading cyber-defense agency, CISA, made a shocking security blunder by leaving a GitHub repository open, exposing sensitive passwords, keys, and tokens with alarmingly obvious filenames. This careless mistake raises serious concerns about the agency's ability to protect itself and the nation from cyber threats.
CISA Contractor Exposes AWS GovCloud Keys in GitHub Leak
A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) made a critical mistake by exposing sensitive AWS GovCloud keys, plaintext passwords, and internal files in a public GitHub repository. The leak, described as one of the worst ever witnessed, included highly privileged credentials and build artifacts for numerous internal CISA systems.
Former CISA Nominee Plankey Joins Defense Startup UFORCE as US CEO
Big news in the defense tech space: Sean Plankey, former CISA nominee, has joined UFORCE as US CEO, bringing his expertise in delivering proven combat systems to a company poised to revolutionize defense technology. With his cyber veteran background, Plankey is set to drive innovation and speed in meeting the evolving needs of the US and its allies.
CISA Flags Cisco SD-WAN Vulnerability as Exploited
CISA has flagged a critical Cisco SD-WAN vulnerability, CVE-2026-20182, as exploited, giving federal agencies until May 17, 2026, to patch the authentication bypass flaw that could grant hackers administrative privileges. This vulnerability, scoring 10.0 on the CVSS scale, is now a top priority for remediation.
Global Agencies Unveil AI Supply Chain Risk Guidance with SBOMs
Global agencies have joined forces to release groundbreaking guidance on AI supply chain risk, outlining minimum elements for Software Bill of Materials (SBOMs) to enhance security and transparency. This crucial step forward aims to tackle the complex challenges of measuring and defining AI risks across organizations.
G7 Guidance Sets AI Security Standards
The G7 has set a new benchmark for AI security with the release of voluntary guidelines, outlining the minimum requirements for transparency around AI system components. This move aims to establish a common baseline for the industry, promoting trust and safety in the rapidly evolving AI landscape.
Senator Warns of Election Security Support Erosion
Senator Mark Warner is sounding the alarm on a critical issue: the alarming erosion of federal support for election security just ahead of the 2026 midterms, leaving states and localities vulnerable to threats. He's demanding answers from the Department of Homeland Security and CISA about their current election security posture.
CISA Mandates Patching of Ivanti Flaw Exploited in Zero-Day Attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) is requiring immediate patching of a high-risk Ivanti flaw, CVE-2026-6973, that allows attackers with admin privileges to remotely execute code on vulnerable systems. This critical vulnerability affects Ivanti Endpoint Manager Mobile (EPMM) version 12.8.0.0 and earlier.
CISA's Election Security Support Plummets Ahead of Midterms
As the midterms approach, Senator Mark Warner is sounding the alarm on a concerning decline in federal election security support, warning that states can't go it alone in protecting their elections from growing physical and cyber threats. Without robust federal backing, states are left vulnerable to attacks, despite their best efforts to safeguard the democratic process.
Ivanti EPMM Flaw Exploited, Grants Admin-Level Access
A critical flaw in Ivanti's Endpoint Manager Mobile (EPMM) has been exploited, allowing attackers to gain admin-level access - and the government is taking swift action to mitigate the threat. Federal agencies are now required to remediate the vulnerability, known as CVE-2026-6973, by May 10, 2026.
CISA Launches Framework to Fortify Critical Infrastructure Against Cyber-Attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) has launched CI Fortify, a vital planning framework designed to shield critical infrastructure sectors like water, energy, and transportation from devastating cyber-attacks. This timely guidance helps organizations safeguard their networks and essential services from threat actors seeking to disrupt and degrade infrastructure.
CISA Taps AI Automation to Bolster Threat Analysis Capabilities
With AI automation, CISA analysts can quickly sift through threats, cutting through the noise to focus on what matters most. This tech boost has supercharged their Security Operations Unit, enabling rapid, real-time assessments that help prevent threats from unfolding.
CISA Urges Infrastructure Operators to Plan for Extended Isolation
To stay ahead of potential disruptions, critical infrastructure operators must plan for extended isolation - and CISA's CI Fortify initiative is here to help, offering targeted assessments and operational planning to keep essential services running smoothly.
CISA Launches CI Fortify to Bolster Critical Infrastructure Resilience
CISA has launched CI Fortify, a groundbreaking initiative that empowers critical infrastructure providers to bolster their defenses and ensure uninterrupted delivery of essential services, even in the face of cyber threats. By investing in resilience measures now, infrastructure owners and operators can safeguard against operational gaps and maintain business continuity during periods of cyber duress.
Five Eyes Warns of Autonomous AI Security Risks
As autonomous AI systems increasingly take control, experts warn that a new wave of security risks is emerging - and being prepared is crucial. Having operational visibility into these systems is key to understanding and mitigating potential threats.
Cybercrime Groups Exploit AI for Rapid, High-Impact Attacks
Cybercrime groups are leveraging AI to launch lightning-fast, high-impact attacks, outpacing security patches and leaving devastating consequences in their wake. This week, a critical vulnerability in cPanel and WHM was exploited, leading to website wipes, botnet deployments, and ransomware attacks.
CISA Warns of Active Linux Exploit
A newly discovered Linux kernel bug, dubbed "Copy Fail," allows unprivileged users to gain root privileges on unpatched systems, prompting urgent warnings from CISA and researchers. If your Linux system was built between 2017 and the recent patch, you're at risk - and need to act fast to protect yourself.
Five Eyes Agencies Warn of Agentic AI Risks, Urge Cautious Adoption
As agentic AI systems increasingly power critical infrastructure and defense sectors, Five Eyes agencies are sounding the alarm on the need for careful security planning to mitigate potential risks. They're urging a slow and cautious approach to adopting this powerful technology.
CISA Warns of Actively Exploited Linux Root Access Bug
A nine-year-old Linux kernel bug, known as Copy Fail, is being actively exploited in the wild, allowing unprivileged users to gain root access with a simple 732-byte Python-based exploit. The Cybersecurity and Infrastructure Security Agency has added this vulnerability to its Known Exploited Vulnerabilities catalog, warning of potential security risks.
CISA's Zero Trust Guidance Falls Short on Cost, Implementation Details
While CISA's new zero trust guidance for operational technology is a step in the right direction, it leaves critical questions unanswered - namely, who foots the bill and how do organizations actually implement it? The guidance gets high marks for technical thinking, but falls short on practical details like funding, timelines, and automation.
Vulnerability Exploits Surge Against cPanel and WHM Software
A critical vulnerability, CVE-2026-41940, with a near-perfect severity score of 9.8, has been discovered in cPanel and WHM software, allowing hackers to bypass authentication and gain unauthorized access to your control panel. This flaw puts your online security at risk, so taking immediate action is crucial.
CISA Rebounds as Funding Deal Bolsters Cyber Defenses
With the record 75-day shutdown finally over, the Cybersecurity and Infrastructure Security Agency can breathe a sigh of relief as a new funding deal brings its operations back to normal, bolstering the nation's cyber defenses. The bipartisan measure provides a much-needed $64.4 billion in discretionary funding for the Department of Homeland Security.
US Agencies Issue Zero Trust Guidance for OT Security
US government agencies have just released a game-changing guide to help protect critical infrastructure systems with practical, layered security strategies. The new zero-trust guidance provides a tailored approach for operational technology environments, balancing safety and uptime needs with robust security measures.
Microsoft Patch Fails to Quell Russian Spy Exploitation of Windows Flaw
Microsoft's latest patch isn't enough to stop Russian spies from exploiting a Windows flaw, leaving sensitive information vulnerable to exposure. The incomplete fix is linked to a previously patched vulnerability from February, highlighting the urgent need for a more robust solution.