Tag: cisa
-
Actively Exploited WSUS Bug Added to CISA KEV List
Sysadmins are urged to patch WSUS vulnerability CVE-2025-59287 as soon as possible, with federal agencies required to update by November 14 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/actively-exploited-wsus-bug-cisa/
-
CISA Alerts on Critical Veeder-Root Flaws Allowing Attackers to Execute System Commands
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert regarding serious vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System. Released on October 23, 2025, the alert warns that attackers could exploit these flaws to take control of industrial systems used worldwide, particularly in the energy sector. Two Critical Vulnerabilities Discovered Security…
-
CISA orders feds to patch Windows Server WSUS flaw used in attacks
Tags: attack, cisa, cybersecurity, exploit, flaw, government, infrastructure, service, update, vulnerability, windowsThe Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. government agencies to patch a critical-severity Windows Server Update Services (WSUS) vulnerability after adding it to its catalog of security flaws exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/
-
CISA orders feds to patch Windows Server WSUS flaw used in attacks
Tags: attack, cisa, cybersecurity, exploit, flaw, government, infrastructure, service, update, vulnerability, windowsThe Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. government agencies to patch a critical-severity Windows Server Update Services (WSUS) vulnerability after adding it to its catalog of security flaws exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/
-
CISA releases warning about Windows Server Update Service bug, orders agencies to patch
A “prior update did not fully mitigate” a flaw in Windows Server Update Service, CISA said in an alert to federal agencies and businesses First seen on therecord.media Jump to article: therecord.media/wsus-vulnerability-cisa-late-friday-warning
-
Ex-CISA head thinks AI might fix code so fast we won’t need security teams
Jen Easterly says most breaches stem from bad software, and smarter tech could finally clean it up First seen on theregister.com Jump to article: www.theregister.com/2025/10/27/jen_easterly_ai_cybersecurity/
-
CISA Beware! Hackers Are Actively Exploiting Windows Server Update Services RCE Flaw in the Wild
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, flaw, hacker, microsoft, rce, remote-code-execution, service, update, vulnerability, windowsCybersecurity researchers are sounding the alarm after discovering that hackers are actively exploiting a critical remote code execution (RCE) vulnerability in Microsoft’s Windows Server Update Services (WSUS). The flaw, tracked as CVE-2025-59287, allows unauthenticated attackers to run arbitrary code on vulnerable servers, and evidence suggests that these attacks are being carried out manually, a technique…
-
How CISA Layoffs Weaken Civilian Cyber Defense
Cyber teams need to get to work backfilling diminishing federal resources, according to Alexander Garcia-Tobar, who shares clear steps on a path forward for protecting enterprises with less CISA help. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/cisa-layoffs-weaken-civilian-cyber-defense
-
U.S. CISA adds Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog
Tags: adobe, cisa, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, open-source, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below the list of flaws added to the…
-
CISA warns of Lanscope Endpoint Manager flaw exploited in attacks
The Cybersecurity & Infrastructure Security Agency (CISA) is warning that hackers are exploiting a critical vulnerability in the Motex Landscope Endpoint Manager. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-lanscope-endpoint-manager-flaw-exploited-in-attacks/
-
Amid CISA cuts, US state launches first VDP
Legislators in Annapolis, Maryland, have teamed up with Bugcrowd to launch a statewide vulnerability disclosure programme First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366633479/Amid-CISA-cuts-US-state-launches-first-VDP
-
CISA Flags Critical Lanscope Bug
CISA urges immediate patching for critical Lanscope flaw. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/cisa-flags-critical-lanscope-bug/
-
CISA Flags Critical Lanscope Bug
CISA urges immediate patching for critical Lanscope flaw. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/cisa-flags-critical-lanscope-bug/
-
House Democrats Push Back at Reassignments, Firings of CISA Employees
Democrats in Congress are continuing to target the Trump Administrations actions with CISA, with the latest effort being a letter from House Democrats arguing the firing some employees and moving others to help with the president’s expansive immigration and deportation operations weaken the country’s security at a time when China’s cyber intrusions are accelerating. First…
-
U.S. CISA adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Motex LANSCOPE flaw, tracked as CVE-2025-61932 (CVSS v4 score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is an improper verification of source of a communication…
-
F5 vulnerability highlights weak points in DHS’s CDM program
The Continuous Diagnostics and Mitigation program is oft-praised, but there are areas where it doesn’t yet excel, as a recent CISA emergency directive shows. First seen on cyberscoop.com Jump to article: cyberscoop.com/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program/
-
F5 vulnerability highlights weak points in DHS’s CDM program
The Continuous Diagnostics and Mitigation program is oft-praised, but there are areas where it doesn’t yet excel, as a recent CISA emergency directive shows. First seen on cyberscoop.com Jump to article: cyberscoop.com/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program/
-
Critical Lanscope Endpoint Manager Bug Exploited in Ongoing Cyberattacks, CISA Confirms
Tags: cisa, cve, cyberattack, cybersecurity, endpoint, exploit, flaw, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting Motex Lanscope Endpoint Manager to its Known Exploited Vulnerabilities (KEV) catalog, stating it has been actively exploited in the wild.The vulnerability, CVE-2025-61932 (CVSS v4 score: 9.3), impacts on-premises versions of Lanscope Endpoint Manager, specifically Client First seen on thehackernews.com…
-
Report: US Cyber Defense Declines, First Time in 5 Years
CISA Budget and Staffing Cuts Undermine National Cyber Readiness, Officials Warn. Federal cybersecurity reforms have regressed for the first time since 2020, as staffing cuts, diminished agency authority and lost momentum threaten U.S. cyber resilience, according to the Cyberspace Solarium Commission’s 2025 report, which urges immediate action from the White House and Congress. First seen…
-
CISA’s international, industry and academic partnerships slashed
The latest round of sweeping layoffs could hamper the business community’s collaboration with the beleaguered cyber agency. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-stakeholder-engagement-division-layoffs-critical-infrastructure-international/803433/
-
CISA’s international, industry and academic partnerships slashed
The latest round of sweeping layoffs could hamper the business community’s collaboration with the beleaguered cyber agency. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-stakeholder-engagement-division-layoffs-critical-infrastructure-international/803433/
-
CISA Flags Highly Exploitable Windows SMB Flaw
Tags: attack, cisa, cybersecurity, exploit, flaw, infrastructure, microsoft, mitigation, network, ntlm, windowsNTLM Reflection Attack Strikes Again. A three-month old flaw in a network protocol for file sharing used by Microsoft is under active exploitation, warns the U.S. Cybersecurity and Infrastructure Security Agency. The flaw’s exploitation bypasses mitigations Microsoft has built over the years to prevent NTLM reflection attacks. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cisa-flags-highly-exploitable-windows-smb-flaw-a-29778
-
Oracle E-Business Suite Vulnerability Exploited In Ransomware Attacks
Tags: attack, business, cisa, cybersecurity, exploit, infrastructure, oracle, ransomware, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that a vulnerability impacting Oracle E-Business Suite customers has seen exploitation in ransomware attacks. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-oracle-e-business-suite-vulnerability-exploited-in-ransomware-attacks
-
CISA confirms hackers exploited Oracle E-Business Suite SSRF flaw
CISA has confirmed that an Oracle E-Business Suite flaw tracked as CVE-2025-61884 is being exploited in attacks, adding it to its Known Exploited Vulnerabilities catalog. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/
-
U.S. CISA adds Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities catalog
Tags: apple, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, oracle, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities (KEV) catalog. Oracle recently released an emergency patch to address an information disclosure flaw, tracked as CVE-2025-61884 (CVSS…
-
CISA warns of Windows SMB flaw under active exploitation (CVE-2025-33073)
CVE-2025-33073, a Windows SMB Client vulnerability that Microsoft fixed in June 2025, is being exploited by attackers. The confirmation comes from the Cybersecurity and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/21/cisa-warns-of-windows-smb-flaw-under-active-exploitation-cve-2025-33073/
-
Mikrosegmentierung in Zero-Trust-Umgebungen die Integration von richtliniengesteuerten Zugriffen
Die kürzlich veröffentlichte Leitlinie der CISA (Cybersecurity and Infrastructure Security Agency), »Mikrosegmentierung in Zero Trust Teil 1: Einführung und Planung«, bestätigt, dass Mikrosegmentierung eine grundlegende Voraussetzung für Zero Trust ist [1]. Anstatt die Mikrosegmentierung für eine fortgeschrittene Phase von Zero-Trust-Initiativen aufzuheben, können und sollten Unternehmen die granulare Segmentierung als Kernbaustein der Zero-Trust-Architektur priorisieren. Der… First…
-
Mikrosegmentierung in Zero-Trust-Umgebungen die Integration von richtliniengesteuerten Zugriffen
Die kürzlich veröffentlichte Leitlinie der CISA (Cybersecurity and Infrastructure Security Agency), »Mikrosegmentierung in Zero Trust Teil 1: Einführung und Planung«, bestätigt, dass Mikrosegmentierung eine grundlegende Voraussetzung für Zero Trust ist [1]. Anstatt die Mikrosegmentierung für eine fortgeschrittene Phase von Zero-Trust-Initiativen aufzuheben, können und sollten Unternehmen die granulare Segmentierung als Kernbaustein der Zero-Trust-Architektur priorisieren. Der… First…
-
CISA Warns of Active Exploitation of Critical Windows SMB Flaw CVE-2025-33073
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a high-severity Windows vulnerability, tracked as CVE-2025-33073. This flaw, rooted in the Server Message Block (SMB) protocol, enables attackers to escalate privileges to SYSTEM level on vulnerable Windows devices, potentially granting full control over affected systems. First seen…
-
CISA Warns of Active Exploitation of Critical Windows SMB Flaw CVE-2025-33073
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a high-severity Windows vulnerability, tracked as CVE-2025-33073. This flaw, rooted in the Server Message Block (SMB) protocol, enables attackers to escalate privileges to SYSTEM level on vulnerable Windows devices, potentially granting full control over affected systems. First seen…