Latest CISA news

CISA warns of Microsoft Streaming bug exploited in malware attacks

CISA ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their Windows systems against a high-severity vulnerability in the Microsoft Streaming Service (MSKSSRV.SYS) that's actively exploited in attacks.
- Sergiu Gatlan
- March 01, 2024
- 02:18 PM
- 0
CISA cautions against using hacked Ivanti VPN gateways even after factory resets

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed today that attackers who hack Ivanti VPN appliances using one of multiple actively exploited vulnerabilities may be able to maintain root persistence even after performing factory resets.
- Sergiu Gatlan
- February 29, 2024
- 03:35 PM
- 1
FBI, CISA warn US hospitals of targeted BlackCat ransomware attacks

Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare organizations of targeted ALPHV/Blackcat ransomware attacks.
- Sergiu Gatlan
- February 27, 2024
- 05:26 PM
- 0
Russian hackers shift to cloud attacks, US and allies warn

Members of the Five Eyes (FVEY) intelligence alliance warned today that APT29 Russian Foreign Intelligence Service (SVR) hackers are now switching to attacks targeting their victims' cloud services.
- Sergiu Gatlan
- February 26, 2024
- 12:31 PM
- 0
Microsoft expands free logging capabilities after May breach

Microsoft has expanded free logging capabilities for all Purview Audit standard customers, including U.S. federal agencies, six months after disclosing that Chinese hackers stole U.S. government emails undetected in an Exchange Online breach between May and June 2023.
- Sergiu Gatlan
- February 21, 2024
- 05:31 PM
- 4
US govt shares cyberattack defense tips for water utilities

CISA, the FBI, and the Environmental Protection Agency (EPA) shared a list of defense measures U.S. water utilities should implement to better defend their systems against cyberattacks
- Sergiu Gatlan
- February 21, 2024
- 01:39 PM
- 1
CISA: Roundcube email server bug now exploited in attacks

CISA warns that a Roundcube email server vulnerability patched in September is now actively exploited in cross-site scripting (XSS) attacks.
- Sergiu Gatlan
- February 12, 2024
- 02:03 PM
- 0
New Fortinet RCE bug is actively exploited, CISA confirms

CISA confirmed today that attackers are actively exploiting a critical remote code execution (RCE) bug patched by Fortinet on Thursday.
- Sergiu Gatlan
- February 09, 2024
- 04:02 PM
- 3
CISA orders federal agencies to disconnect Ivanti VPN appliances by Saturday

CISA has ordered U.S. federal agencies to disconnect all Ivanti Connect Secure and Policy Secure VPN appliances vulnerable to multiple actively exploited bugs before Saturday.
- Sergiu Gatlan
- February 01, 2024
- 08:49 AM
- 0
CISA warns of patched iPhone kernel bug now exploited in attacks

CISA warned today that a patched kernel security flaw affecting Apple iPhones, Macs, TVs, and watches is now being actively exploited in attacks.
- Sergiu Gatlan
- January 31, 2024
- 02:02 PM
- 0
CISA: Vendors must secure SOHO routers against Volt Typhoon attacks

CISA has urged manufacturers of small office/home office (SOHO) routers to ensure their devices' security against ongoing attacks attempting to hijack them, especially those coordinated by Chinese state-backed hacking group Volt Typhoon (Bronze Silhouette).
- Sergiu Gatlan
- January 31, 2024
- 11:14 AM
- 0
CISA emergency directive: Mitigate Ivanti zero-days immediately

CISA issued this year's first emergency directive ordering Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate two Ivanti Connect Secure and Ivanti Policy Secure zero-day flaws in response to widespread and active exploitation by multiple threat actors.
- Sergiu Gatlan
- January 19, 2024
- 02:25 PM
- 0
CISA: Critical Ivanti auth bypass bug now actively exploited

CISA warns that a critical authentication bypass vulnerability in Ivanti's Endpoint Manager Mobile (EPMM) and MobileIron Core device management software (patched in August 2023) is now under active exploitation.
- Sergiu Gatlan
- January 18, 2024
- 03:51 PM
- 0
CISA pushes federal agencies to patch Citrix RCE within a week

Today, CISA ordered U.S. federal agencies to secure their systems against three recently patched Citrix NetScaler and Google Chrome zero-days actively exploited in attacks.
- Sergiu Gatlan
- January 17, 2024
- 01:31 PM
- 0
CISA: Critical Microsoft SharePoint bug now actively exploited

CISA warns that attackers are now exploiting a critical Microsoft SharePoint privilege escalation vulnerability that can be chained with another critical bug for remote code execution.
- Sergiu Gatlan
- January 12, 2024
- 02:24 PM
- 0
CISA warns agencies of fourth flaw used in Triangulation spyware attacks

The U.S. Cybersecurity and Infrastructure Security Agency has added to its to the Known Exploited Vulnerabilities catalog six vulnerabilities that impact products from Adobe, Apache, D-Link, and Joomla.
- Bill Toulas
- January 09, 2024
- 02:32 PM
- 0
CISA warns of actively exploited bugs in Chrome and Excel parsing library

The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to the Known Exploited Vulnerabilities catalog, a recently patched flaw in Google Chrome and a bug affecting an open-source Perl library for reading information in an Excel file called Spreadsheet::ParseExcel.
- Bill Toulas
- January 03, 2024
- 07:55 AM
- 0
FBI: ALPHV ransomware raked in $300 million from over 1,000 victims

The ALPHV/BlackCat ransomware gang has made over $300 million in ransom payments from more than 1,000 victims worldwide as of September 2023, according to the Federal Bureau of Investigation (FBI).
- Sergiu Gatlan
- December 19, 2023
- 02:32 PM
- 0
FBI: Play ransomware breached 300 victims, including critical orgs

The Federal Bureau of Investigation (FBI) says the Play ransomware gang has breached roughly 300 organizations worldwide between June 2022 and October 2023, some of them critical infrastructure entities.
- Sergiu Gatlan
- December 18, 2023
- 11:24 AM
- 0
CISA urges tech manufacturers to stop using default passwords

Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged technology manufacturers to stop providing software and devices with default passwords.
- Sergiu Gatlan
- December 15, 2023
- 02:01 PM
- 1