CISA
Every development involving CISA covered by Laurenceo Intelligence, the daily AI intelligence briefing published in Bermuda: what happened, sourced to the original reporting and announcements, why it matters for organisations and markets, and how it connects to Defense and National Security, Cybersecurity and AI Threats and Government and National Security.
38 developments tracked since 27 September 2026, most recently 29 October 2026.
Coverage
- CISA adds PHP2Shell flaws to exploited-vulnerabilities catalog with a short federal deadline 29 October 2026
PHP underpins a large share of web-facing applications, so exposure extends to embedded runtimes in hosting panels and vendor software that organisations may not inventory as PHP. A short federal deadline signals... - US government warns critical PHP web flaws are now being exploited in the wild 28 October 2026
Exploitation of unauthenticated remote-code-execution flaws in a widely used web language leaves little room for routine patch cycles. Organisations should inventory PHP-based applications, including third-party and... - CISA adds PHP 'php2shell' remote code execution flaws to Known Exploited Vulnerabilities catalog 27 October 2026
Unauthenticated remote code execution in a language that underpins a very large share of web applications and content management systems means exposure is broad and the window between disclosure and compromise is... - CISA flags actively exploited critical flaws in Arista VeloCloud Orchestrator and Collabora Online 27 October 2026
Network orchestration and document collaboration platforms sit close to credentials and internal traffic, so a compromise there can become a route to wider access. Organisations that self-host these products should... - CISA warns Plex Media Server flaws are exploited as a chain; federal deadline set for 23 October 25 October 2026
Patch queues ordered by individual severity score can leave moderate flaws waiting while they are combined into a critical compromise. Security teams should check for consumer-grade or unmanaged software such as media... - CISA and NSA urge immediate patching of critical PHP remote code execution flaws (php2shell) 24 October 2026
PHP is often embedded inside other software, so the hard part is finding every instance, not applying the fix. Organizations that have not yet mapped their PHP exposure, including third-party and vendor-managed... - CISA urges immediate patching of critical 'php2shell' PHP flaws leaked before a fix existed 22 October 2026
The leak removed the usual head start defenders get from coordinated disclosure, so internet-facing PHP systems should be treated as potentially exposed since 20 October, not just since the patch date. The hardest... - US, UK and German agencies issue joint #StopRansomware advisory on SafePay 22 October 2026
Six agencies across three countries putting their names to one advisory signals that SafePay is an established operator that law enforcement prioritises, not an opportunistic newcomer. Security teams should run the... - CISA issues #StopRansomware advisory on SafePay group targeting businesses and critical infrastructure 21 October 2026
The cited vulnerabilities are years old, so exposure to SafePay is mainly a sign of patching and credential hygiene failures rather than a novel threat. Security teams should confirm remediation of the listed CVEs on... - CISA adds six actively exploited vulnerabilities to KEV catalog, some with three-day deadlines 21 October 2026
A three-day remediation window combined with a forensic triage requirement assumes that patching alone may not be enough, because systems may already be compromised. Private-sector vulnerability programmes that... - CISA adds exploited Fortinet and BeyondTrust flaws to KEV as PEERSTITCH edge malware is disclosed 19 October 2026
A fix that has been available for six months did not prevent exploitation, which suggests exposed appliances remain unpatched or were compromised before patching. Memory-resident implants on edge devices may not appear... - CISA flags exploited Palo Alto PAN-OS, Cisco Secure Email Gateway and Ahsay flaws 19 October 2026
A three-day remediation window indicates how urgently CISA rates these flaws, and private organisations should work to a similar timeline. Root-level code execution on a firewall gives an attacker control of the device... - CISA urges immediate patching of exploited BeyondTrust Remote Support authentication bypass 18 October 2026
Remote support platforms hold standing privileged access to large numbers of endpoints, so a compromised instance gives an attacker the reach of an IT administrator. Organisations running self-hosted versions should... - CISA adds exploited Palo Alto PAN-OS, Cisco Secure Email Gateway and Ahsay flaws to KEV catalog 18 October 2026
Firewalls and email gateways sit at the edge of the network, and root access on them lets an attacker watch or redirect traffic while evading the controls those devices provide. Because the PAN-OS flaw requires... - CISA urges immediate patching of exploited Ivanti Connect Secure flaw that may evade Ivanti's own integrity tool 16 October 2026
Patching closes the door but does not establish whether an attacker is already inside, and the vendor's own check cannot be relied on to answer that question. Organisations running these gateways should commission... - CISA flags actively exploited flaws in Palo Alto PAN-OS, Cisco Secure Email Gateway and Ahsay backup 16 October 2026
Firewalls, email gateways and backup servers sit at the trust boundaries attackers most want to own, and backup compromise directly undermines ransomware recovery. A deadline of days rather than weeks is CISA's signal... - CISA adds actively exploited Microsoft Windows command injection flaw CVE-2026-96951 to KEV catalog 16 October 2026
An exploited Windows flaw touches almost every enterprise estate, so this belongs at the top of this week's patch cycle alongside the edge-device fixes. The BOD 26-04 criteria (exploited, publicly exposed, full control... - CISA urges immediate patching of exploited Ivanti Connect Secure flaw CVE-2026-104935 15 October 2026
Remote-access gateways sit at the network perimeter, so active exploitation calls for same-day verification of version status on every affected appliance, not a scheduled patch cycle. Organisations still running the... - CISA urges immediate patching of exploited Ivanti Connect Secure zero-day 14 October 2026
An unauthenticated command execution flaw in a remote access gateway is already a breach path, so patching alone is not enough. Organisations running affected versions should treat credentials that passed through the... - CISA expands alert on exploited Citrix NetScaler ADC and Gateway zero-days 13 October 2026
When the list of exploited flaws in an edge appliance keeps growing, a single patch cycle is unlikely to be enough. Organisations using NetScaler for remote access should confirm remediation of every listed CVE, run... - CISA adds five Flax Typhoon-exploited flaws, some a decade old, to KEV catalog 13 October 2026
Four of the five flaws date from 2015 to 2021, showing that state-linked actors still find unpatched legacy components worth exploiting. Asset inventories should be checked for these specific products, including... - CISA adds five Flax Typhoon-exploited flaws to KEV catalog, including a 2015 ProFTPD bug 12 October 2026
A state-linked actor is exploiting a flaw catalogued in 2015, which means legacy services remain a viable entry point for sophisticated attackers. The federal deadline has now passed, but private organisations should... - Joint FBI, CISA and NSA advisory ties China's Integrity Technology Group to a global data-theft campaign 11 October 2026
The techniques target Exchange servers, VPNs and web applications, which most enterprises run. Security leaders should treat the advisory's mitigations (disabling unused services and ports, sanitising inputs, enforcing... - CISA adds five flaws exploited by Flax Typhoon to its KEV catalog, with an 11 October federal deadline 11 October 2026
A state-linked actor is still exploiting long-known flaws, which suggests that unpatched legacy and edge systems remain a dependable way in. The three-day federal deadline gives private organisations a useful benchmark... - US and allied agencies name China's Integrity Tech as an enabler of global critical infrastructure intrusions 10 October 2026
Naming a commercial contractor shows that state-linked intrusion capability is being supplied as a service, so the same tradecraft can surface across many sectors at once. Security leaders should treat internet-facing... - CISA expands Citrix NetScaler zero-day alert and urges patching of the full CVE set 10 October 2026
A disclosure that keeps widening means organisations that patched early against one CVE may still be exposed to the others. Teams running NetScaler should verify that every appliance is on a build covering the full CVE... - US and allied agencies tie China-based Integrity Tech to global intrusions as FBI seizes linked domains 9 October 2026
Naming and disrupting a commercial contractor signals that allied governments now treat the private supply chain behind state-linked intrusions as a target. For defenders, the practical lesson is that unmonitored edge... - CISA adds actively exploited Citrix NetScaler flaw CVE-2026-88779 to KEV with a three-day deadline 7 October 2026
The federal remediation deadline falls today, and the forensic triage requirement shows CISA treats patching alone as insufficient. Any organisation running NetScaler at the network edge should patch now and also look... - CISA adds another actively exploited Citrix NetScaler flaw to KEV with a three-day deadline 6 October 2026
Three exploited NetScaler flaws in close succession suggest attackers are concentrating on this gateway, so patching alone is not a sufficient response. The forensic triage requirement signals that CISA expects some... - CISA adds exploited Citrix NetScaler flaw and chained Zammad flaws to KEV catalogue 5 October 2026
Because NetScaler appliances sit at the network edge, a three-day federal deadline is a strong prioritisation signal for private-sector teams as well. The forensic triage marking means patching alone is not sufficient... - FortiMail zero-day CVE-2026-104286 under active exploitation; CISA sets a three-day federal deadline 4 October 2026
An email security gateway sits in the path of every inbound and outbound message, so a compromise there threatens confidentiality and trust across the organisation, not a single system. Without a patch to apply... - CISA adds actively exploited Cisco Catalyst SD-WAN Manager authentication bypass to KEV catalogue 2 October 2026
An unauthenticated admin-level bypass on a system that controls network configuration centrally is about as severe as an enterprise vulnerability gets, and the federal deadline is tomorrow. Organisations running... - CISA orders agencies to patch two exploited critical Citrix NetScaler RCE flaws 1 October 2026
The federal deadline has passed, but the exposure applies to any organisation running NetScaler at its perimeter. Applying the patch is not enough: exploitation was under way before fixes shipped, so security teams... - CISA warns of two actively exploited critical zero-days in Citrix NetScaler ADC and Gateway 30 September 2026
NetScaler appliances typically sit at the remote-access and application-delivery edge, so a compromise there can give attackers a foothold ahead of most internal controls. Security leaders should confirm their... - CISA adds two actively exploited critical Citrix NetScaler flaws to KEV; federal deadline 30 September 29 September 2026
NetScaler appliances often serve as the front door for remote access. Unauthenticated exploitation of default configurations should therefore be treated as an emergency change, not held for the next maintenance window.... - CISA discontinues its weekly Vulnerability Bulletin as of 28 September in shift to risk-based prioritisation 29 September 2026
Any organisation whose vulnerability intake depended on the bulletin now has a gap and should assign ownership for direct vendor feeds straight away. The policy shift also signals that severity scores alone are no... - Actively exploited SharePoint flaw CVE-2026-65660 passes CISA's 28 September federal patch deadline 29 September 2026
A fix that sat available for about six weeks before exploitation was confirmed shows the cost of letting patches age in the backlog. The authentication requirement limits the risk less than it seems, because stolen or... - Check Point and F5 flaws actively exploited as CISA adds four vulnerabilities to its KEV catalogue 27 September 2026
All four products sit at the network perimeter, where a single compromise can give attackers management-plane or remote-access footholds. Because CVE-2026-93616 was exploited for weeks before emergency fixes were...
Forecasts
- Will CISA add more than 296 vulnerabilities to its Known Exploited Vulnerabilities catalog during calendar year 2026? (94% by 31 January 2027)
- Will CISA add any vulnerability from Cisco's 7 October 2026 NX-OS, Nexus 3000/9000 or APIC advisories to its KEV catalog by 2027-04-30? (35% by 30 April 2027)
- Will CISA add CVE-2026-109618 or CVE-2026-109619 (php2shell) to its Known Exploited Vulnerabilities catalog by 2026-12-31? (Resolved YES)
Sectors
- Defense and National Security
- Cybersecurity and AI Threats
- Government and National Security
- Infrastructure
- Data Centres and Compute
- Geopolitics, China and AI
- Enterprise AI and Agents
- AI, Work and Skills
- AI Governance and Regulation
Related Organisations
Every Desk
Frontier AI25 storiesLatest: Anthropic IPO filing discloses month-long training pause and four model sandbox escapes
Defense52 storiesLatest: CISA adds PHP2Shell flaws to exploited-vulnerabilities catalog with a short federal deadline
Geopolitics7 storiesLatest: CISA adds five Flax Typhoon-exploited flaws, some a decade old, to KEV catalog
Financial Markets58 storiesLatest: Alphabet Q3: Google Cloud revenue doubles to $30.7bn, capex hits record $51.4bn, free cash flow negative
Infrastructure65 storiesLatest: NVIDIA and Oracle expand Vera Rubin on OCI to multi-gigawatt scale; Vera Rubin NVL72 now available
Regulation46 storiesLatest: Anthropic files S-1 for proposed IPO, plans Nasdaq listing under ANT
Laurenceo Intelligence is the daily AI intelligence briefing published in Bermuda by Laurenceo, founded by Jorai Laurenceo. Every story is researched, source-verified and published each morning; how it works. General information only, not legal, regulatory or financial advice.