Do Son CISA, FBI, and HHS issue a joint advisory on Interlock ransomware, active since Sep 2024, targeting businesses and critical infrastructure with double extortion tactics.
CISA
CISA warns of critical flaws in Emerson ValveLink software, exposing cleartext data, allowing code execution, and compromising industrial systems. Update to v14.0 now.
CISA, FBI, NSA, and DC3 warn of potential cyberattacks from Iranian-affiliated actors on vulnerable U.S. infrastructure and networks, urging vigilance despite recent ceasefires.
CISA warns of critical flaws in MICROSENS NMP Web+ (v3.2.5 & earlier), including hardcoded JWTs, persistent sessions, and path traversal (CVSS 9.8 RCE). Update to 3.3.0 now!
CISA, FBI, and NSA call for adopting memory-safe languages (Rust, Go, Java, Swift) to slash software vulnerabilities. Android saw a 52% drop in memory bugs after embracing MSLs.
CISA warns of critical flaws in ControlID iDSecure On-premises, including SQL Injection, auth bypass, and SSRF, risking vehicle access control systems.
CISA warns of critical flaws in Kaleris Navis N4 terminal OS: unauthenticated RCE (CVSS 9.8) via Java deserialization and cleartext data transmission.
CISA warns fuel infrastructure operators of a critical flaw (CVE-2025-5310) in Dover Fueling Solutions ProGauge MagLink devices, risking control
CISA adds two actively exploited zero-days to KEV: an iOS zero-click flaw used by spyware (CVE-2025-43200) and a command injection in TP-Link routers
CISA warns of active exploitation of a SimpleHelp RMM flaw (CVE-2024-57727) by ransomware actors, impacting utility billing software providers and their customers.
CISA adds two critical vulnerabilities to KEV: Erlang/OTP (RCE) and Roundcube (XSS). Actively exploited, these flaws pose severe risks to systems and email accounts.
CISA issues critical warning for CyberData SIP Emergency Intercom (Model 011209) with severe vulnerabilities (CVSS 9.8), risking remote access and code execution. Update now.
CISA adds 3 actively exploited Qualcomm Adreno GPU flaws to KEV catalog. Android devices at risk from memory corruption and use-after-free bugs.
CISA warns of a critical vulnerability (CVE-2025-1907) in Instantel Micromate devices, allowing unauthenticated remote command execution. Immediate action is advised.
CISA adds 5 new exploited vulnerabilities to KEV, including flaws in ASUS routers, Craft CMS, and ConnectWise. Urgent patching required!
CISA warns of critical flaws (CVE-2025-41438, CVE-2025-46352) in Consilium Safety CS5000 Fire Panels, allowing remote access & disruption. Vendor won't patch.
AutomationDirect's MB-Gateway has a critical (CVSS 10) flaw allowing unauthenticated remote access and RCE. Hardware limits prevent a software fix; replacement is recommended.
CISA adds critical DrayTek router, Chrome, and SAP NetWeaver flaws to its KEV list after in-the-wild exploitation. Federal agencies face a June 5th patch deadline.
CISA warns of critical vulnerabilities in Planet Technology products, including command injection and hardcoded credentials, allowing attackers to manipulate devices.
CISA confirms stability of the CVE Program, dispelling funding concerns and reaffirming its commitment to cybersecurity and vulnerability management.
CISA warns of actively exploited vulnerabilities in Apple and Microsoft products. Urgent patching is required to mitigate risks from these attacks.
CISA warns of potential risks from Oracle cloud credential exposure. Urges password resets, MFA, and vigilance against phishing attacks.