Topic

CISA: news, advisories and analysis

10 articlesUpdated 6 Oct 2026

CyberSecureToday covers CISA across 10 articles published between 8 Sep 2026 and 6 Oct 2026. The coverage includes 3 vulnerability advisories, 2 incident or breach reports and 3 analysis or guidance pieces. 3 advisories are rated critical or high severity.

Stories on CISA most often intersect with Critical Infrastructure, ICS-CERT and Ransomware, with Government & Defence the most affected sector. The most recent story, “Water Utility Discloses Nation-State Breach of SCADA Gateways in SEC Filing”, was published 6 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

NewsIndustrial & OT
Water Utility Discloses Nation-State Breach of SCADA Gateways in SEC Filing
SEC Form 8-K disclosure details a nation-state intrusion targeting municipal water SCADA gateways and programmable logic controllers.
Daniel Okafor6 Oct 20268 min read
Cyber AttackGov & Defence
Defense Manpower Data Center Server Exposure Leaks 3 Million Military Records Across Nine-Month Breach
The U.S. Department of Defense confirms a nine-month breach of an unencrypted DMDC server, exposing 3.05 million active military, retiree, and dependent records.
CST Editorial Desk30 Sep 202612 min read
ThreatsIndustrial & OTCritical
Rockwell Automation Logix Controllers Exposed to Critical Remote Firmware Tampering Flaws
CISA alerted industrial manufacturing operators to severe vulnerabilities in Rockwell Automation Logix controllers and 1756 communication modules allowing PLC tampering.
Mei-Lin Chen14 Sep 20267 min read
ThreatsEnergy & UtilitiesHigh
AVEVA Pipeline Integrity Monitor Vulnerabilities Threaten Critical Energy Infrastructure
CISA issued an energy sector ICS advisory warning of memory corruption and authentication defects in AVEVA Pipeline Integrity Monitor supervising oil and gas transport.
Daniel Okafor14 Sep 20268 min read
ThreatsHealthcare & PharmaCritical
NextGen Mirth Connect Critical RCE Flaws Expose Healthcare HL7 Data Pipelines
CISA published an urgent medical ICS advisory detailing critical RCE vulnerabilities in NextGen Mirth Connect integration engines routing hospital clinical records.
Priya Raman14 Sep 20268 min read
IndustryGov & Defence
CISA Finalizes CIRCIA Mandate: 72-Hour Incident and 24-Hour Ransomware Reporting Enforced
CISA issued its landmark final rule under CIRCIA, legally mandating critical infrastructure operators report major cyber incidents within 72 hours and ransom payments within 24 hours.
Tom Verhoeven14 Sep 20268 min read
ResearchCloud & SaaS
CISA, NSA, and FBI Warn Critical Infrastructure of Advanced AI Model Extraction Campaigns
A joint cybersecurity advisory from CISA, NSA, and FBI alerts defense contractors and cloud vendors to sophisticated state-sponsored AI model extraction campaigns.
Daniel Okafor14 Sep 20269 min read
InsightsGov & Defence
CISA BOD 26-04 ends CVSS-ordered patching: the four questions that replace it
CISA's Binding Operational Directive 26-04 drops CVSS from federal patch prioritisation, replacing it with four yes/no questions and a sixteen-row deadline table.
Priya Raman11 Sep 20267 min read
ResearchEducation & Academia
Eight new ransomware brands in one week: why tracking group names has stopped working
One tracker logged 315 leak-site posts from 40 groups in a single August week, eight of them new. Brand-based detection cannot keep pace. Here is what to instrument instead.
Daniel Okafor10 Sep 20266 min read
Cyber AttackGov & Defence
Gunra ransomware: what AA26-222A actually gives your detection engineers
Six agencies detailed Gunra's Fortinet entry, its forticloud-sync backdoor and an MFA bypass planted in a VDI server. Here is how to turn that into detection coverage.
Daniel Okafor8 Sep 20266 min read