Policy, Regulation & Enforcement

US sanctions Iranian cyber actors while the UK discloses a cyber intrusion that disrupted a small power plant.

Over 270 Zimbra servers compromised via CVE-2026-73570 RCE; CISA issued a rapid patch directive.

CISA says CVE-2026-21962 in Oracle WebLogic is actively exploited, enabling remote compromise; immediate patching recommended.

CISA ordered immediate patching of TrueConf Server vulnerabilities that are being actively abused to deploy malware.

CISA warns threat actors are actively exploiting a critical MLflow flaw to steal cloud credentials and internal data.

CISA confirms ransomware groups are exploiting a high-severity Windows Task Host vulnerability previously flagged as actively exploited.

Updated FBI/CISA/HHS advisory details Medusa techniques: disabling security, exfiltrating data, and encrypting whole networks.

CISA added a critical Ray vulnerability to its Known Exploited Vulnerabilities catalog due to observed active exploitation.

CISA ordered federal agencies to patch a Microsoft bug exploited in a long-running DPRK job-application campaign within two weeks.

CISA confirms active exploitation of a high-severity Microsoft SharePoint RCE now used in ransomware intrusions and lateral movement.

IEH Corporation disclosed a cyberattack affecting systems tied to military device manufacturing in an SEC filing.

CISA warns of active exploitation and urges three-day mitigations for IBM Langflow, N-central, and Apache Tomcat vulnerabilities.

PNLD compromise leaked contact data for police and justice professionals, published by ExfilSquad on dark web.

CISA warns of rising attacks on internet-exposed PLCs in water/wastewater systems and recommends removing public exposure.

CISA urges water and wastewater utilities to lock down internet-exposed controllers after intrusions impacted dozens of Minnesota systems.

Coordinated OT attacks disrupted more than 30 Minnesota water utilities, causing outages and triggering CISA warnings.

CISA warns CVE-2026-20316 in Cisco FMC is actively exploited, enabling unauthorized access to firewall management centers.

U.S. and Australian guidance from CISA advises critical infrastructure to prepare for isolating OT systems during cyber incidents.