CISA — Cyber Attacks, Breaches & Threat Activity

Related Threat Clusters

• Cisco Fixes Critical AsyncOS Vulnerability Under Attack

  Cisco has addressed a maximum-severity vulnerability in AsyncOS, tracked as CVE-2025-20393, which has been actively exploited for at least a month. The flaw affects Secure Email Gateway (SEG) and Secure Email and Web…

  11 articles · Updated January 15, 2026
• FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation

  A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative access to affected systems. Organizations using FortiWeb are at risk of…

  100 articles · Updated November 15, 2025
• Resurgence of KV Botnet Linked to Chinese State Actors

  Chinese operatives have revived the KV-botnet, a covert data transfer network previously dismantled by the FBI in January 2024. The botnet, which primarily exploits vulnerable routers and IoT devices, has seen a…

  2 articles · Updated June 11, 2026
• Critical Vulnerabilities in TP-Link Archer Routers Expose Users to Attacks

  TP-Link has patched multiple critical vulnerabilities in its Archer NX router series, specifically affecting models NX200, NX210, NX500, and NX600. The most severe flaw, CVE-2025-15517, allows unauthenticated attackers…

  11 articles · Updated March 25, 2026
• Record Highs in Industrial Control System Vulnerabilities Reported

  A report from Forescout reveals a record number of industrial control system (ICS) vulnerabilities, with 3,637 advisories published by CISA/ICS-CERT from March 2010 to January 31, 2026. In 2025 alone, there were over…

  3 articles · Updated February 19, 2026
• CISA Warns of Exploited Windows Task Host Vulnerability CVE-2025-60710

  CISA has issued a warning to U.S. government agencies regarding a privilege escalation vulnerability in Windows Task Host, tracked as CVE-2025-60710. This vulnerability, affecting Windows 11 and Windows Server 2025,…

  2 articles · Updated April 15, 2026
• Critical IKEv2 RCE Vulnerability in WatchGuard Firebox Devices Exploited

  WatchGuard Technologies released patches on July 2, 2026, for a critical remote code execution vulnerability (CVE-2026-13368) affecting all supported Firebox firewall models. This flaw, linked to a race condition in the…

  3 articles · Updated July 4, 2026
• Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages

  A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into…

  685 articles · Updated April 29, 2026
• Critical RCE Vulnerability in WatchGuard Firebox Firewalls Actively Exploited

  WatchGuard has issued a warning about a critical remote code execution vulnerability, tracked as CVE-2025-14733, affecting its Firebox firewalls running Fireware OS 11.x and later. The flaw allows unauthenticated…

  20 articles · Updated December 19, 2025
• CISA Contractor Exposes Sensitive AWS Credentials on Public GitHub

  A contractor for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) left a public GitHub repository named 'Private-CISA' exposed for six months, containing sensitive credentials including AWS GovCloud…

  41 articles · Updated May 19, 2026

Recent Intelligence Reports

• WatchGuard Firebox Patches Third Critical IKEv2 RCE in 10 Months, T15/T35 Still Exposed — Techtimes · July 4, 2026
• AI Coding Agents Skip Package Verification, and Attackers Are Exploiting It — Techtimes · July 1, 2026
• Attackers Register AI — Gbhackers · July 1, 2026
• 'Five Eyes' intelligence alliance warns that new AI models pose urgent cyber risk — Channelnewsasia · June 22, 2026
• Chinese agents caught rebuilding botnets and stirring the pot on AI datacenter debate — Theregister · June 11, 2026
• CISA contractor's public GitHub repo exposed sensitive government credentials — Scworld · May 20, 2026
• “Worst Leak I've Ever Seen”: U.S. Cyber Agency Accidentally Exposes Secret Access Keys on GitHub — Usaherald · May 19, 2026
• US cyber agency CISA exposed reams of passwords and cloud keys to the open web — Longbridge · May 19, 2026

Related Entities