CISA guidance on managing AI token consumption
Joint guidance from CISA and partners helps organizations manage AI token usage to reduce costs, performance degradation and denial-of-wallet attacks.
30
- Mentions · 7d0
- Mentions · 30d4
- All mentions132
- First seenAug 12, 2026
- Last mentioned8d ago
Timeline
132 articles · newest firstCISA Orders Patch for Exploited Plex2Shell, Siemens and SiteGuard Flaws
CISA added four Plex2Shell vulnerabilities and two other exploited flaws to its KEV catalog, ordering federal agencies to patch them by October 23 and November 3, 2026.
75
CISA Malcolm
CISA patched high-severity Malcolm flaws through version 26.08.0, including authentication bypass and SSRF.
66
CISA Malcolm
CISA details multiple Malcolm flaws before 26.06.0, including authenticated command injection CVE-2026-90444 scored CVSS 8.8.
64
CISA: Ransomware gangs now exploiting critical TeamCity flaw
Ransomware gangs are exploiting a critical JetBrains TeamCity flaw (CVE-2026-63077) and are being used in ransomware attacks.
70
Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems
Hackers described as foreign actors targeted OT/ICS at two small Colorado water utilities in late August, altering settings and alarms without disrupting service.
70
Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities
CISA added three exploited Linux kernel flaws to its KEV catalog, ordering federal agencies to patch within three days.
75
U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266) to its KEV catalog, federal patch deadline September 21, 2026.
78
Week in review: Cisco patches exploited email gateway 0-day, Revolut breach
Weekly roundup: Cisco patches actively exploited email gateway zero-day CVE-2026-76461, Revolut discloses breach via government-agency impersonation, plus Acronis, Parallels, Cisco ISE flaws.
30
CISA is ending its monthly vulnerability bulletin
CISA will discontinue its weekly known-vulnerability bulletin on September 28, citing risk-based patching requirements under Binding Operational Directive BOD 26-04.
45
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
SecurityWeek roundup: ransomware developer sentenced, critical SAP flaw CVE-2026-44756, PhantomRaven npm info-stealer, WordPress mass exploitation, and AI agent security findings.
32
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two actively exploited Linux kernel flaws, CVE-2025-39964 (race condition) and CVE-2026-53266 (out-of-bounds write), to its KEV Catalog.
72
CISA Ditches Weekly Vulnerability Roundups for Risk-Based Focus
CISA is discontinuing its weekly vulnerability roundups, shifting to risk-based guidance that prioritizes the vulnerabilities that matter most.
30
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication stack overflow letting unauthenticated attackers run code as root on Security Management and Log Servers.
66
ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.
46
AL26-021 - Vulnerabilities Impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) - CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460
Canada's Cyber Centre alerts on three actively exploited Cisco ISE/ISE-PIC vulnerabilities enabling unauthenticated administrative access and data tampering.
83
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Docker fixed CVE-2026-77179 (CVSS 9.4), a virtio-fs symlink flaw letting code inside macOS Sandboxes VMs read and modify host files; update to 0.42.0.
56
Cisco security advisory (AV26-932)
Cisco September 2026 updates fix flaws in ASA, FTD, FMC, ISE, and Nexus Dashboard; CISA added actively exploited CVE-2026-76460 to KEV.
72
CISA Wants Defenders to Plant Fake Credentials and Systems to Catch Hackers
CISA published guidance urging organizations to deploy decoy credentials, accounts, systems, and honeytokens to detect post-compromise attacker activity.
40
CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot
CISA will discontinue its weekly vulnerability bulletin on September 28, shifting defenders toward risk-based prioritization via the KEV catalog.
38
CISA Urges Critical Infrastructure to Plant Decoys Inside Networks
CISA's first decoy guidance tells critical infrastructure to deploy honeytokens and tripwires inside networks, mapped via MITRE ATT&CK and Engage, to speed detection.
50
CISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys
CISA released guidance, "Using Cyber Decoys to Strengthen Detection and Response," helping resource-constrained teams deploy honeytokens and honeypots with existing tools.
42
Hitachi Energy FACTS Control Platform (FCP)
CISA republished Hitachi Energy's advisory on five flaws, including two critical CVSS 9.9 issues, in the FACTS Control Platform GWS component for grid systems.
48
ABB Ability Edgenius
CISA's ABB advisory covers CVE-2026-31431, a public Linux kernel flaw letting local users or compromised containers gain root on Ability Edgenius gateways.
40
Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)
CISA updated its CC-Link IE TSN advisory: segment-attached attackers can tamper with Mitsubishi Electric control data and trigger denial of service conditions.
42
Bransys ELD
CISA reports Bransys ELD apps ship hardcoded MQTT and FTP credentials plus cleartext transport, exposing real-time telemetry for connected fleet devices.
30
Schneider Electric Modicon M340 Controller and Communication Modules
CISA warns CVE-2025-6625 lets unauthenticated attackers crash Schneider Electric Modicon M340 controllers and communication modules via a crafted FTP command.
32
Mitsubishi Electric GX Works3 and Motion Control Settings
CISA warns CVE-2026-15688 lets a local attacker bypass block password authentication in Mitsubishi Electric GX Works3 and tamper with control programs.
35
Cisco Warns of Active Exploitation of Critical ISE Flaw
Cisco warns that CVE-2026-76460 (CVSS 10.0) in Identity Services Engine is actively exploited, enabling unauthenticated root access; CISA added it to KEV.
90
CISA Urges Organizations to Deploy Cyber Decoys to Detect Hackers Inside Networks
CISA's new guidance urges organizations to deploy cyber decoys like honeytokens and tripwires to detect attackers using valid credentials and living-off-the-land techniques.
30
CISA Releases Guidance on Deploying Cyber Decoys
CISA issued guidance on deploying honeypots, honeytokens, and decoy systems to detect adversaries and gather threat intelligence in critical infrastructure.
32
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco warns CVE-2026-76460 (CVSS 10.0), an unauthenticated ISE auth bypass leading to root command execution, is under active exploitation and was added to CISA's KEV.
90
CISA promotes a fresh way to deter cyberattackers: Lie to them
CISA issued first-time guidance advising critical infrastructure operators to deploy honeypots, honeytokens, and decoys to detect and distract intruders.
45
Google Pixel phones pwned in zero-click attacks
CISA added actively exploited zero-click Pixel modem flaw CVE-2026-58704 to its KEV catalog, giving federal agencies three days to patch.
78
AI agent authorization risks remain a gap in new NIST-CISA token security guidance
NIST and CISA release IR 8587 guidance on securing signed tokens, but AI agent authorization and delegation risks remain out of scope.
48
CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks
CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.
85
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added actively exploited Google Pixel improper authorization flaw CVE-2026-58704 to its KEV catalog, mandating federal remediation.
72
NIST and CISA finalize playbook to stop token theft and forgery
NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.
60
GitLab CVE-2026-85706 Added to CISA KEV
CISA added CVE-2026-85706 to KEV: a path traversal in GitLab CE/EE letting unauthenticated attackers read arbitrary files.
72
CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.
88
Related CVEs
by mentions- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-7646076%10.0Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-8570697%10.0Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE
- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-81963<1%7.8Local Privilege Escalation via Link Following in Windows Update Stack
- CVE-2026-2031635%5.3Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
- CVE-2026-8621815%10.0Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
Appears with
- CISAorganization · 67
- Microsoftvendor · 17
- Ciscovendor · 13
- Googlevendor · 8
- Cisco Secure Firewall Management Centerproduct · 6
- FBIvendor · 6
- Canadian Centre for Cyber Securityvendor · 5
- Wizvendor · 5
- Cisco Identity Services Engineproduct · 5
- JFrogvendor · 5
- Linux kernelproduct · 5
- GitLabvendor · 4
- Geminiproduct · 4
- Grokproduct · 4
- Claudeproduct · 4
- NSAvendor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.