CISA is ending its monthly vulnerability bulletin
CISA will discontinue its weekly known-vulnerability bulletin on September 28, citing risk-based patching requirements under Binding Operational Directive BOD 26-04.
CISA will stop issuing its weekly bulletin of known vulnerabilities from September 28, attributing the change to Binding Operational Directive BOD 26-04, which requires agencies to prioritize patching by real-world risk factors including in-the-wild exploitation rather than severity scores. The agency will continue publishing the Known Exploited Vulnerabilities catalog, Cybersecurity Alerts and Advisories, and CVE records. CISA has also recently warned about AI-generated threats and encouraged CISOs to follow vendor security bulletins directly.
- Weekly known-vulnerability bulletin ends September 28.
- BOD 26-04 shifts agency patching priorities from severity scores to real-world risk factors.
- CISA continues publishing KEV, Cybersecurity Alerts and Advisories, and CVE catalogs.
- Agency recently warned about attackers targeting AI-developed assets.
- Vendors
- CISA
- Countries
- United States
From the original article
1 min read at csoonline.com
The rise in AI-generated security threats may just have generated one casualty: the death of the weekly bulletin of security threats from the US Cybersecurity Infrastructure and Security Agency (CISA). The agency will discontinue its weekly bulletin of known vulnerabilities from September 28.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.