CISA orders agencies to quickly patch critical Netlogon bug

CISA has increasingly used its emergency-directive authority to try to keep foreign spies or criminals from burrowing into federal networks

For several days, security experts have urged organizations to fix a critical vulnerability in a Microsoft protocol that hackers could use to steal sensitive data. Now, U.S. government agencies don’t have a choice but to act.

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency on late Friday evening ordered federal civilian agencies to apply a patch for the vulnerability by the end of the day Monday. The “emergency directive” — only the fourth ever issued by the agency — reflects the “unacceptable risk” the vulnerability poses to federal agencies because the affected software is used throughout the government, officials said.

The bug is the latest in a bevy of critical flaws to emerge in popular software this year. In response, CISA has increasingly used its emergency-directive authority to try to keep foreign spies or criminals from burrowing into federal networks. In July, CISA gave agencies 24 hours to address another critical Windows-related vulnerability.

The latest vulnerability affects the Netlogon protocol that Microsoft employs to authenticate users within a domain. That means a hacker with access to an internal network could exploit the bug to essentially impersonate any user on the network, including the domain controller responsible for handling security requests.

Security experts have warned that complacency is not an option.

Microsoft issued a fix for the flaw in August, but the issue took on greater urgency last week when researchers released a “proof of concept” showing just how easy it is to exploit the bug. More exploits followed, setting off a scramble to patch systems.

“We do not issue emergency directives unless we have carefully and collaboratively assessed it to be necessary,” said Bryan S. Ware, assistant director for cybersecurity at CISA.

Foreign espionage groups often exploit known vulnerabilities in widely used software to infiltrate targets. Earlier this month, CISA warned that hackers associated with China’s civilian intelligence service, the MSS, were exploiting VPN software to target U.S. government agencies.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure