30
42
55
30
30
30
30
30
30
30
30
30
55
55
55
30
30
55
30
30
55
55
30
55
Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security
CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.
CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.
58
30
42
55
55
30
30
60
42
30
30
Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence
Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for wire fraud conspiracy tied to Conti ransomware.
Lytvynenko, 44, admitted coding a loader for Conti and holding stolen data from eight U.S. and four overseas victims; prosecutors linked his actions to attacks on at least 12 companies. Conti infected more than 1,000 organizations across 47 U.S. states and 31 countries between 2020 and 2022, with victim payouts exceeding $150 million. Arrested in County Cork in July 2023 with Cobalt Strike running and an active Rocket.Chat session over Tor, forensic evidence showed his ransomware activity continued after Conti's 2022 collapse.
45
30
55
30
30