Watch hub·fedramp · fedramp-20x · fisma · far
FedRAMP, FISMA, CISA, FAR, and the federal compliance machinery beyond CMMC.
Federal cybersecurity policy moves through FedRAMP authorizations, FISMA reporting, CISA directives, OMB memos, and FAR rulemaking. This hub tracks federal compliance activity that isn't CMMC-specific — including FedRAMP 20x progress, KEV-driven Binding Operational Directives, and NIST publications that shape ATO decisions.
What changed in the last 30 days
cisa/regulator
CISA issued an alert on two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, tracked as "php2shell." They affect every PHP installation serving web requests, and CISA has not observed exploitation as of publication. Patches are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; organizations that can't update immediately, or that run PHP 8.1 or earlier, should take those PHP systems offline until patched.
incident-response/trade-press
FedScoop's Kathy Hsu argues that the FBI's new Cyber Strategy (which aims to compress the interval between threat detection and partner notification from days to hours, then minutes) forces an uncomfortable question onto critical infrastructure operators: how fast can they actually act on an incoming warning? Hsu makes the case for joint government-industry exercises built around a single essential service and a single threat scenario, with agreed criteria for what counts as a successful handoff. CISA already offers the Federal Incident Response Evaluation service for federal entities and runs the biennial Cyber Storm exercise series, but neither is designed to test one specific federal-to-operator notification cycle end to end.
incident-response/trade-press
CISA's CI Fortify asks critical infrastructure operators to plan isolation and recovery around two assumptions: third-party connections will fail in a crisis, and adversaries already have access to OT networks. A Federal News Network commentary extends the framing to federal agencies, noting most continuity plans were written for natural disasters, not cyber-caused outages. The load-bearing change isn't another preventive control; it's tested restoration under an assumed-compromise condition.
far/trade-press
The FAR Council published four additional proposed rules on Sept. 18, bringing the total to eight of a planned twelve, for the first comprehensive rewrite of the Federal Acquisition Regulation since the 1990s. Comments are due October 19. The overhaul streamlines how agencies buy cloud, software, and AI, removing clause checklists, letting commercial terms drive applicability, and shifting the default away from government-added requirements. Companies that sell technology to the federal government and stay silent risk letting legacy players write the rules for the next three decades.
ics-ot/trade-press
CISA threat-hunting operations coordinator Rina Rakipi said adversaries have moved past defacing websites and human-machine interfaces to modifying PLC code, bypassing safety systems, tampering with sequencing routines, and disabling alarms to evade detection, changes she calls "true operational sabotage." AppGate CEO Leo Taddeo attributed the shift partly to higher risk appetite and AI agent capabilities. INL and HHS officials added that engineering/cyber silos and unpatched devices compound exposure; the average hospital runs roughly 26,000 connected devices, more than half with critical unpatched risks.
supply-chain/trade-press
The Justice Department and FBI obtained court-authorized seizures of Microscan, a vulnerability scanning tool in use since 2017, and FishHub, a spear-phishing platform, both built by Beijing-based Integrity Technology Group for the Flax Typhoon campaign. Integrity Tech holds PRC government contracts; this is the second disruption of its operations in two years, following the 2024 botnet takedown. CISA, the NSA, and agencies from six allied nations issued a joint advisory warning that Integrity Tech-enabled actors are positioned inside OT systems with the aim of disrupting critical functions at a future time of their choosing.
vuln-advisory/regulator
CISA published an advisory covering four vulnerabilities in Satel Netco Design versions prior to v2.1.7. The flaws span stored cross-site scripting (CVE-2026-105269), inefficient regex complexity that can degrade availability (CVE-2026-104628), relative path traversal in data import that enables file enumeration (CVE-2026-105275), and relative path traversal in data export that can result in unauthorized file creation, modification, and (under certain conditions) arbitrary code execution (CVE-2026-101024, CVSS 3.1: 8.8). Satel advises updating to v2.1.7. All four require authenticated access; the lowest-barrier CVE needs only Viewer privileges. No known public exploitation has been reported to CISA.
procurement/trade-press
Chris Granger, DHS's deputy CIO, left the department and joined a CACI subsidiary less than two months after the subsidiary won a five-year, $983 million contract to provide desktop support services for DHS's Office of the Chief Information Officer. The Procurement Integrity Act bars former officials from accepting compensation from a contractor for one year post-award when they participated in procurement decisions on contracts over $10 million. CACI told FedScoop it screened Granger for conflicts and that any connection between the award and his hiring "is non-existent." Ethics experts and attorneys consulted by FedScoop didn't say the move was illegal, but several told the outlet the timing raised eyebrows.
ics-ot/regulator
CISA published ICSA-26-279-02 for CVE-2026-15340, a buffer overflow in Savannah lwIP SMTP client 2.2.1 rated 9.8 critical. The attack vector is network-based with no authentication or user interaction, and success can crash the device or enable remote code execution. The advisory lists Energy and Water and Wastewater Systems as affected sectors, deployed worldwide. The fix ships as git commit 614420f82c8729d070e01464c0dddb3c9525c772 via patch_125_smtp_txbuf.diff, disclosed by xchglabs after the patch released.
ai-cybersecurity/trade-press
The Cybersecurity Coalition, part of Venable's Center for Cybersecurity Policy and Law, published a white paper Sept. 24 arguing the Gold Eagle AI cybersecurity clearinghouse needs defined interfaces with private-sector open-source vulnerability initiatives. The paper identifies three existing industry-led efforts (Akrites (Linux Foundation), Chainguard's Athena, and Lightwell (IBM/Red Hat)) and says Gold Eagle's July launch announcement "does not clearly articulate a role for open-source maintainers." Its recommendation: Treasury and CISA should focus on cross-sector deconfliction and escalations while routing open-source findings to the projects already built for maintainer coordination.
cisa/vendor
Microsoft's 2026 Digital Defense Report puts government agencies and services at 27% of threat activity its telemetry observed between July 2025 and June 2026, up from 17% in 2025, and names the sector the top nation-state target. Dwell time rose across sectors, and phishing jumped to 23% of observed intrusions from 7%. Those figures are vendor telemetry, not an independent census, and the five government priorities are advocacy. The phishing swing is load-bearing: compromised identities as the entry point.
ai-cybersecurity/trade-press
National Cyber Director Sean Cairncross said Tuesday that business leaders need visibility into AI agents running in their supply chains, who has authorization, what they can access, and where they're operating. Speaking at a USTelecom event, Cairncross also said the administration is working to deploy AI models across critical infrastructure sectors for cyber defense "as quickly as possible." The dual message (accelerate deployment while tracking agents) comes as the administration pushes rapid AI adoption in defense without new regulations.
ics-ot/trade-press
WaterISAC is adopting Cyware's threat intelligence platform to speed cross-sector threat sharing after a summer of attacks on internet-exposed PLCs at water utilities across at least 12 states. Executive Director Tom Dobbins told CyberScoop the sector's biggest vulnerabilities are exposed OT, aging PLCs built "pre-cyber threats," insecure integrator connections, and poor cyber hygiene at smaller utilities. CISA, FBI, and EPA have jointly attributed the PLC-targeting campaign to Iranian-affiliated actors since April, an assessment Dobbins endorsed over President Trump's public dismissal of Iranian involvement.
supply-chain/trade-press
Kiteworks emailed customers this week recommending they shut down the company's managed file transfer platform during a six-hour window on Saturday. CISO Frank Balonis told Recorded Future News the company received "credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems." Balonis said the advisory is preventative ("we are not aware of any compromise") and that all known vulnerabilities are addressed in the current 9.5.1 release. A Kiteworks customer-support official separately told German outlet Heise the warning involved a potential zero-day, but the company declined to say whether a CVE had been assigned or which group was involved. Neither the FBI nor CISA commented.
vuln-advisory/regulator
CISA published ICSA-26-272-07 on two vulnerabilities in the Viidure Dashcam Android Application (versions ≤3.3.1.260403). CVE-2026-96587 embeds plaintext cloud-storage credentials in compiled application code, attackers extracting them gain full read, modify, and delete access to critical platform files including firmware and application binaries (CVSS v4 10). CVE-2026-94204 is a misconfigured cloud storage backend with public-read permissions, exposing user records, live footage, and platform files (CVSS v4 8.7). Viidure did not respond to CISA's coordination attempts. No fix is planned.
vuln-advisory/regulator
CISA published ICSA-26-272-03 Tuesday, detailing CVE-2026-22755, a command-injection vulnerability in firmware modules used by more than 40 VIVOTEK network camera models spanning seven product series. The CVSS score is 10.0 in both v3.1 and v4.0 scoring, network-accessible, no authentication, no user interaction, full scope-change compromise. The advisory lists affected sectors as government services and facilities, transportation, commercial facilities, energy, critical manufacturing, and financial services. VIVOTEK says it has addressed the issue and directs users to its download center for updated firmware; CISA notes it discovered a public proof of concept authored by the researcher indoushka.
cisa/regulator
CISA's ICSA-26-274-06 covers two missing-authorization flaws (CWE-862) in Meari's IoT Cloud Platform OpenAPI Service, all versions. An authenticated user can reconfigure devices they don't own (CVE-2026-101104, CVSS 7.7) or pull any device's full shadow, credentials and owner data included, just by supplying its ID (CVE-2026-96613). No fix is planned and Meari didn't answer CISA, so operators have to isolate rather than patch.
vuln-advisory/regulator
CISA issued an advisory covering 10 vulnerabilities in Toptech TMS7 and TopHAT 7.6.3, terminal-management software deployed across energy, chemical, and transportation infrastructure worldwide. CVE-2026-71379 scores 10.0: an unauthenticated attacker sends a crafted POST request and exports arbitrary database tables. Five additional flaws are SQL injection; another allows arbitrary PHP file upload. Toptech alerted customers on July 20, 2026 and says release 7.8 addresses all ten.
vuln-advisory/regulator
CISA's ICSA-26-254-01 discloses a dozen-plus vulnerability classes in Malcolm, the agency's free network traffic and log analysis suite, affecting all versions before v26.06.0. The worst is CVE-2026-90444, an 8.8 CVSS OS command injection: an authenticated user uploads a file whose name carries shell metacharacters, and a later automated process runs it with the privileges of that process. CVE-2026-90447 lets anyone holding a shared service credential set a request header to swap in the elevated fixed role. Fix is to v26.06.0 or later.
vuln-advisory/regulator
CISA published two vulnerabilities in Lantronix G520 Series Cellular Gateways (CVE-2026-84409, CVE-2026-91191) affecting versions through 2.6.0.4R6_stable. The attack chain combines a stored-XSS vector in the update-metadata path with a signature-verification bypass, the production private key shipped in the publicly available SDK. Together they allow arbitrary code execution with root privileges. Organizations in transportation, energy, and water sectors running these gateways should move to firmware 2.6.0.7R6. The advisory doesn't address retroactive integrity verification for devices that already ran the vulnerable firmware.
ics-ot/regulator
CISA issued ICSA-26-272-06 for CVE-2026-84411, a CVSS 9.8 unauthenticated remote code execution flaw in the web management service of MikroTik RouterOS versions below 7.24. An attacker can achieve root-level code execution or denial of service with one crafted HTTP request, no authentication, no user interaction. MikroTik directs users to upgrade to version 7.23 or later. CISA states no known public exploitation has been reported to it at this time.
fisma/trade-press
GAO's final biennial report on the IoT Cybersecurity Improvement Act finds 14 of 22 civilian CFO Act agencies had established networked device inventories as of September 2026, two years past OMB's September 2024 deadline, and only 10 captured all required metadata. Agencies cite technical constraints and competing priorities. GAO's target is OMB: it hasn't issued FY 2026 guidance, hasn't overseen the inventory mandate, and hasn't updated the deadline. Without those three things, the requirement is a suggestion.
ics-ot/regulator
CISA published ICSA-26-274-03 covering two flaws in ABB Protection and Control IED Manager PCM600 2.14 and earlier, deployed in energy infrastructure worldwide. CVE-2026-15952 (CVSS v3.1 6.4, v4.0 7.1) lets any local user with valid credentials escalate privileges because the ABBPCMSchedulerService runs as LocalSystem while granting permissions to the local users group; CVE-2026-15953 is a path traversal in project archive extraction. ABB's remediations are workarounds. The advisory lists no fixed version. CISA reports no known public exploitation.
ics-ot/regulator
CISA disclosed CVE-2026-96274, a CVSS 7.4 unauthenticated denial-of-service vulnerability in Baicells Nova 430H eNodeB (model pBS3101SH) running firmware through BaiBLQ_3.0.12. An attacker within radio range can send a malformed NAS payload during connection setup that the eNodeB forwards to the core network, triggering a shutdown of the cell's signaling association. Baicells hasn't responded to CISA's vendor coordination outreach and no fix is planned. The equipment is deployed worldwide in the Communications and IT sectors.
vuln-advisory/regulator
CISA published ICS advisory ICSA-26-272-05 covering nine vulnerabilities in Anjvision YSSD-RTMP-H5 streaming devices running firmware 3.3.2.4. The CVEs range from unauthenticated ONVIF bypass and OS command injection to hard-coded cloud credentials, unsigned firmware updates, and an admin-password-reset via empty POST. The highest scores hit 9.8. Anjvision, headquartered in China, has not responded to CISA's coordination attempts and no fix is planned. The affected devices are deployed worldwide in the Commercial Facilities sector. Operators who can't reach the vendor for mitigations are left with the familiar grim calculus: isolate the device or accept the risk.
ics-ot/regulator
CISA's ICSA-26-274-03 covers two flaws in ABB Protection and Control IED Manager PCM600 versions 2.14 and earlier. CVE-2026-15952 lets a standard local user escalate privileges because the ABBPCMSchedulerService runs as LocalSystem while granting permissions to the local users group (CVSS 3.1 6.4, CVSS 4.0 7.1). CVE-2026-15953 is a path traversal in project-archive extraction that writes files outside the target directory. ABB offers workarounds in advisories 2NGA003170 and 2NGA003179, not a corrected version.
fisma/trade-press
The DHS Office of Inspector General found TSA failed to secure privileged accounts, perform annual access reviews, and consistently disable accounts for separated employees across its 60,000-person workforce. The vulnerabilities could allow attackers to compromise TSA networks and cause what OIG called "serious or catastrophic damage to operations and assets." TSA attributed the gaps to staff shortages, resource constraints, and inadequate policies. The agency has since begun monthly access reviews and is developing a formal account-disablement process for departing staff. This is the most recent of several DHS-component access-control audits OIG has conducted, Customs and Border Protection was flagged for similar neglect last month.
cisa/regulator
CISA added CVE-2026-104286, a Fortinet FortiMail path-traversal vulnerability, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Under BOD 26-04, the listing brings rapid-remediation prioritization for FCEB agencies when the asset is publicly exposed and grants total control after exploitation, with lower-risk work deferred. The directive binds only FCEB agencies; for contractors it's CISA's encouragement, not a requirement.
cisa/trade-press
CISA acting cyber chief Chris Butera laid out a two-track vulnerability management overhaul at a Federal News Network event: Gold Eagle, the Treasury-led AI clearinghouse that ingests and deduplicates AI-discovered vulnerability reports at scale, and concurrent reforms to CVE program governance, data standards, and infrastructure. Butera framed them as connected, the CVE pipeline can't handle the volume AI models are now producing without machine-readable submission formats, deduplication, and a new prioritization mechanism to protect under-resourced open-source maintainers from alert floods.
cisa/trade-press
The Cybersecurity Information Sharing Act of 2015, which provides liability and antitrust protections for industry threat-sharing with DHS and among peers, runs through Dec. 11 on its third short-term extension. The House passed a reauthorization through 2035 as part of the fiscal 2027 NDAA; the Senate has a competing 2036 endpoint via Homeland Security ranking member Gary Peters (D-MI). USTelecom's Robert Mayer and Brandon Heiner are pressing for the long-term fix, explicitly linking reauthorization to AI-enabled attacks that probe critical infrastructure at speed, a framing shift from the nation-state and ransomware threats that dominated earlier renewal arguments.
Open questions
Sources we watch
regulator·last fetched
regulator·last fetched
regulator·last fetched
regulator·last fetched
regulator·last fetched
regulator·last fetched
regulator·last fetched
regulator·last fetched
standards·last fetched
Related from Deep Fathom
Earlier coverage