14 dispatches · latest 18 SEP 2026 · all keywords →
The weekly 'top vulnerabilities by CVSS' email goes dark Monday. CISA's replacement signal chain is KEV + advisories + CVE.org — and BOD 26-04 replaces severity scores with a four-variable risk model your patch routine can run on too.
CISA advisory ICSA-26-258-08 covers seven CVEs in the CareCam CM2507 IP camera (firmware v251211.1507). Headlined by unauthenticated live video over the network — and no fix exists, because CareCam hasn't answered CISA's coordination attempts.
CISA advisory ICSA-26-258-01 covers six CVEs across the entire Digital Watchdog VMAX DVR/NVR line — all versions affected. An unauthenticated request can hand over your admin credentials in plaintext, and a hard-coded credential scores 9.6.
NSA, CISA, and FBI name DeepSeek, Moonshot, Alibaba, MiniMax, StepFun, and Z.AI for extracting billions of tokens from Claude/GPT/Gemini/Grok since 2024 via proxy 'transfer stations' — and recommend subtly altering responses to poison the payoff.
Yesterday, CISA and the G7 Cyber Security Working Group published 'Preparing for the Post-Quantum Era' — five priorities, no deadlines. It's a posture shift, not a patch-by date. But if you hold long-lived SSH keys and TLS certs for years without rotation, the harvest is already happening.
CVE-2026-16347 (CVSS 8.8) hits every version of RouterOS: the API auth path has no real rate-limiting, lockout, or source restriction, so admin credentials can be hammered at high volume. CISA published ICSA-26-209-05 with a mitigation checklist that is the whole post.
A ~$63 Chinese wireless USB print server whose entire job is to sit on your LAN and share a dumb printer just got a CISA ICS advisory: three CVEs, two of them CVSS 9.8 with no authentication required. All fixed in firmware 2.1.240. If you own one, patch it and VLAN it.
ICSA-26-239-05 rates the under-$40 Ebyte NA111-M RS485-to-Ethernet gateway with 13 CVEs on firmware 9013-2-17 — six of them CVSS 9.8, including an unauthenticated admin interface and cleartext MQTT. If you bolt one onto a PLC, a printer, or an e-bike, read this.
CISA's red team hit two critical-infrastructure orgs with similar tradecraft at the same time. Both ended up full-domain-compromised. The difference: one org's defenders saw the first hits in minutes, the other's thousands of false positives drowned them out.
Six agencies (FBI, CISA, DC3, NSA, USSS, Korea's KNPA) document Gunra, a Conti-descended RaaS whose front door is a FortiOS auth-bypass, whose MFA backdoor is a fixed OTP, and whose key action list is basically the homelab checklist.
CISA's FY2024/2025 Vulnerability Review (2026-08-26) lands the punchline homelabbers already suspect: most compromises come from injection flaws and input-validation bugs we've known about for twenty years. The fix is Secure by Design, not more zero-day budgets.
NSA, CISA, FBI, DOE, and EPA warn of an active threat to every Siemens S7-series PLC, with AI-generated exploit scripts built on open-source snap7 libraries. Here's what it means if you don't read ICS advisories for a living.
A July 2026 joint advisory on Russian state-sponsored targeting of network devices explains why 'just a router' is the worst thing it can be.
You don't need enterprise gear to close most of the gaps the FSB router advisory calls out. Here's a concrete checklist you can run on your home edge tonight.