Training

Opportunistic Pro-Russia Hacktivists Attack US and Global Critical Infrastructure

This Joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, Joint Fact Sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology and European Cybercrime Centre’s (EC3) Operation Eastwood, in which CISA, Federal Bureau of Investigation (FBI), Department of Energy (DOE), Environmental Protection Agency (EPA), … Continue reading
Wed, 10 Dec 2025 19:25:25 +0000

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution – PATCH: NOW

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install … Continue reading
Tue, 09 Dec 2025 20:05:18 +0000

Mitigating Email Based Threats

Yesterday, the NJCCIC released an advisory, Increase in Compromised NJ Public Sector Accounts. Common threads observed in these incidents are a lack of or misconfigured Sender Policy Framework (SPF) and Domain-based Message Authentication, Reporting, and Conformance (DMARC) records. Without these email security protocols, organizations are more at risk of phishing campaigns and impersonation scams. As … Continue reading
Tue, 09 Dec 2025 20:03:05 +0000

Critical Patches Issued for Microsoft Products, December 9, 2025 – PATCH NOW

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; … Continue reading
Tue, 09 Dec 2025 18:40:26 +0000

Updated Draft Guidelines for National Checklist Program for IT Products

Available for Public Comment—National Checklist Program for IT Products: Guidelines for Checklist Users and Developers NIST Special Publication (SP) 800-70r5 ipd (Revision 5, initial public draft), National Checklist Program for IT Products – Guidelines for Checklist Users and Developers, is now available for public comment through January 16, 2026, at 11:59 PM (EST). NIST established … Continue reading
Tue, 09 Dec 2025 16:50:13 +0000

Vulnerability in React Server Component Could Allow for Remote Code Execution

This Multi-State Information Sharing and Analysis Center (MS-ISAC) Advisory is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals. A vulnerability in the React Server Components (RSC) implementation has been discovered that could allow for remote code execution. Specifically, it could allow for unauthenticated remote code execution on … Continue reading
Tue, 09 Dec 2025 16:09:50 +0000

Charting the Course for NIST OSCAL: NIST CSWP 53 is Available for Public Comment

The initial public draft of NIST Cybersecurity White Paper (CSWP) 53, Charting the Course for NIST OSCAL, is available for public comment. This paper introduces the Open Security Controls Assessment Language (OSCAL) — an open-source, machine-readable language that standardizes security documentation for better monitoring and risk management. OSCAL was developed to modernize manual, paper-based cybersecurity compliance … Continue reading
Tue, 09 Dec 2025 16:04:12 +0000

Principles for the Secure Integration of Artificial Intelligence in Operational Technology

Since the public release of ChatGPT in November 2022, artificial intelligence (AI) has been integrated into many facets of human society. For critical infrastructure owners and operators, AI can potentially be used to increase efficiency and productivity, enhance decision-making, save costs, and improve customer experience. Despite the many benefits, integrating AI into operational technology (OT) … Continue reading
Tue, 09 Dec 2025 16:03:23 +0000

NICE Releases NICE Framework Components v2.1.0

NICE is pleased to announce the release of NICE Framework Components v2.1.0. The NICE Workforce Framework for Cybersecurity (NICE Framework) establishes a standard approach and common language for describing cybersecurity work and learner capabilities. NICE Framework Components include Work Role Categories, Work Roles, Competency Areas, and Task, Knowledge, and Skill (TKS) statements as well as … Continue reading
Tue, 09 Dec 2025 16:02:05 +0000

PRC State-Sponsored Actors Use BRICKSTORM Malware Across Public Sector and Information Technology Systems

The Cybersecurity and Infrastructure Security Agency (CISA) is aware of ongoing intrusions by People’s Republic of China (PRC) state-sponsored cyber threat actors using BRICKSTORM malware for long-term persistence on victim systems. BRICKSTORM is a sophisticated backdoor for VMware vSphere and Windows environments. Victim organizations are primarily in the Government Services and Facilities and Information Technology Sectors. … Continue reading
Tue, 09 Dec 2025 16:01:17 +0000

BLOG