cybersecurity
Every record this desk has filed under cybersecurity, newest first, each with the number of sources it can still show you.
DHS publishes Acronis exclusion and removal order for federal civilian agencies, with issuance-based deadlines
An October 30 Homeland Security notice publishes an order excluding covered Acronis products from federal civilian executive branch procurement and requiring removal from agency systems. The attached order lists July 31 as its original release date. Its removal and exception-request periods run from issuance, so publication does not announce a fresh compliance clock or a consumer ban.
Also filed underfederal-procurementsoftwaresupply-chainhomeland-security
SEC examination priorities put advisers' conflicts and hard-to-sell investments in focus for 2027
SEC examination staff plans to focus on advisers' financial conflicts, complex investments sold to ordinary investors, and protection of customer information during fiscal 2027. The October 23 announcement describes a program covering more than 34,000 registrants. The priorities identify planned scrutiny; the staff document creates no new legal obligations and does not establish misconduct by a particular firm.
Also filed undersecinvestor-protectioninvestment-advisersprivate-credit
None of 24 major federal agencies has fully met the three preparation practices GAO drew from federal guidance for a future quantum computer able to break some of today's encryption.
The Government Accountability Office reported October 6 that none of the 24 agencies covered by the Chief Financial Officers Act has fully built the cryptography inventories, funding assessments and testing federal guidance calls for before a quantum computer able to break some of today's encryption exists. In a sensitive September 2025 report, GAO made 89 recommendations to CISA and 23 of those agencies: 12 agreed, two partially agreed, one disagreed with three of its four, seven neither agreed nor disagreed, and Interior did not respond.
Also filed underquantum-computingencryptionpost-quantum-cryptographyfederal-agencies
A third NetScaler flaw in eight days carries an October 7 federal remediation deadline and forensic-triage requirement
CISA added CVE-2026-88779 to its exploited-vulnerabilities catalog October 4, with an October 7 federal due date. The entry calls for vendor mitigations and compliance with forensic-triage guidance. It is the third NetScaler entry added from September 27 through October 4, by this desk’s count. Affected builds and fixed versions are not established by this catalog record.
Also filed undervulnerabilitiescitrixnetscalerfederal-agencies
CISA adds a FortiMail path-traversal flaw and two Zammad flaws to its exploited-vulnerabilities catalog, with federal deadlines October 4 and 5
CISA's Known Exploited Vulnerabilities catalog, updated October 2 to 1,733 entries, added a critical FortiMail path-traversal flaw (CVE-2026-104286, CVSS 9.8, added October 1, due October 4), plus two Zammad flaws added October 2, due October 5: a session-fixation bug (CVE-2026-102489), fixed in Zammad 7.2.0, and an improper-privilege-management bug (CVE-2026-102490) whose reported scope Zammad says it cannot verify. CISA marks ransomware use Unknown for all three. Fortinet lists its fixed builds as upcoming, so its advisory urges a workaround.
Also filed undervulnerabilitiesfortinetzammadfederal-agencies
Apple fixed an iPhone, iPad and Mac flaw it says was reported as possibly exploited in a targeted attack; CISA set federal civilian agencies an October 2 deadline
Apple's September 28 updates (iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1) fix a CoreGraphics flaw; Apple says it is aware of a report that the flaw may have been exploited in an attack on specific people. CISA added it to its exploited-vulnerabilities catalog September 29, with an October 2 due date that applies to federal civilian agencies, not the public. A Cisco SD-WAN Manager flaw was added September 30, due October 3. Apple advises keeping software up to date.
Also filed underappleiosmacoscisaknown-exploited-vulnerabilitiescisco
GAO could count DOGE-accessible systems. It could not establish the permissions.
A September 29 review of six agencies found incomplete access and security-control records. Four reported access to more than 23 systems containing sensitive information. The finding is a gap in assurance—not proof of a breach.
Also filed undergovernmentprivacyaccountability
The 988 crisis line went dark for hours after a 2022 cyberattack. Four years later, GAO found seven of HHS's own required security control areas were never written into the agreement that runs it.
GAO's September 17 report on the 988 Suicide and Crisis Lifeline — the number roughly 220 local crisis contact centers answer — finds the cybersecurity controls protecting it only partly in place. HHS defined oversight roles but 'did not include all key HHS-defined cybersecurity control areas' in its cooperative agreement with the network administrator, nor in the administrator's agreement with the crisis centers: seven missing control areas in the first, three in the second. The network administrator has not implemented current NIST password guidance and only partly implemented contingency-plan controls; the crisis centers have only partly implemented incident response and contingency planning. GAO's stated risk is specific: prolonged service disruption 'could... potentially prevent individuals in crisis access to timely mental health support.' Congress ordered this review in the SUPPORT for Patients and Communities Reauthorization Act of 2025. Ten recommendations, all open; HHS concurred with all of them.
Also filed undergaohhs988mental-healthoversight
A record appears here because it carries cybersecurity in its own tags. If a record you expected is missing, it was filed under a different subject — the full list is on the topics index.