This page collects the latest public security warnings from U.S. government agencies: cybersecurity advisories from the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA), joint advisories with the FBI, FBI Internet Crime Complaint Center (IC3) scam warnings, and the Department of Homeland Security’s National Terrorism Advisory System (NTAS). The lists below update automatically from the agencies’ official feeds. Each item is dated, credited to the agency that issued it and linked to the original.
Compiled by The Boston Report from official sources; not an official government page. We are not affiliated with the NSA, CISA, FBI, DHS or any other agency. In an emergency, call 911.
Compiled by The Boston Report from official sources; not an official government page. The Boston Report is an independent news site and is not affiliated with, endorsed by or speaking for the NSA, CISA, FBI, DHS, the State Department or any Massachusetts agency. Headlines below are the agencies' own titles, linked to the original. Feeds refresh about every 6 hours; last checked Oct 22, 2026 7:47 pm EDT.
Current threat status
Latest 5 advisories and warnings
- NSA NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
- CISA Critical Vulnerabilities in PHP Require Immediate Patching
- CISA (joint advisory) #StopRansomware: SafePay Ransomware
- FBI IC3 Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials
- CISA CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
Includes CISA cybersecurity advisories (usually joint with the FBI, NSA and partners), CISA urgent alerts, FBI IC3 public service announcements and NSA press releases. Routine "CISA adds vulnerabilities to catalog" notices are counted in the KEV figure instead.
Cyber advisories
CISA and joint cybersecurity advisories
- CISA (joint advisory) #StopRansomware: SafePay Ransomware
- CISA (joint advisory) Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
- CISA (joint advisory) China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
- CISA (joint advisory) A Tale of Two SOCs: Insights From Two Red Team Assessments
- CISA (joint advisory) Defending Against an Active Threat to Siemens S7 Series PLCs
- CISA (joint advisory) #StopRansomware: Gunra Ransomware
- CISA (joint advisory) Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
- CISA (joint advisory) Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting
- CISA (joint advisory) Defending Against China-Nexus Covert Networks of Compromised Devices
- CISA (joint advisory) Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
NSA cybersecurity advisories and guidance
- NSA NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
- NSA NSA Releases Zero Trust Guidance for Protecting Operational Technology Systems
- NSA NSA Joins FBI and Others to Provide Guidance to Mitigate Chinese Government-linked Actors Targeting Sensitive Data
- NSA NSA Announces Post-Quantum Cryptography Measures to Safeguard National Security Systems Against Quantum Computing Threats
Full library: NSA Cybersecurity Advisories & Guidance.
CISA alerts (latest)
- CISA Critical Vulnerabilities in PHP Require Immediate Patching
- CISA CISA Adds Six Known Exploited Vulnerabilities to Catalog
- CISA CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
- CISA CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISA CISA Adds One Known Exploited Vulnerability to Catalog
- CISA CISA Adds Four Known Exploited Vulnerabilities to Catalog
- CISA CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
- CISA CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISA CISA Adds One Known Exploited Vulnerability to Catalog
- CISA CISA Adds Two Known Exploited Vulnerabilities to Catalog
Newest Known Exploited Vulnerabilities
| Added | CVE | Vendor / product | Federal fix-by date | Ransomware use |
|---|---|---|---|---|
| 2026-10-20 | CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | 2026-10-23 | Unknown |
| 2026-10-20 | CVE-2026-96656 | Plex Media Server | 2026-10-23 | Unknown |
| 2026-10-20 | CVE-2026-96655 | Plex Media Server | 2026-11-03 | Unknown |
| 2026-10-20 | CVE-2026-96654 | Plex Media Server | 2026-10-23 | Unknown |
| 2026-10-20 | CVE-2026-96652 | Plex Media Server | 2026-11-03 | Unknown |
| 2026-10-20 | CVE-2026-110936 | Siemens Software Center | 2026-11-03 | Unknown |
| 2026-10-16 | CVE-2026-102764 | BeyondTrust Remote Support | 2026-10-19 | Unknown |
| 2026-10-16 | CVE-2025-61624 | Fortinet Multiple Products | 2026-10-19 | Unknown |
| 2026-10-15 | CVE-2026-21589 | Atlassian Multiple Products | 2026-10-18 | Unknown |
| 2026-10-14 | CVE-2026-105134 | Ahsay AhsayCBS | 2026-10-17 | Unknown |
Source: CISA KEV JSON feed. The fix-by date is the deadline for federal civilian agencies under Binding Operational Directive 22-01; CISA urges all organizations to prioritize these.
Nation-state threat actors named in official advisories
These are advisories in which the issuing agency itself names a country. The attribution is the agency's, as worded in its title.
China
- CISA (joint advisory) Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
- CISA (joint advisory) China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
- CISA (joint advisory) Defending Against China-Nexus Covert Networks of Compromised Devices
- NSA NSA Joins FBI and Others to Provide Guidance to Mitigate Chinese Government-linked Actors Targeting Sensitive Data
Russia
- CISA (joint advisory) Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
- CISA (joint advisory) Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting
Iran
- CISA (joint advisory) Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
North Korea
Scams and fraud: FBI IC3 public service announcements
- FBI IC3 Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials
- FBI IC3 Scammers Exploit 2026 U.S. Midterm Election to Perpetrate Multiple Fraud Schemes
- FBI IC3 FBI Warns Voters on Election Crimes Ahead of the November 2026 Midterm Election
- FBI IC3 FBI Cautions About Threats to Election Workers Ahead of the November 2026 Midterm Election
- FBI IC3 North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment
Terrorism and physical threats
DHS uses the National Terrorism Advisory System to warn the public about terrorist threats. It issues two kinds of advisories: Bulletins, which describe general trends or developments, and Alerts, which are issued when there is specific, credible information about a terrorist threat against the United States. The status panel above reads the official NTAS feed.
The most recent NTAS Bulletin was issued June 22, 2025, and it expired Sept. 22, 2025. DHS said then that “the ongoing Iran conflict is causing a heightened threat environment in the United States” and that “multiple recent Homeland terrorist attacks have been motivated by anti-Semitic or anti-Israel sentiment.”
- Report suspicious activity to local police or through DHS “If You See Something, Say Something”. Call 911 in an emergency.
- Submit tips about federal crimes and threats to the FBI at tips.fbi.gov.
- Massachusetts: emergency alerts and preparedness information come from the Massachusetts Emergency Management Agency (MEMA). The state’s Commonwealth Fusion Center is the Massachusetts State Police hub for sharing threat information with law enforcement.
- Traveling abroad: check the State Department’s country travel advisories before you go.
What to do
CISA’s Secure Our World campaign recommends four basic steps for individuals and small businesses:
- Use strong passwords, and a password manager to keep track of them.
- Turn on multifactor authentication.
- Recognize and report phishing.
- Update your software.
- Organizations: CISA urges every organization to prioritize fixing the vulnerabilities in its Known Exploited Vulnerabilities catalog. Each advisory above lists the agencies’ specific mitigations.
- Report a cyber incident to CISA at cisa.gov/report.
- Report online fraud or a scam to the FBI at ic3.gov.
More from our coverage: North Korea’s internet outage and the ConnectWise hack, and our War & Conflict section.
Sources
- NSA: Cybersecurity Advisories & Guidance
- CISA: Cybersecurity Advisories (RSS feed)
- CISA: Alerts (RSS feed)
- CISA: Known Exploited Vulnerabilities catalog
- CISA: KEV catalog JSON feed
- FBI IC3: Public Service Announcements (RSS feed)
- DHS: National Terrorism Advisory System
- DHS: NTAS alerts feed
- DHS: NTAS Bulletin, June 22, 2025
- CISA: Secure Our World
- U.S. State Department: Travel Advisories
- Massachusetts Emergency Management Agency
- Commonwealth Fusion Center