CISA Orders Agencies to Patch by Risk, Not Severity
2026-06-11T20:52:16Z•cc8afc633343a359d7c529f159534a7928ccab517f9567a30f4ba2215cbff680
AI-malwareAsyncRATCISACVE-2026-11645Check-PointChromeEverest-FormsMicrosoft-Patch-TuesdaySilabRATSniperDzVidaragentjackingextortion-only-ransomwarepatch-prioritizationphishing-as-a-servicephpBBrisk-based-patchingtraining-and-governancevulnerability-managementzero-day
What happened
A June 2026 news digest highlights a policy shift and rising operational threats: CISA has instructed federal agencies to prioritize patching by real‑world risk/exploitability rather than CVSS severity. Multiple active campaigns are using AI-themed lures, fake developer guides and social-media tutorials to distribute malware (AsyncRAT, Vidar, SilabRAT) and to steal crypto; researchers also disclosed new “agentjacking” attacks that can trick AI coding agents into executing arbitrary code. Vendors and defenders are racing to respond to actively exploited flaws — Microsoft patched 200 CVEs (incl.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- infosecurity_magazine
- Record identifier
- cc8afc633343a359d7c529f159534a7928ccab517f9567a30f4ba2215cbff680
- Enrichment time
- 2026-06-11T20:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.