CISA to allow researchers to report vulnerabilities to exploited bugs catalog

Multiple security developments: CISA launched a nomination form allowing researchers, vendors and partners to submit bugs for inclusion in the Known Exploited Vulnerabilities (KEV) catalog, streamlining reporting of actively exploited flaws. The FBI issued an advisory on Kali365, a Telegram-based phishing-as-a-service that captures legitimate OAuth tokens to enable large-scale access to Microsoft 365 environments — a significant threat to orgs relying on cloud identity. Separately, U.S. authorities unsealed charges against a Canadian operator of the KimWolf DDoS-for-hire botnet that allegedly—