CISA to allow researchers to report vulnerabilities to exploited bugs catalog

This collection highlights several security and privacy developments: CISA launched a nomination form allowing researchers, vendors, and partners to report bugs for inclusion in the Known Exploited Vulnerabilities (KEV) catalog; the FBI warned about Kali365, a Telegram-based phishing-as-a-service that captures OAuth tokens to enable widespread Microsoft 365 compromise; a Canadian operator was charged for running the KimWolf DDoS-for-hire botnet that infected over a million devices; a high-profile settlement by Meta in a school-district lawsuit over addictive design and student harm; and a U.S.