CISA is ending its monthly vulnerability bulletin

The rise in AI-generated security threats may just have generated one casualty: the death of the weekly bulletin of security threats from the US Cybersecurity Infrastructure and Security Agency (CISA).

The agency will discontinue its weekly bulletin of known vulnerabilities from September 28. It said that it is taking this step because of the recently introduced Binding Operational Directive (BOD 26-04), which compels US agencies to prioritize patching vulnerabilities according to real-world risk factors. These will include evidence of vulnerabilities being identified in the wild, as opposed to the previous criterion of severity scores. It is not clear why the agency cannot continue to issue weekly bulletins while complying with the demands of BOD.

What could be a more pressing issue for CISA is the proliferation of AI-generated threats. Earlier this month, the agency issued a warning about bad actors threatening AI-developed assets and using them to launch new attacks.

The agency is also encouraging CISOs to follow vendors’ and providers’ own security bulletins and updates in order to strengthen their defences.  Earlier this year, CISA urged these vendors to work more closely with security researchers to improve defences against cyberattacks.

Although it is no longer issuing weekly bulletins, CISA will continue to issue other information through its Known Exploited Vulnerabilities (KEV), its Cybersecurity Alerts and Advisories and its Common Vulnerabilities and Exposures catalogs.