Decision Insights Threat Desk

CISA released CPG 2.0, adding a governance component and measurable actions for IT and OT to reach a foundational cybersecurity level.

CISA issued 12 ICS advisories covering products from Johnson Controls, Siemens, AzeoTech, OpenPLC_V3, GDCM, and Varex Imaging.

CISA added CVE-2025-58360, an OSGeo GeoServer XML external entity vulnerability, to the Known Exploited Vulnerabilities Catalog.

CISA and partners report pro-Russia hacktivists exploit internet-facing VNC to access OT control devices and cause physical damage.

CISA added CVE-2025-6218 and CVE-2025-62221 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.

CISA details PCIe IDE specification flaws that can allow local actors to cause receivers to accept stale or corrupted data.