| Date | Source | Type | Title | Author |
|---|---|---|---|---|
| Jan 30, 2026 | NSA | Analysis Report | CTR: Zero Trust Implementation Guideline Phase Two Cybersecurity Technical Report Zero Trust Implementation Guideline January 2026 1.0 Initial publication The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Gove… | CISA, NSA |
| Jan 30, 2026 | CERT-EU | Advisory | 2026-001: Critical vulnerabilities in Ivanti EPMM An attacker could exploit those flaws to achieve unauthenticated remote code execution on the vulnerable device. One of these vulnerabilities have been exploited in a The vulnerability CVE-2026-1281, with a CVSS score of 9.8, is a code injection vulnerability in Ivanti Endpoint Manager Mobile. | CERT-EU |
| Jan 29, 2026 | FBI | Alert | Justice Department Announces Actions To Combat Two Russian State Sponsored Cyber Criminal Hacking Groups The Justice Department announced two indictments in the Central District of California charging Ukrainian national Victoria Eduardovna Dubranova, 33, also known as Vika, Tory, and SovaSonya, for her role in conducting cyberattacks and computer intrusions against critical infrastructure and other victims around the world, in support of Russia’s geopolitical interests. | FBI |
| Jan 28, 2026 | CISA | Alert | Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858 Newly disclosed vulnerability Common Vulnerabilities and Exposures (CVE)-2026-24858 [ Common Weakness Enumeration (CWE)-288: Authentication Bypass Using an Alternate Path or Channel ] allows malicious actors with a FortiCloud account and a registered device to log in to separate devices registered to other users in FortiOS, FortiManager, FortiWeb, FortiProxy, and FortiAnalyzer, if FortiCloud single sign on (SSO) is enabled on devices. | CISA |
| Jan 23, 2026 | CISA | Advisory | Product Categories for Technologies That Use Post-Quantum Cryptography Standards The Hardware Asset Management (HWAM) Capability provides organizations visibility into the hardware devices operating on their network(s), so they can manage and defend them in an appropriate manner. It also provides a view of device management responsibility such that prioritized defects can be presented to the assigned party for mitigation actions and risk acceptance decisions. | CISA |
| Jan 14, 2026 | CISA | Advisory | Secure Connectivity Principles for Operational Technology (OT) This guidance outlines eight principles to use as a framework to design, secure, and manage connectivity into OT environments. These principles are particularly critical for operators of essential services. | CISA, NCSC-UK |
| Jan 14, 2026 | FBI | Guidance | Secure Connectivity Principles for Operational Technology SSeeccuurree CCoonnnneeccttiivviittyy PPrriinncciipplleess ffoorr OOppeerraattiioonnaall TTeecchhnnoollooggyy ((OOTT)) Operational technology (OT) environments - which have long been centred on safety, uptime, and operational continuity - are now more interconnected than ever. | ASD/ACSC, BSI, CCCS, FBI, NCSC-NL, NCSC-NZ, NCSC-UK |
| Jan 14, 2026 | NSA | Analysis Report | CTR: Zero Trust Implementation Guideline Primer Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product This document was developed in furtherance of NSA’s cybersecurity missions, including its responsibilities to identify and disseminate threats, and to d… | CISA, NSA |
| Jan 14, 2026 | JPCERT/CC | Alert | Microsoft Releases January 2026 Security Updates Microsoft has released January 2026 Security Updates to address the vulnerabilities in their products. Remote attackers leveraging these vulnerabilities may be able to execute arbitrary code. According to Microsoft, among the vulnerabilities, the following vulnerability has been confirmed to be exploited in the wild. | JPCERT/CC |
| Jan 8, 2026 | FBI | Alert | North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities As of 2025, Kimsuky actors have targeted think tanks, academic institutions, and both U.S. and foreign government entities with embedded malicious Quick Response (QR) codes in spearphishing campaigns. This type of spearphishing attack is referred to as Quishing. | FBI |