The US Cybersecurity and Infrastructure Security Agency (CISA) will cease its weekly vulnerability bulletins starting September 28. "Newly recorded vulnerabilities will remain available on CVE.org," CISA emphasized, while users should rely on the CISA Known Exploited Vulnerability (KEV) Catalog, Cybersecurity Alerts and Advisories, and vendor security alerts for actionable, risk-based updates. Bahmanyar adds, "As AI-driven cyberattacks continue to rise and adversaries automate attacks at greater scale and speed, CISA's move to a more contextual, risk-based vulnerability prioritization approach is a significant and welcome step forward."
Besides the growing challenge of addressing every new vulnerability—bug bounty platforms like Bugcrowd, HackerOne, and TrendAI's Zero Day Initiative have reported submissions doubling and tripling recently—another factor is the attackers' focus on exploiting only a small subset of all vulnerabilities.
Waseem Ahmed, the founding member and head of engineering at Secure.com, emphasizes that many organizations continue to heavily rely on severity scores without adequate visibility into how these vulnerabilities relate to actual attack paths. "CISA is correct that a CVSS score alone cannot determine what to patch first." Surace also notes that the weekly bulletin provided a reliable platform for security teams to see newly disclosed vulnerabilities.
Related: Why AI Is So Good at Scamming Humans Removing it places the burden of assembling the picture on defenders who are already overworked, particularly at smaller organizations.
