CISA

The full name is the Cybersecurity and Infrastructure Security Agency. It's part of the US Department of Homeland Security.

Imagine you're a doctor and you get two kinds of bulletin from the health authorities. One says: "this disease theoretically exists somewhere in the world." The other says: "this disease already has confirmed cases in your neighborhood, here are the addresses." The second bulletin is the one you actually drop everything else to read. CISA does exactly this, but for software. Their list is called KEV. That's short for Known Exploited Vulnerabilities catalog, literally: a catalog of holes already in use. Only cases with proven attacks make it in, not hypotheses.

The difference matters. Every year, researchers around the world painstakingly find and document thousands of holes in software. Almost nobody but their author pays attention to most of them. CISA doesn't report on all that noise. Only the case where it's already proven that someone specific went through exactly this hole makes it in. So the list isn't reading material for the curious. It's a list of the doors currently actually being kicked.

The list isn't the only thing CISA puts out. On October 8, 2026 it, the FBI and the US National Security Agency (NSA), together with agencies from the UK, Australia, Canada, Japan, New Zealand and Spain, issued a joint advisory about Integrity Technology Group, a China-based cybersecurity company with ties to the Chinese government. According to the advisory, the company supplies attackers with tools, botnets and VPN infrastructure. The targets are edge devices that organizations don't watch closely, in government, manufacturing, healthcare and information technology. An advisory like this doesn't only name who's behind it. It also tells you what to patch, and the same day some of the holes in it went into KEV.

The difference between "theoretically dangerous" and "CISA said it's already under attack" is the difference between suspecting an illness and a confirmed diagnosis.

Look at it the other way

CISA is more like a doctor declaring an epidemic than a weatherman making a forecast. It's not "you might get sick" here, it's "there are already confirmed cases, here are the addresses". So when we cite CISA under a breach story here at we are coded, we're not doing it for weight of prose. We're doing it because it means someone specific, proven, has already caught the infection through exactly this gap. But software has no borders. The agency is American, but the infection it flags is the same in software used by a Bulgarian company or shop. If your neighborhood drinks from the same tap, the infection is already yours too.

The visual is generated code-art, no third-party images.