Guides

Daily CISO has 34 guides, together citing 73 distinct sources. The newest, “Ransomware News: Active Groups, Federal Advisories and the Latest Numbers”, was published November 8, 2026.

Evergreen, sourced answers to the questions that come up between editions: what a tool, directive or routine is, and how security leaders actually use it. Most of these are about patch and vulnerability management; they are gathered, with the glossary and the live trackers, on the patch and vulnerability management hub.

Updated November 8, 2026

1. 
   Ransomware News: Active Groups, Federal Advisories and the Latest Numbers

   The FBI's 2025 ransomware complaint and loss data, the most-reported variants, the newest #StopRansomware advisories, and how many KEV flaws tie to ransomware.

   Published November 8, 2026

2. 
   CISA KEV additions, Nov 4 to Nov 6, 2026: Apple and SonicWall entries and what to triage

   CISA added one Apple CVE on Nov 4 and one SonicWall SonicOS SSLVPN CVE on Nov 6, 2026. What the alerts say and how to set priorities.

   Published November 7, 2026

3. 
   Cold-chain and refrigeration security: what the joint federal advisory asks operators to do

   What CISA, FBI, HHS, USDA and DOT say about attacks on refrigeration controllers, and the four steps they ask operators to take.

   Published November 7, 2026

4. 
   The HIPAA Security Rule update: what the 2025 proposal would require

   HHS proposed mandatory encryption and MFA for the HIPAA Security Rule in January 2025. It is still only a proposal, now targeted for mid-2027, not yet in effect.

   Published November 6, 2026

5. 
   Moving from KEV alerts to a documented remediation exception process

   What CISA's October 30 and November 3, 2026 KEV alerts and its October 26 strategy say about missed remediation, and what a CISO can record.

   Published November 5, 2026

6. 
   What a CISA KEV listing requires of non-federal organizations when a vendor patch is unavailable

   CISA's October 28, October 30 and November 3, 2026 KEV alerts say nothing about unpatched flaws. Here is what they do say and where they stop.

   Published November 5, 2026

7. 
   What CISA's KEV alerts say about the Nov 3 addition and the Ivanti deadline

   CISA's Oct 30 and Nov 3, 2026 KEV alerts list three CVEs. Neither alert states a due date, so here is what they do say and where to look.

   Published November 4, 2026

8. 
   Who must meet CISA's KEV deadlines, and what non-federal organizations can take from them

   CISA's Oct 28, Oct 30 and Nov 3, 2026 KEV alerts say BOD 26-04 binds only federal civilian agencies. Here is what they say others should do.

   Published November 4, 2026

9. 
   Reading CISA KEV alerts for ransomware-use and vendor-mitigation signals

   What four CISA KEV alerts from October 26 to 30, 2026 say about required actions, due dates, fallbacks and ransomware use, and what they leave out.

   Published November 3, 2026

10. 
    What a KEV listing means for exposed edge devices: deadlines and compromise checks

    What CISA's October 2026 KEV alerts, including the Ivanti Connect Secure entries, say about required actions, deadlines and checks for prior compromise.

    Published November 3, 2026

11. 
    Matching KEV alerts to your asset inventory: product names, CVE IDs and CPE strings

    What CISA's KEV alerts give you to match against assets, what they leave out, and what four CISA pages say (and don't say) about CPE strings.

    Published November 2, 2026

12. 
    Matching KEV entries to your asset inventory: names, versions, and CPE

    What three CISA alerts give you to match KEV entries to assets, where version data exists, and what the alerts say about CPE strings.

    Published November 2, 2026

13. 
    Patch Tuesday dates and how to schedule around KEV deadlines

    The three CISA alerts supplied do not state the Patch Tuesday date or any KEV due dates. Here is what they do say about BOD 26-04 and KEV priorities.

    Published November 2, 2026

14. 
    Reading CVSS vectors next to KEV: what CISA's documents say

    The CISA documents we have never define CVSS metrics. They do show how a KEV listing, exposure and post-exploitation control drive priority.

    Published November 2, 2026

15. 
    October 2026 KEV additions: patterns and what to change in remediation

    CISA's four KEV alerts from October 23 to 30, 2026 added Arista, PHP, VMware ESX, Linux kernel and Ivanti flaws. Here is what they support.

    Published November 1, 2026

16. 
    Patch Tuesday vs. KEV: when to break the monthly patch cycle

    What CISA's October 2026 PHP alert and KEV additions say about patching outside a monthly cycle, and what they leave unanswered.

    Published November 1, 2026

17. 
    CISA KEV additions, Oct 28 to Oct 30, 2026: Ivanti and what to triage

    CISA's Oct 28 and Oct 30, 2026 KEV alerts list four CVEs, two in Ivanti Connect Secure. Here is what the alerts say about triage and deadlines.

    Published October 31, 2026

18. 
    SBOMs and KEV: finding Brotli and PHP, and what CISA's alerts require

    CISA's Brotli and PHP alerts do not mention SBOMs, but the PHP alert says to inventory every system running the component. Here is what they require.

    Published October 30, 2026

19. 
    Sequencing patches in a heavy KEV week: KEV, CVSS and EPSS

    What CISA's October 2026 KEV alerts and PHP advisory support for patch order, and what they leave unsaid about CVSS and EPSS.

    Published October 30, 2026

20. 
    CISA KEV additions, Oct 26 to Oct 27, 2026: what was added and how to triage

    CISA's Oct 26 and Oct 27, 2026 KEV alerts list four CVEs in PHP, Adobe Commerce and Magento, and Google Brotli. Here is what they say and omit.

    Published October 29, 2026

21. 
    CISA's Brotli KEV listing: what the Oct 27 and 28, 2026 alerts say, and what they leave out

    CISA added Google Brotli and three other flaws to the KEV Catalog on Oct 27 and 28, 2026. Here is what the alerts say and where they stop.

    Published October 29, 2026

22. 
    Quest Diagnostics breach: what lab and healthcare security leaders should do

    Quest reports unauthorized access to patient records. What is known, and what CISA and the FBI's SafePay advisory tells defenders.

    Published October 29, 2026

23. 
    CISA 2030: what the strategy commits to and what to plan for

    CISA's October 26, 2026 strategy sets three pillars and three deadlines. Here is what it commits to, and what it leaves unsaid on KEV and vendors.

    Published October 27, 2026

24. 
    CISA KEV additions, Oct 16 to Oct 23, 2026: what was added and how to triage

    Nine KEV entries across three CISA alerts, plus what BOD 26-04 says about prioritizing them. The alerts give no due dates.

    Published October 26, 2026

25. 
    Defending election and campaign officials against cyber threat actors

    What CISA and the FBI say about phishing and smishing aimed at election and campaign officials, and which CISA defensive steps apply to supporting security teams.

    Published October 26, 2026

26. 
    Defending election and campaign officials against phishing and account takeover

    What CISA says threat actors use against election and campaign officials, and which account controls its SafePay advisory lists for high-risk users.

    Published October 26, 2026

27. 
    Google Chrome's critical vulnerabilities, October 2026: what to patch now

    Chrome shipped five updates in October 2026. Google's own severity rating calls 19 of the fixed flaws Critical. None is yet on CISA's KEV catalog. Update now.

    Published October 26, 2026

28. 
    PHP2Shell: patching the critical PHP vulnerabilities CISA flagged

    CISA's guidance on CVE-2026-109618 and CVE-2026-109619: who is exposed, which PHP versions fix them, what to monitor, and how they sit beside new KEV entries.

    Published October 26, 2026

29. 
    BeyondTrust Remote Support flaw: what CISA says to patch, hunt and rotate

    CISA says CVE-2026-102764 in BeyondTrust Remote Support is under active exploitation. Here is its guidance on patching, compromise checks and credential rotation.

    Published October 24, 2026

30. 
    CISA on BeyondTrust Remote Support: patch, hunt and contain CVE-2026-102764

    CISA's October 16, 2026 alert on CVE-2026-102764 in BeyondTrust Remote Support: affected versions, patching, forensics and exposure limits.

    Published October 24, 2026

31. 
    SafePay ransomware: what the CISA/FBI advisory says and how to defend

    How SafePay breaks in, spreads, steals data and extorts victims, and which mitigations in the October 2026 CISA/FBI advisory to put first.

    Published October 22, 2026

32. 
    EO 14028, 14144, 14306 and 14412: the federal cybersecurity deadlines still ahead

    Four executive orders set the federal cybersecurity deadlines still ahead, most already passed. Two OMB memos and a fourth order add 2026-2027 dates, plus 2030 and 2031.

    Published October 13, 2026

33. 
    CVE, CVSS, KEV, EPSS and 27 more: a sourced security glossary

    31 security terms CISOs run into daily — CVE, CVSS, KEV, EPSS, ransomware, phishing and more — each defined from NIST, the FBI, CISA, FIRST.org or Microsoft's own pages.

    Published October 11, 2026

34. 
    What is CISA KEV, and how do CISOs use it?

    CISA's KEV catalog lists flaws attackers are already exploiting. BOD 26-04 (June 10, 2026) replaced the old flat deadlines with a four-factor, risk-tiered patching clock.

    Published October 7, 2026