Week of February 2, 2026: CISA Mandates Edge-Device Overhaul; Microsoft, Pennsylvania Name New CISOs

Security leaders faced a new federal mandate forcing removal of end-of-support edge devices, a joint CISA-FBI-NCSC warning on nation-state exploitation of those same devices, and two rounds of CISA Known Exploited Vulnerabilities additions covering six CVEs between February 3 and February 5, 2026. The week also brought a wave of CISO moves at the Commonwealth of Pennsylvania, Microsoft, and Torq, alongside an SEC filing closing out a prior website-defacement incident at a small public company.

CISA Issues Binding Directive to Purge End-of-Support Edge Devices

CISA issued Binding Operational Directive 26-02, "Mitigating Risk From End-of-Support Edge Devices," requiring Federal Civilian Executive Branch agencies to inventory, update, and remove edge hardware and software no longer supported by vendors. The directive instructs agencies to update supported devices running end-of-support software, report end-of-support assets to CISA, and establish continuous lifecycle management for load balancers, firewalls, routers, and other perimeter equipment. CISA Acting Director Madhu Gottumukkala said unsupported devices "should never remain on enterprise networks." CISA encouraged non-federal organizations to adopt similar actions to strengthen edge device security. (CISA)

CISA, FBI, and UK's NCSC Warn on Nation-State Exploitation of EOS Edge Devices

CISA, the FBI, and the UK's National Cyber Security Centre published a joint fact sheet warning that nation-state threat actors exploit end-of-support edge devices—including load balancers, firewalls, routers, and VPN gateways—to gain network access and compromise sensitive data. The agencies said organizations using devices exposed to the public internet at the network edge face particular risk. Recommended mitigations included maintaining an asset inventory with support timelines, replacing unsupported hardware, and enabling automatic updates to patch known CVEs when immediate replacement is not possible. The guidance accompanied CISA's new Binding Operational Directive 26-02. (CISA)

CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog

CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2019-19006 in Sangoma FreePBX, CVE-2021-39935 in GitLab Community and Enterprise Editions, CVE-2025-40551 in SolarWinds Web Help Desk, and CVE-2025-64328, another Sangoma FreePBX flaw. CISA said the vulnerability types are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate catalog entries by their due dates, and CISA urged all organizations to prioritize the same patching. (CISA)

CISA Adds Two More Exploited Flaws, Including a SmarterMail Auth Bypass

CISA added two more vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-11953, an OS command injection flaw in the React Native Community CLI, and CVE-2026-24423, a missing-authentication vulnerability in SmarterTools SmarterMail. CISA cited evidence of active exploitation for both entries. The agency reiterated that Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate catalog vulnerabilities by set deadlines, and it urged all organizations to prioritize timely remediation of the two additions as part of routine vulnerability management. (CISA)

Wytec International Closes Out Website Defacement Incident Disclosure

Wytec International filed an amended Form 8-K confirming it had restored IT systems and data affected by a cybersecurity incident first disclosed in 2025, in which an unidentified actor defaced the company's website, wytecintl.com, and redefaced it after an initial restoration. The company said the investigating authorities closed the matter without identifying the source of the attack. Wytec stated that the incident's impacts consisted primarily of costs to rebuild the website on a new server and hosting platform and to enhance security protocols. CEO William H. Gray signed the filing dated February 3, 2026. (SEC EDGAR)