Week of May 25, 2026: CISA KEV Surge and Nx/GitHub Supply-Chain Compromise

Security leaders watched CISA add five vulnerabilities to its Known Exploited Vulnerabilities Catalog across the week, including a Palo Alto Networks PAN-OS authentication bypass and a malicious Nx Console VS Code extension tied to a GitHub repository compromise. CISA also rescheduled CIRCIA stakeholder town halls, detailed World Cup 2026 security exercises, and the industry recorded new cybersecurity leadership appointments.

CISA Adds PAN-OS Authentication Bypass to KEV Catalog

CISA added CVE-2026-0257, a Palo Alto Networks PAN-OS authentication bypass vulnerability, to its Known Exploited Vulnerabilities Catalog on May 29, 2026, citing evidence of active exploitation. Federal civilian agencies must remediate the flaw under Binding Operational Directive 22-01's deadline, and CISA urged all organizations managing PAN-OS deployments to prioritize patching given confirmed in-the-wild abuse of the authentication bypass as part of ongoing vulnerability management practices. (CISA)

Malicious Nx Console Extension Leads to GitHub Repository Compromise

CISA disclosed that threat actors used a prior compromise of Nx developer systems to push a poisoned Nx Console VS Code extension, version 18.95.0, through the automatic update mechanism, compromising a GitHub employee's device and enabling unauthorized access to and exfiltration of internal GitHub repositories. The agency assigned CVE-2026-48027 to the malicious extension and urged organizations to audit CI/CD workflows, revert unauthorized changes, and rotate credentials exposed to build pipelines. (CISA)

CISA Adds Three Vulnerabilities to KEV Catalog, Including Daemon Tools Lite and TanStack

On May 27, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog: a Daemon Tools Lite embedded malicious code flaw, an unspecified TanStack vulnerability, and the Nx Console embedded malicious code issue tied to the GitHub supply-chain incident. CISA said these vulnerability types remain frequent attack vectors for malicious cyber actors and again urged all organizations, not only federal civilian agencies, to prioritize remediation as part of standard vulnerability management. (CISA)

LiteSpeed cPanel Plugin Privilege Escalation Added to KEV Catalog

CISA added CVE-2026-48172, a LiteSpeed cPanel plugin privilege escalation vulnerability, to its Known Exploited Vulnerabilities Catalog on May 26, 2026, based on evidence of active exploitation. The addition triggers remediation obligations for federal civilian executive branch agencies under Binding Operational Directive 22-01, and CISA again encouraged private-sector organizations running the affected plugin to treat timely patching of privilege escalation flaws as a core part of vulnerability management programs. (CISA)

CISA Details World Cup 2026 Security Readiness Ahead of Matches

CISA published a May 27, 2026 account of its preparations for FIFA World Cup 2026, noting the Department of Homeland Security designated all 78 matches with Special Event Assessment Rating Level 1 and 2, a sharp rise in high-rated events compared with an average year. The post described a Lumen Field full-scale exercise with more than 460 participants from over 25 organizations, stress-testing stadium and transit security coordination with Seattle-area partners ahead of the tournament. (CISA)

CISA Reschedules CIRCIA Town Halls After Prior Postponement

CISA announced on May 26, 2026 a revised schedule of virtual town hall meetings, beginning June 15, to gather stakeholder input on the Cyber Incident Reporting for Critical Infrastructure Act rulemaking, replacing sessions earlier canceled due to a government shutdown. Once finalized, the rule will require covered critical infrastructure entities to report certain cyber incidents to CISA within 72 hours and ransom payments within 24 hours, a timeline CISOs in regulated sectors continue to track closely. (CISA)

Security Leadership Moves: CTERA Names Cybersecurity SVP, CISA Adds First COO

Industry moves reported for the week of May 25, 2026 included CTERA appointing Tal Sarfaty as Senior Vice President of Cybersecurity after prior roles at Citi, Promisec, and SofaWare, and CISA welcoming Ryan Donaghy back as the agency's first Chief Operating Officer following earlier CISA leadership roles since 2016. Other appointments that week included a new SVP of Engineering at CodeHunter and a new CTO at Quantum Secure Encryption. (SecurityWeek)