Homeland

CISA ends mandatory terrorist vetting for high-risk chemical plants

1 min readSeptember 8, 2026

Owners and operators lose federal staff-screening tool after July 2023 program lapse

GAO says DHS contract savings will fall short of $10.5 billion estimate

1 min readSeptember 3, 2026

The Department of Homeland Security's reported $10.5 billion cost avoidance from 438 contract terminations between Jan 1 and Sep 30 2025 is unlikely to be realized.

Elsewhere

What other outlets are reporting on this beat. We link out; we do not republish.

CISA Adds One Known Exploited Vulnerability to Catalog | CISA
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
CISA advisories 17 hours ago
ICE Is Reportedly Using A Palantir Database To Compile Dossiers On Protestors
An attorney representing protestors said this infringes on First Amendment rights. Ryan Murphy/Getty Images As revealed by unsealed court documents, Department of Homeland Security agents are allegedly creating dossiers on those that are accused of observing or protesting Immigration and Customs Enforcement agents. As first reported by Wired, these DHS files on protestors reportedly include sensitive info like photos and license plate numbers and are stored in a database built by Palantir called Investigative Case Management. The new information comes from a partially unsealed court filing about a January ICE operation that took place in Maine, according to Wired. The filing is part of a class action lawsuit, which led to a redacted version becoming available to the public on Friday and revealing the purported database of ICE protestors. According to the lawsuit, DHS agents would track and intimidate observers or protestors, sometimes by driving by their homes or labeling them as "Threat to Law Enforcement, Professional Protestor." In one example, an agent reportedly called one of the plaintiffs on her cell and suggested that she tell her spouse "not to do anything like that in the future because people who are doing things like that might get added to a domestic terrorism watchlist." The lawyers representing the plaintiffs said that this sort of database creates a chilling effect on the First Amendment rights of protestors. On the other side, a DHS spokesperson told Wired that the case was "meritless" and denied the existence of such a database that labels and tracks "domestic terrorists."
Engadget 2 days ago
DHS readies major cyber contract
The Department of Homeland Security is preparing this year to award a major cloud, cybersecurity and network services contract aimed at further centralizing the management of IT services across DHS. In a notice posted to Sam.gov last month, DHS laid out the notional timeline for award of the Network, Cloud and Cybersecurity Services 2.0 vehicle, known as NCCS 2.0. The notice included a draft request for proposals and a draft statement of work. DHS plans to release the final solicitation in early October before making a final award in late November. The contract will have a $626 million ceiling, according to the draft RFP. The purpose of the contract is to allow DHS to buy “the full range of cybersecurity, network operations, management, and other professional support services” for DHS CIO’s office and select components, the draft statement of work states. “These services will enable DHS to provide network, cloud platform, system, application, and cybersecurity monitoring and analysis, incident management and coordination, and alert and notification functions in support of the broader DHS information enterprise and to provide other related cybersecurity services,” the document states. The “primary objective” of the contract is to evolve the DHS headquarters Network Operations and Service Center (NOSC) into a “best-in-class service entity that meets DHS Cybersecurity Provider (CSP) Program, industrial, and other doctrinal Center of Excellence service maturity standards.” A “secondary objective” for the contract is to redefine the NOSC as the “central hub” for managing network services, infrastructure, platforms and cybersecurity for the DHS OneNet across all classification levels, according to the draft statement of work. It states that the winning vendor will be responsible for “identifying, protecting against, detecting, responding to, and recovering from any malicious or disruptive information technology events and incidents, and ensuring that DHS OCIO is able to r
Federal News Network 3 days ago
ICE Has Been Dumping Protester Photos Into a Palantir Database
Palantir did not immediately respond to requests for comment. A spokesperson for DHS calls the case “meritless” and says that “the underlying lawsuit is based on the lie that there is a database of ‘domestic terrorists’ run by DHS.” Plaintiffs allege in the filing, which is heavily based on documents produced by the government and depositions of DHS agents, that agents had a practice of intimidating protesters and observers. They did this, the filing says, by doing drive-bys of the observers’ homes and, in the case of at least one observer, requiring that she be referred to secondary inspection any time she tries to cross the border until at least January 2027. "The government is treating people who exercise their First Amendment rights and seek to hold it accountable as criminal suspects, and that's what we're asking the court to stop,” says JoAnna Suriani, an attorney at Protect Democracy who is representing ICE observers in the case. The filing focuses on agents’ conduct during “Operation Catch of the Day,” an immigration enforcement surge in Maine this past January. It is part of a proposed class action brought in federal court in Maine by four observers: Elinor Hilton, Colleen Fagan, Polyxenia Pantos, and Carlyn Williams. It was filed under seal in September, and a redacted version was made public Friday. In particular, it describes how one DHS agent, referred to as “Agent J.C.” in the filing, used the Investigative Case Management (ICM) database, which the government describes as the case management system the ICE component Homeland Security Investigations (HSI) uses to document its investigations, to flag observers. According to the filings, J.C. created ICM records on at least six observers; the government puts the number of people at eight. He labeled two people he filmed at a Home Depot parking lot with “Threat to Law Enforcement, Professional Protestor,” according to the filing, and sent photos of them and others to a US Customs and Border Protection (CBP
Wired 3 days ago
CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
CISA advisories 3 days ago
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
The US Cybersecurity and Infrastructure Security Agency (CISA) and Fortinet on Thursday sounded the alarm on a critical FortiMail vulnerability that has been exploited in the wild. Patches have yet to be released. Tracked as CVE-2026-104286 (CVSS score of 9.8), the zero-day is a path traversal and an improper neutralization of NULL byte or NULL character flaw that could allow attackers to write arbitrary files to the underlying system. Threat actors could exploit the issue via crafted HTTP or HTTPS requests, potentially gaining arbitrary code or command execution. Fortinet has published an advisory describing the security defect, urging organizations to disable the IBE feature support or disable access to the FortiMail management interface from the web and limit access to trusted sources. “This has been reported to be exploited in the wild; customers are urged to apply the workaround,” the company said. Fortinet also published indicators of compromise (IoCs) to help security teams hunt for potential intrusions.Advertisement. Scroll to continue reading. On Thursday, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to address it within three days, as mandated by BOD 26-04. According to Fortinet, the security bug was discovered internally and affects FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. The company says fixes will be included in the upcoming FortiMail versions 7.4.9, 7.6.7, and 8.0.2, but has not provided a release timeline. Neither Fortinet nor CISA has provided details on the observed attacks. Related: Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure Related: Zammad Zero-Days Exploited in AI-Powered DIVD Hack Related: Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability Related: Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
SecurityWeek 3 days ago
Judge denies relief in push for Oregon immigration detainee attorney access
The court also dismissed two defendants from the suit and declined to certify a class of individuals who fear arrest and detention.EUGENE, Ore. (CN) — A federal judge declined to order the Department of Homeland Security to ensure migrants in Oregon have access to attorneys before they are transferred out of the state.“Plaintiffs cite no case for the proposition that access to counsel before transfer to [Northwest ICE Processing Center] is required,” U.S. District Judge Ann Aiken wrote in a 32-page order.Clear Clinic, a Portland, Oregon-based pro bono law firm, and Pineros y Campesinos Unidos del Noroeste, a nonprofit representing Latino farmworkers, sued the Department of Homeland Security in 2025, accusing Immigration and Customs Enforcement officers of blocking detainees from accessing lawyers. Leon X, a 32-year-old Mexican national with a pending visa application, joined as a plaintiff to represent a class of individuals who fear arrest and detention by ICE.The nonprofits said detainees are held in ICE facilities for mere hours before being transferred to larger facilities out of state, which denies them access to lawyers. The government argued deferring meetings with potential counsel before transferring detainees is not the same as denying counsel.Aiken denied the nonprofits’ emergency motion for a temporary restraining order last year and on Wednesday denied their motion for a preliminary injunction and class certification.The Bill Clinton appointee found that of the three plaintiffs, only Clear Clinic had standing to pursue its claims and preliminary injunction.Under the proposed injunction, the nonprofit wanted ICE ordered to arrange a meeting between pro bono attorneys and detainees as well as provide the plaintiffs with all paperwork related to detained individuals even before an attorney-client relationship has been established. The nonprofit also requested detainees be allowed to attend Pineros y Campesinos Unidos del Noroeste’s Know Your Rights traini
Courthouse News 4 days ago
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
CISA advisories 4 days ago

Newsletter

What the federal government did today, and what it changes - with the document behind every item.

Federal Reserve publishes change-in-control notice for Shnaider Family Trust acquisition

SEC Sets Deadline for Hearing on SLR BDC Share-Class Exemption

Nasdaq proposes written clearing affirmation for Night Session trades

Nasdaq MRX adopts immediate rule change to reflect Nasdaq Texas name

Homeland

CISA ends mandatory terrorist vetting for high-risk chemical plants

GAO says DHS contract savings will fall short of $10.5 billion estimate