CISA
As CISA reportedly admits two of its systems were breached in February due to Ivanti flaws
"Package managers are at a critical point in the open source ecosystem and have the capability to scale security improvements across open source ecosystems"
"This actor is not doing the quiet intelligence collection and theft of secrets... they can disrupt major services if, and when, the order comes down,"
"When we see a vulnerability or intrusion campaign that could have been reasonably avoided if the software manufacturer had aligned to secure by design principles, we’ll call it out"
CISA has sounded the alarm over a pair of actively targeted vulnerabilities in Ivanti and Veeam software
"We have gotten very smart on how to do business with agencies and build in flexibility into our contracting vehicles. We took an approach early on to divide and conquer..."
Attackers dropped a webshell, collected and exfiltrated Active Directory data, then ran into some healthy obstacles...
Following a major security breach involving US federal agencies, Microsoft refuses to provide details on the incident
... and probably shot to high heaven with malware.