The US Cybersecurity and Infrastructure Security Agency (CISA) has added five old software flaws to its list of bugs that attackers are known to be using. The oldest dates from 2015. CISA added all five to its Known Exploited Vulnerabilities (KEV) catalogue on Thursday 8 October 2026, US time, and gave US federal agencies until Sunday 11 October to deal with them.

Photo: Shixart1985 / Wikimedia Commons (CC BY 2.0), cropped