CISA Cybersecurity Advisories

https://www.cisa.gov/news-events/cybersecurity-advisories

US government joint advisories often co-signed with allied CERTs (UK NCSC, ACSC AU, NCSC-NZ, CCCS CA, BSI DE, CERT-EU). WebFetch is reliably HTTP 403 on cisa.gov (re-confirmed 2026-05-08). REQUIRED FETCH METHOD: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/cybersecurity-advisories`. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api/bridge: python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/cybersecurity-advisories (then `cisa page <alert_url>` to drill). AVOID: WebFetch reliably HTTP 403 on cisa.gov, skip it entirely. Use the bridge `cisa page` subcommand.. | 2026-07-04: bridge (cisa page) upstream HTTP 403 again, consecutive_fetch_failures 2; 403 is transport blocking (does NOT demote per lifecycle rules). CISA KEV JSON API still works via the bridge. | 2026-07-05 root-cause confirmed: www.cisa.gov dynamic paths (/news-events/*, all .xml feeds, and the CSAF .well-known) are blocked by Akamai bot management (`Access Denied`, `Reference #18.*`) for EVERY UA/header combination tested (chrome/firefox/googlebot/curl/minimal/+Referer all 403), the block keys off the egress TLS/behavioural fingerprint, so it is unfixable from request headers. Only the STATIC /sites/default/files/feeds/ path (KEV JSON) is served. No reachable alternative for the advisory HTML content (search.gov results are a JS shell needing an API key; Wayback has no snapshots). SUBSTITUTE: `cisa-kev` JSON API for exploited-vuln ground truth + WebSearch corroboration for advisory narrative (covered_anyway). STAYS ACTIVE; a 403 is a transport block and NEVER demotes (hard rule). source_health.py now classifies this `bridge-blocked` (handled), not `needs-demote`, so the routine stops re-flagging it every run. | 2026-07-05 RECOVERED; CISA dynamic content is now reachable. The Akamai 403 on every UA still holds for a DIRECT fetch, but `tools/fetch_source.py` routes cisa.gov through the r.jina.ai reader proxy (server-side fetch, bypasses the Akamai fingerprint) for `cisa page` / `cisa feed`, and through the cisagov/CSAF GitHub mirror (raw.githubusercontent.com, not proxy-blocked) for `cisa csaf-recent` / `cisa csaf` (fully-structured ICS advisories). This SUPERSEDES the earlier KEV+WebSearch-substitute handling; the advisory/directive/news content itself is now fetchable with full detail. `cisa-kev` JSON remains the exploited-vuln ground truth. FETCH now works via the reader-proxy recipe: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml` to discover items (title+link), then `cisa page <advisory_url>` for the full body. For ICS/OT advisories prefer the fully-structured CSAF mirror: `cisa csaf-recent [N]` (dated index) + `cisa csaf <icsa-YY-DDD-NN>`. | 2026-07-05 admiralty audit: A (primary-authority), CISA advisories; bridge 403 is a known transport block (does NOT demote per lifecycle rules), host confirmed live via KEV. Status stays active. | 2026-07-09 structured-listing recipe (v3.14): the /news-events/cybersecurity-advisories listing is a JS shell, `cisa page` on it returns only the filter UI. REQUIRED listing fetch: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml 20` (structured {title,link} items, newest first); drill each item with `cisa page <link>`. Confirmed working 2026-07-09. | 2026-07-10: recipe recovered, `python3 tools/fetch_source.py cisa page` returned 200 full listing (S2); freshest item 07-07, no in-window content. Rotation-gap cleared; fetch_method/bridge path works. | 2026-07-10 (2009Z run): page URL returned only filter/facet UI in static HTML (no enumerated advisory rows); S1 recovered content via the RSS feed https://www.cisa.gov/cybersecurity-advisories/all.xml, which surfaced the in-window KEV addition. Prefer the RSS feed over the page URL for enumeration. | 2026-07-26 weekly quality audit: RUN-TIME RECIPE DIVERGENCE FIXED: the 2026-07-25 and 2026-07-26 fires both logged HTTP 403 fetching the /news-events/cybersecurity-advisories HTML listing while source_health.py probed the record green, because the health probe uses the working feed recipe (`cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml`), which is what a sweep must lead with too. This is an IGNORED-recipe problem, not a missing one: that feed URL was already this record's rss_url and the 2026-07-10 note already said to prefer it, and the fires still swept the url field. LEAD WITH rss_url. NEVER sweep the /news-events/cybersecurity-advisories HTML listing: Akamai 403s it for every UA. | 2026-08-04 run: FETCH NOTE, `cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml` returns 30 items cleanly, but the parsed `published` field comes back EMPTY. In-window filtering requires the date path in each alert URL (/news-events/alerts/YYYY/MM/DD/...) or the ICS day-of-year id (icsa-26-NNN-XX). | 2026-08-16: third consecutive run unreachable: cisa.gov Akamai-403s every direct UA and the jina reader pool (the documented recovery transport) returned HTTP 402 on all seven keys, so the full ladder failed. NOT demoted (403 is transport blocking, not content death). The CISA KEV and CSAF endpoints do not route through jina and covered the advisory surface this run; they are the load-bearing CISA path until reader credit is restored. | 2026-08-17: unreachable again, direct transport refused and the jina reader pool returned HTTP 402 on every rotating key, so the documented ladder had no last rung. Transport blocking plus an exhausted reader quota; NOT demoted. | 2026-08-18: fifth consecutive run unreachable, cisa.gov refuses the direct transport on every user agent and the reader pool returned HTTP 402 on all seven keys, so the documented ladder again had no last rung. NOT demoted (403 is transport blocking, not content death). The KEV API and the cisagov CSAF mirror do not route through the reader and covered the exploited-vulnerability and ICS surfaces this run; the general AA-series advisory listing was reachable by no transport. | 2026-08-19: sixth consecutive unreachable run, HTTP 403 to every direct transport with the reader fallback credit-exhausted; NOT demoted, a transport block is not content death. The KEV JSON feed remains the working substitute for the exploited-vulnerability surface. | 2026-09-04: advisories/directives listing returned only filter-facet shell content on the bridge `cisa page` transport, consistent with prior 403/JS-shell condition; CISA KEV JSON feed unaffected and confirmed 0 in-window additions separately. | 2026-09-05 audit: bridge cisa page transport returned an unfiltered/unsorted facet page with no dated item list; CISA KEV JSON feed (separate source) unaffected and confirmed 0 in-window additions. | 2026-09-06: bridge `cisa page` again returned only the filter-facet shell (same long-documented JS-shell condition); the feed substitute (`cisa feed .../all.xml`) worked and confirmed the newest KEV-adjacent alert was already covered, no further in-window items. | 2026-09-29: in-container reads of cisa.gov are impossible without reader credit (Akamai 403 on all UAs; jina 402), BUT the agent-side WebFetch tool reached all.xml, the JS-hydrated /news-events/cybersecurity-advisories listing (10 dated items) and detail pages 5/5 times today, use WebFetch (outbound-links template) first for the listing/feed and item pages; `cisa csaf-recent N` (+ `cisa csaf <id>`) for ICS/OT advisories and `cisa-kev` need no reader; joint AA-series advisories are also mirrored by the co-signing agencies (NSA media.defense.gov, IC3, NCSC-UK, ASD). Health check: in-container command `cisa csaf-recent 10` proves the free mirror path only (partial: ICS advisories); the AA-series/alerts surface is agent-WebFetch-only. Re-sample WebFetch on the next fire before rewriting the CLAUDE.md 'never WebFetch CISA' rule. (2026-09-29T2134Z-audit) | US government joint advisories often co-signed with allied CERTs (UK NCSC, ACSC AU, NCSC-NZ, CCCS CA, BSI DE, CERT-EU). WebFetch is reliably HTTP 403 on cisa.gov (re-confirmed 2026-05-08). REQUIRED FETCH METHOD: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/cybersecurity-advisories`. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api/bridge: python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/cybersecurity-advisories (then `cisa page <alert_url>` to drill). AVOID: WebFetch reliably HTTP 403 on cisa.gov, skip it entirely. Use the bridge `cisa page` subcommand.. | 2026-07-04: bridge (cisa page) upstream HTTP 403 again, consecutive_fetch_failures 2; 403 is transport blocking (does NOT demote per lifecycle rules). CISA KEV JSON API still works via the bridge. | 2026-07-05 root-cause confirmed: www.cisa.gov dynamic paths (/news-events/*, all .xml feeds, and the CSAF .well-known) are blocked by Akamai bot management (`Access Denied`, `Reference #18.*`) for EVERY UA/header combination tested (chrome/firefox/googlebot/curl/minimal/+Referer all 403), the block keys off the egress TLS/behavioural fingerprint, so it is unfixable from request headers. Only the STATIC /sites/default/files/feeds/ path (KEV JSON) is served. No reachable alternative for the advisory HTML content (search.gov results are a JS shell needing an API key; Wayback has no snapshots). SUBSTITUTE: `cisa-kev` JSON API for exploited-vuln ground truth + WebSearch corroboration for advisory narrative (covered_anyway). STAYS ACTIVE; a 403 is a transport block and NEVER demotes (hard rule). source_health.py now classifies this `bridge-blocked` (handled), not `needs-demote`, so the routine stops re-flagging it every run. | 2026-07-05 RECOVERED; CISA dynamic content is now reachable. The Akamai 403 on every UA still holds for a DIRECT fetch, but `tools/fetch_source.py` routes cisa.gov through the r.jina.ai reader proxy (server-side fetch, bypasses the Akamai fingerprint) for `cisa page` / `cisa feed`, and through the cisagov/CSAF GitHub mirror (raw.githubusercontent.com, not proxy-blocked) for `cisa csaf-recent` / `cisa csaf` (fully-structured ICS advisories). This SUPERSEDES the earlier KEV+WebSearch-substitute handling; the advisory/directive/news content itself is now fetchable with full detail. `cisa-kev` JSON remains the exploited-vuln ground truth. FETCH now works via the reader-proxy recipe: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml` to discover items (title+link), then `cisa page <advisory_url>` for the full body. For ICS/OT advisories prefer the fully-structured CSAF mirror: `cisa csaf-recent [N]` (dated index) + `cisa csaf <icsa-YY-DDD-NN>`. | 2026-07-05 admiralty audit: A (primary-authority), CISA advisories; bridge 403 is a known transport block (does NOT demote per lifecycle rules), host confirmed live via KEV. Status stays active. | 2026-07-09 structured-listing recipe (v3.14): the /news-events/cybersecurity-advisories listing is a JS shell, `cisa page` on it returns only the filter UI. REQUIRED listing fetch: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml 20` (structured {title,link} items, newest first); drill each item with `cisa page <link>`. Confirmed working 2026-07-09. | 2026-07-10: recipe recovered, `python3 tools/fetch_source.py cisa page` returned 200 full listing (S2); freshest item 07-07, no in-window content. Rotation-gap cleared; fetch_method/bridge path works. | 2026-07-10 (2009Z run): page URL returned only filter/facet UI in static HTML (no enumerated advisory rows); S1 recovered content via the RSS feed https://www.cisa.gov/cybersecurity-advisories/all.xml, which surfaced the in-window KEV addition. Prefer the RSS feed over the page URL for enumeration. | 2026-07-26 weekly quality audit: RUN-TIME RECIPE DIVERGENCE FIXED: the 2026-07-25 and 2026-07-26 fires both logged HTTP 403 fetching the /news-events/cybersecurity-advisories HTML listing while source_health.py probed the record green, because the health probe uses the working feed recipe (`cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml`), which is what a sweep must lead with too. This is an IGNORED-recipe problem, not a missing one: that feed URL was already this record's rss_url and the 2026-07-10 note already said to prefer it, and the fires still swept the url field. LEAD WITH rss_url. NEVER sweep the /news-events/cybersecurity-advisories HTML listing: Akamai 403s it for every UA. | 2026-08-04 run: FETCH NOTE, `cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml` returns 30 items cleanly, but the parsed `published` field comes back EMPTY. In-window filtering requires the date path in each alert URL (/news-events/alerts/YYYY/MM/DD/...) or the ICS day-of-year id (icsa-26-NNN-XX). | 2026-08-16: third consecutive run unreachable: cisa.gov Akamai-403s every direct UA and the jina reader pool (the documented recovery transport) returned HTTP 402 on all seven keys, so the full ladder failed. NOT demoted (403 is transport blocking, not content death). The CISA KEV and CSAF endpoints do not route through jina and covered the advisory surface this run; they are the load-bearing CISA path until reader credit is restored. | 2026-08-17: unreachable again, direct transport refused and the jina reader pool returned HTTP 402 on every rotating key, so the documented ladder had no last rung. Transport blocking plus an exhausted reader quota; NOT demoted. | 2026-08-18: fifth consecutive run unreachable, cisa.gov refuses the direct transport on every user agent and the reader pool returned HTTP 402 on all seven keys, so the documented ladder again had no last rung. NOT demoted (403 is transport blocking, not content death). The KEV API and the cisagov CSAF mirror do not route through the reader and covered the exploited-vulnerability and ICS surfaces this run; the general AA-series advisory listing was reachable by no transport. | 2026-08-19: sixth consecutive unreachable run, HTTP 403 to every direct transport with the reader fallback credit-exhausted; NOT demoted, a transport block is not content death. The KEV JSON feed remains the working substitute for the exploited-vulnerability surface. | 2026-09-04: advisories/directives listing returned only filter-facet shell content on the bridge `cisa page` transport, consistent with prior 403/JS-shell condition; CISA KEV JSON feed unaffected and confirmed 0 in-window additions separately. | 2026-09-05 audit: bridge cisa page transport returned an unfiltered/unsorted facet page with no dated item list; CISA KEV JSON feed (separate source) unaffected and confirmed 0 in-window additions. | 2026-09-06: bridge `cisa page` again returned only the filter-facet shell (same long-documented JS-shell condition); the feed substitute (`cisa feed .../all.xml`) worked and confirmed the newest KEV-adjacent alert was already covered, no further in-window items. | 2026-09-29: in-container reads of cisa.gov are impossible without reader credit (Akamai 403 on all UAs; jina 402). Observation only: the agent-side WebFetch tool reached all.xml, the JS-hydrated /news-events/cybersecurity-advisories listing (10 dated items) and detail pages 5/5 times today, but CLAUDE.md forbids WebFetch on CISA, so using it is the operator's decision (docs/audits/2026-09-29-quality-audit.md, recommendation 1). `cisa csaf-recent N` (+ `cisa csaf <id>`) for ICS/OT advisories and `cisa-kev` need no reader; joint AA-series advisories are also mirrored by the co-signing agencies (NSA media.defense.gov, IC3, NCSC-UK, ASD). Health check: in-container command `cisa csaf-recent 10` proves the free mirror path only (ICS advisories); the AA-series and alerts surface has no in-container reader. (2026-09-29T2134Z-audit) | 2026-09-30 (v4.18, operator directive): ICS/OT advisories stay on `cisa csaf-recent` / `cisa csaf <id>` (structured, in-container). For the IT half (alerts, AA-series joint advisories), WebFetch https://www.cisa.gov/news-events/cybersecurity-advisories with the outbound-links template, then each advisory page; a joint advisory's PDF on a co-sealing agency's host reads through `pdf <URL>`. (2026-09-30T0634Z-audit) | 2026-09-30: both halves confirmed (SR1): the WebFetch listing returned 10 dated items with URLs, alert and AA-series pages read in full, and csaf-recent returned five ICS advisories of 2026-09-29. WebFetch of all.xml returned only ICS items, so do not use it to enumerate alerts; AA-series items also surface through the cisa-news listing. The older 'AVOID WebFetch' lines are superseded. (2026-09-30T0634Z-audit) | 2026-10-10: `feed https://www.cisa.gov/cybersecurity-advisories/all.xml` falls to the reader (credit) and lists ICS items only; WebFetch of the listing plus `cisa csaf-recent` stays the working recipe. | 2026-10-15 (S1): `WebFetch https://www.cisa.gov/news-events/alerts` returns 404; the working listing is https://www.cisa.gov/news-events/cybersecurity-advisories?f%5B0%5D=advisory_type%3A93. A per-alert URL (the 2026-10-14 KEV alert) reads with WebFetch and the outbound-links template. | 2026-10-19 intel run S1: `feed https://www.cisa.gov/cybersecurity-advisories/all.xml` falls through to the metered reader from the container; the listing https://www.cisa.gov/news-events/cybersecurity-advisories?f%5B0%5D=advisory_type%3A93 reads with WebFetch (titles, dates, hrefs). | 2026-10-21 (2026-10-21T0256Z-intel, S1): `cisa page <aa-url>` and `pdf` fall through to the metered reader or a 403; WebFetch reads the listing and the advisory summary, and the reader returns the full text only when needed. | 2026-10-23 (S1): recipe: the all.xml feed answers 403 on the bridge and the reader returns no items; WebFetch of /news-events/cybersecurity-advisories returns the ten newest items with titles, dates and hrefs, and `cisa csaf-recent` reads the ICS advisories in full.