CISA Cybersecurity Advisories

https://www.cisa.gov/news-events/cybersecurity-advisories

US government joint advisories often co-signed with allied CERTs (UK NCSC, ACSC AU, NCSC-NZ, CCCS CA, BSI DE, CERT-EU). WebFetch is reliably HTTP 403 on cisa.gov (re-confirmed 2026-05-08). REQUIRED FETCH METHOD: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/cybersecurity-advisories`. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api/bridge: python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/cybersecurity-advisories (then `cisa page <alert_url>` to drill). AVOID: WebFetch reliably HTTP 403 on cisa.gov, skip it entirely. Use the bridge `cisa page` subcommand.. | 2026-07-04: bridge (cisa page) upstream HTTP 403 again, consecutive_fetch_failures 2; 403 is transport blocking (does NOT demote per lifecycle rules). CISA KEV JSON API still works via the bridge. | 2026-07-05 root-cause confirmed: www.cisa.gov dynamic paths (/news-events/*, all .xml feeds, and the CSAF .well-known) are blocked by Akamai bot management (`Access Denied`, `Reference #18.*`) for EVERY UA/header combination tested (chrome/firefox/googlebot/curl/minimal/+Referer all 403), the block keys off the egress TLS/behavioural fingerprint, so it is unfixable from request headers. Only the STATIC /sites/default/files/feeds/ path (KEV JSON) is served. No reachable alternative for the advisory HTML content (search.gov results are a JS shell needing an API key; Wayback has no snapshots). SUBSTITUTE: `cisa-kev` JSON API for exploited-vuln ground truth + WebSearch corroboration for advisory narrative (covered_anyway). STAYS ACTIVE; a 403 is a transport block and NEVER demotes (hard rule). source_health.py now classifies this `bridge-blocked` (handled), not `needs-demote`, so the routine stops re-flagging it every run. | 2026-07-05 RECOVERED; CISA dynamic content is now reachable. The Akamai 403 on every UA still holds for a DIRECT fetch, but `tools/fetch_source.py` routes cisa.gov through the r.jina.ai reader proxy (server-side fetch, bypasses the Akamai fingerprint) for `cisa page` / `cisa feed`, and through the cisagov/CSAF GitHub mirror (raw.githubusercontent.com, not proxy-blocked) for `cisa csaf-recent` / `cisa csaf` (fully-structured ICS advisories). This SUPERSEDES the earlier KEV+WebSearch-substitute handling; the advisory/directive/news content itself is now fetchable with full detail. `cisa-kev` JSON remains the exploited-vuln ground truth. FETCH now works via the reader-proxy recipe: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml` to discover items (title+link), then `cisa page <advisory_url>` for the full body. For ICS/OT advisories prefer the fully-structured CSAF mirror: `cisa csaf-recent [N]` (dated index) + `cisa csaf <icsa-YY-DDD-NN>`. | 2026-07-05 admiralty audit: A (primary-authority), CISA advisories; bridge 403 is a known transport block (does NOT demote per lifecycle rules), host confirmed live via KEV. Status stays active. | 2026-07-09 structured-listing recipe (v3.14): the /news-events/cybersecurity-advisories listing is a JS shell, `cisa page` on it returns only the filter UI. REQUIRED listing fetch: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml 20` (structured {title,link} items, newest first); drill each item with `cisa page <link>`. Confirmed working 2026-07-09. | 2026-07-10: recipe recovered, `python3 tools/fetch_source.py cisa page` returned 200 full listing (S2); freshest item 07-07, no in-window content. Rotation-gap cleared; fetch_method/bridge path works. | 2026-07-10 (2009Z run): page URL returned only filter/facet UI in static HTML (no enumerated advisory rows); S1 recovered content via the RSS feed https://www.cisa.gov/cybersecurity-advisories/all.xml, which surfaced the in-window KEV addition. Prefer the RSS feed over the page URL for enumeration. | 2026-07-26 weekly quality audit: RUN-TIME RECIPE DIVERGENCE FIXED: the 2026-07-25 and 2026-07-26 fires both logged HTTP 403 fetching the /news-events/cybersecurity-advisories HTML listing while source_health.py probed the record green, because the health probe uses the working feed recipe (`cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml`), which is what a sweep must lead with too. This is an IGNORED-recipe problem, not a missing one: that feed URL was already this record's rss_url and the 2026-07-10 note already said to prefer it, and the fires still swept the url field. LEAD WITH rss_url. NEVER sweep the /news-events/cybersecurity-advisories HTML listing: Akamai 403s it for every UA. | 2026-08-04 run: FETCH NOTE, `cisa feed https://www.cisa.gov/cybersecurity-advisories/all.xml` returns 30 items cleanly, but the parsed `published` field comes back EMPTY. In-window filtering requires the date path in each alert URL (/news-events/alerts/YYYY/MM/DD/...) or the ICS day-of-year id (icsa-26-NNN-XX). | 2026-08-16: third consecutive run unreachable: cisa.gov Akamai-403s every direct UA and the jina reader pool (the documented recovery transport) returned HTTP 402 on all seven keys, so the full ladder failed. NOT demoted (403 is transport blocking, not content death). The CISA KEV and CSAF endpoints do not route through jina and covered the advisory surface this run; they are the load-bearing CISA path until reader credit is restored. | 2026-08-17: unreachable again, direct transport refused and the jina reader pool returned HTTP 402 on every rotating key, so the documented ladder had no last rung. Transport blocking plus an exhausted reader quota; NOT demoted. | 2026-08-18: fifth consecutive run unreachable, cisa.gov refuses the direct transport on every user agent and the reader pool returned HTTP 402 on all seven keys, so the documented ladder again had no last rung. NOT demoted (403 is transport blocking, not content death). The KEV API and the cisagov CSAF mirror do not route through the reader and covered the exploited-vulnerability and ICS surfaces this run; the general AA-series advisory listing was reachable by no transport. | 2026-08-19: sixth consecutive unreachable run, HTTP 403 to every direct transport with the reader fallback credit-exhausted; NOT demoted, a transport block is not content death. The KEV JSON feed remains the working substitute for the exploited-vulnerability surface. | 2026-09-04: advisories/directives listing returned only filter-facet shell content on the bridge `cisa page` transport, consistent with prior 403/JS-shell condition; CISA KEV JSON feed unaffected and confirmed 0 in-window additions separately. | 2026-09-05 audit: bridge cisa page transport returned an unfiltered/unsorted facet page with no dated item list; CISA KEV JSON feed (separate source) unaffected and confirmed 0 in-window additions. | 2026-09-06: bridge `cisa page` again returned only the filter-facet shell (same long-documented JS-shell condition); the feed substitute (`cisa feed .../all.xml`) worked and confirmed the newest KEV-adjacent alert was already covered, no further in-window items.