CISA News

https://www.cisa.gov/news-events/news

CISA news index, broader announcements beyond formal advisories. WebFetch is reliably HTTP 403 on cisa.gov (re-confirmed 2026-05-08). REQUIRED FETCH METHOD: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/news`. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api/bridge: python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/news (listing) then `cisa page <article_url>` for body. AVOID: WebFetch reliably HTTP 403 on cisa.gov, skip it entirely. Do not WebFetch any cisa.gov URL.. | 2026-07-04: bridge (cisa page) upstream HTTP 403 again, consecutive_fetch_failures 2; 403 is transport blocking (does NOT demote per lifecycle rules). CISA KEV JSON API still works via the bridge. | 2026-07-05 root-cause confirmed: www.cisa.gov dynamic paths (/news-events/*, all .xml feeds, and the CSAF .well-known) are blocked by Akamai bot management (`Access Denied`, `Reference #18.*`) for EVERY UA/header combination tested (chrome/firefox/googlebot/curl/minimal/+Referer all 403), the block keys off the egress TLS/behavioural fingerprint, so it is unfixable from request headers. Only the STATIC /sites/default/files/feeds/ path (KEV JSON) is served. No reachable alternative for the advisory HTML content (search.gov results are a JS shell needing an API key; Wayback has no snapshots). SUBSTITUTE: `cisa-kev` JSON API for exploited-vuln ground truth + WebSearch corroboration for advisory narrative (covered_anyway). STAYS ACTIVE; a 403 is a transport block and NEVER demotes (hard rule). source_health.py now classifies this `bridge-blocked` (handled), not `needs-demote`, so the routine stops re-flagging it every run. | 2026-07-05 RECOVERED; CISA dynamic content is now reachable. The Akamai 403 on every UA still holds for a DIRECT fetch, but `tools/fetch_source.py` routes cisa.gov through the r.jina.ai reader proxy (server-side fetch, bypasses the Akamai fingerprint) for `cisa page` / `cisa feed`, and through the cisagov/CSAF GitHub mirror (raw.githubusercontent.com, not proxy-blocked) for `cisa csaf-recent` / `cisa csaf` (fully-structured ICS advisories). This SUPERSEDES the earlier KEV+WebSearch-substitute handling; the advisory/directive/news content itself is now fetchable with full detail. `cisa-kev` JSON remains the exploited-vuln ground truth. FETCH now works: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/news.xml` for recent items, then `cisa page <news_url>` for the body. (Note: /cisa/blog.xml is a deprecated feed, CISA returns Access Denied even server-side; do not use it.) | 2026-07-05 admiralty audit: A (primary-authority), CISA News, first-party government communications; bridge 403 is a known transport block (no demotion), host confirmed live. Status stays active. | 2026-07-09 structured-listing recipe (v3.14): the /news-events/news listing is a JS shell. REQUIRED listing fetch: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/news.xml 20`; drill with `cisa page <link>`. New directives are announced here too. Confirmed working 2026-07-09. | 2026-08-17: unreachable again, direct transport refused and the jina reader pool returned HTTP 402 on every rotating key, so the documented ladder had no last rung. Transport blocking plus an exhausted reader quota; NOT demoted. | 2026-08-18: same cisa.gov condition. NOT demoted. | 2026-08-19: same cisa.gov condition; NOT demoted. | 2026-09-29: news.xml and the /news-events/news listing are unreadable in-container (Akamai 403; jina 402) but the agent-side WebFetch tool reads both plus detail pages (7/7 cisa.gov WebFetch calls succeeded today across the three CISA records), use WebFetch with the outbound-links template first, then the item URL. The fetch_source `cisa feed|page` recipe needs reader credit. Latest items as of 2 (2026-09-29T2134Z-audit) | 2026-09-29: fetch_method bridge -> webfetch: WebFetch https://www.cisa.gov/news.xml then the item page; the cisa feed/page recipes need reader credit. Same source_health caveat as cisa-directives. (2026-09-29 operator-directed setup review) | CISA news index, broader announcements beyond formal advisories. WebFetch is reliably HTTP 403 on cisa.gov (re-confirmed 2026-05-08). REQUIRED FETCH METHOD: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/news`. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api/bridge: python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/news (listing) then `cisa page <article_url>` for body. AVOID: WebFetch reliably HTTP 403 on cisa.gov, skip it entirely. Do not WebFetch any cisa.gov URL.. | 2026-07-04: bridge (cisa page) upstream HTTP 403 again, consecutive_fetch_failures 2; 403 is transport blocking (does NOT demote per lifecycle rules). CISA KEV JSON API still works via the bridge. | 2026-07-05 root-cause confirmed: www.cisa.gov dynamic paths (/news-events/*, all .xml feeds, and the CSAF .well-known) are blocked by Akamai bot management (`Access Denied`, `Reference #18.*`) for EVERY UA/header combination tested (chrome/firefox/googlebot/curl/minimal/+Referer all 403), the block keys off the egress TLS/behavioural fingerprint, so it is unfixable from request headers. Only the STATIC /sites/default/files/feeds/ path (KEV JSON) is served. No reachable alternative for the advisory HTML content (search.gov results are a JS shell needing an API key; Wayback has no snapshots). SUBSTITUTE: `cisa-kev` JSON API for exploited-vuln ground truth + WebSearch corroboration for advisory narrative (covered_anyway). STAYS ACTIVE; a 403 is a transport block and NEVER demotes (hard rule). source_health.py now classifies this `bridge-blocked` (handled), not `needs-demote`, so the routine stops re-flagging it every run. | 2026-07-05 RECOVERED; CISA dynamic content is now reachable. The Akamai 403 on every UA still holds for a DIRECT fetch, but `tools/fetch_source.py` routes cisa.gov through the r.jina.ai reader proxy (server-side fetch, bypasses the Akamai fingerprint) for `cisa page` / `cisa feed`, and through the cisagov/CSAF GitHub mirror (raw.githubusercontent.com, not proxy-blocked) for `cisa csaf-recent` / `cisa csaf` (fully-structured ICS advisories). This SUPERSEDES the earlier KEV+WebSearch-substitute handling; the advisory/directive/news content itself is now fetchable with full detail. `cisa-kev` JSON remains the exploited-vuln ground truth. FETCH now works: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/news.xml` for recent items, then `cisa page <news_url>` for the body. (Note: /cisa/blog.xml is a deprecated feed, CISA returns Access Denied even server-side; do not use it.) | 2026-07-05 admiralty audit: A (primary-authority), CISA News, first-party government communications; bridge 403 is a known transport block (no demotion), host confirmed live. Status stays active. | 2026-07-09 structured-listing recipe (v3.14): the /news-events/news listing is a JS shell. REQUIRED listing fetch: `python3 tools/fetch_source.py cisa feed https://www.cisa.gov/news.xml 20`; drill with `cisa page <link>`. New directives are announced here too. Confirmed working 2026-07-09. | 2026-08-17: unreachable again, direct transport refused and the jina reader pool returned HTTP 402 on every rotating key, so the documented ladder had no last rung. Transport blocking plus an exhausted reader quota; NOT demoted. | 2026-08-18: same cisa.gov condition. NOT demoted. | 2026-08-19: same cisa.gov condition; NOT demoted. | 2026-09-29: news.xml and the /news-events/news listing are unreadable in-container (Akamai 403; jina 402). Observation only: the agent-side WebFetch tool read both plus detail pages (7/7 cisa.gov WebFetch calls succeeded today across the three CISA records), but CLAUDE.md forbids WebFetch on CISA, so using it is the operator's decision (docs/audits/2026-09-29-quality-audit.md, recommendation 1). The fetch_source `cisa feed|page` recipe needs reader credit. Latest items as of 2026-09-29: 23 Sep whitepaper (CVE Program Quality Era), 18 Sep Cyber Storm X, 16 Sep critical-infrastructure guidance, 15 Sep NIST/CISA cloud identity guidelines, 9 Sep insider threat guide. (2026-09-29T2134Z-audit) | 2026-09-30 (v4.18, operator directive): WebFetch is the sanctioned reader for this record: CLAUDE.md now allows it on cisa.gov pages no structured recipe covers. Recipe: WebFetch https://www.cisa.gov/news-events/news with the outbound-links template for the dated listing, then WebFetch each item URL for its body. The in-container transports still fail (Akamai 403, reader credit), so source_health.py reports webfetch-only rather than unreadable. (2026-09-30T0634Z-audit) | 2026-09-30: recipe confirmed by an independent pass (SR1): the listing returned 10 dated items with URLs and drilled pages came through with body text and outbound links. https://www.cisa.gov/news.xml also reads through WebFetch (dates and links, empty descriptions), and its tail can differ from the HTML listing, so use both when completeness matters. The older 'REQUIRED: cisa page / AVOID WebFetch' lines above are superseded. (2026-09-30T0634Z-audit) | 2026-09-30: with the plain outbound-links template the listing call can come back without dates or links, so ask the prompt for every item's title, date and href; that returned all 10 items with dates and URLs. (2026-09-30T0634Z-audit) | 2026-09-30: with the reader pool refilled, the health probe reads this page through the reader's fallback and judges it relevant (12:31Z sweep); it reports webfetch-only only while the pool is empty. (2026-09-30T0634Z-audit) | 2026-10-07 (S2): a WebFetch listing gives dated items. | 2026-10-19 intel run S2: `feed https://www.cisa.gov/news.xml` silently falls back to the jina reader and returns undated items; the dated listing reads with WebFetch https://www.cisa.gov/news-events/news.