{
  "id": 7871563,
  "title": "CISA decides weekly vulnerability bulletin isn't necessary anymore",
  "url": "https://urgent.news/2026/09/16/cisa-decides-weekly-vulnerability-bulletin-isnt-necessary-anymore",
  "topic": "science",
  "section": "Science",
  "published": "2026-09-16T20:33:48.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/09/16/cisa-decides-weekly-vulnerability-bulletin-isnt-necessary-anymore/5296968"
  },
  "original_language": "en",
  "account": "The Cybersecurity and Infrastructure Security Agency (CISA) is discontinuing its weekly vulnerability bulletin, effective September 28. This change is part of CISA's shift towards a risk-based approach in managing vulnerabilities. The directive, issued in June, emphasizes prioritizing security updates based on real-world risk rather than treating all vulnerabilities equally. Factors like evidence of exposure and exploitation, degree of control granted, and whether exploitation can be automated are considered when determining severity. While CISA acknowledges the growing number of vulnerabilities and the need for AI-assisted security research, it doesn't explain why it chose to discontinue the bulletin instead of adapting it to the new standards. Users relying on the bulletin should now rely on CISA's known exploited vulnerabilities catalog, cybersecurity alerts and advisories, and the CVE catalog.",
  "summary": "Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "CISA decides weekly vulnerability bulletin isn't necessary anymore",
        "url": "https://urgent.news/2026/09/16/cisa-decides-weekly-vulnerability-bulletin-isnt-necessary-anymore-7874059",
        "published": "2026-09-16T20:33:48.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}