CISA BROKE INTO A US FEDERAL AGENCY, AND NO ONE NOTICED FOR A FULL 5 MONTHS

Summary from the TLDR InfoSec newsletter

CISA's 2023 red team exercise on an unnamed federal agency revealed significant security vulnerabilities. The team exploited an unpatched Oracle Solaris vulnerability (CVE-2022-21587) to gain full access. Despite being notified, the agency took over two weeks to patch and failed to conduct a thorough investigation.