20 out of 23 US federal agencies have failed to meet the cyber threat incident response capabilities required by Executive Order 14028, reports the Government Accountability Office (GAO). Despite progress in incident preparedness, just three agencies have reached the advanced tier three level, causing government limitations in detecting, investigating, and remediating cyber threats. Agencies noted challenges such as staff shortages, technical issues with event logging, and limitations in cyber threat information sharing.
Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)
A suspected Chinese advanced persistent threat (APT) group exploited CVE-2025-22457, a previously unexploitable buffer overflow bug, to compromise devices running Ivanti Connect Secure (ICS) and
