CISA to require federal agencies to patch some cyber vulnerabilities within 3 days

CISA issued a binding operational directive requiring federal civilian agencies to remediate certain vulnerabilities within 72 hours when they meet three of four criteria (internet-exposed, listed in the Known Exploited Vulnerabilities catalog, automatable exploit, and degree of adversary control); agencies have 180 days to adopt the timeframe, CISA will assist with triage/forensics, and the agency encourages state, local, tribal, and critical infrastructure operators to adopt similar prioritization.