CISA updated ransomware intel on 59 bugs last year without telling defenders

**Executive summary:** In 2025 CISA silently flipped the "known ransomware use" status on 59 KEV catalog vulnerabilities without issuing alerts, potentially delaying defenders' ability to reprioritize patching; GreyNoise analyzed the flips (noting vendors such as Microsoft, Ivanti, Fortinet, Palo Alto Networks, and Zimbra) and published an RSS feed to notify when KEV entries change to 'Known' for ransomware use.