@NSACyber

We protect our nation’s most sensitive systems against cyber threats. Likes, retweets, and follows ≠ endorsement.

nsa.gov/Cybersecurity/
Joined November 2019
  • Tweets516
  • Following12
  • Followers203K
264Media
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: nsa.gov/Press-Room/Press-Rel…

NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities

FORT MEADE, Md. — PHP — short for PHP: Hypertext Preprocessor — works on most major operating systems.  It runs directly on web servers and can be added into HTML to create

nsa.gov
NSA Cyber
@NSACyber21h
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
60
690
54
3,043
222,763
NSA Cyber retweeted
CISA Cyber
@CISACyber18h
🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 go.dhs.gov/5Hi
47
619
51
1,847
159,872
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
1,169
9,797
2,542
64,524
10,505,381
NSA joined @NIST and @CISACyber in releasing guidelines for managing SI control incidents. Organizations utilizing SI are encouraged to adopt these practices. Read the joint report: media.defense.gov/2026/Oct/1…
Text on the image reads: "NSA and Others Release: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. Cybersecurity Information Sheet.

ALT Text on the image reads: "NSA and Others Release: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. Cybersecurity Information Sheet.

14
78
14
277
133,143
NSA Cyber retweeted
NSA/CSS
@NSAGovOct 13
Email servers remain a top target for adversaries. From Russian state-sponsored phishing to exploitation of unpatched or misconfigured software, the threats are real. For #CybersecurityAwarenessMonth, we’re sharing critical remediations to protect NSS and DIB networks. Secure your servers: nsa.gov/Cybersecurity/Cybers…
A digital graphic shows a laptop with a glowing envelope being hooked. The National Security Agency logo is in the upper left corner. The text reads, "Securing your email is a fundamental step in protecting your organization's data.

ALT A digital graphic shows a laptop with a glowing envelope being hooked. The National Security Agency logo is in the upper left corner. The text reads, "Securing your email is a fundamental step in protecting your organization's data.

38
65
8
262
18,723
Integrity Tech has enabled Chinese government-linked threat actors to exploit organizations’ networks globally and exfiltrate critical data. We’ve joined @FBICyberDiv and others to arm organizations with guidance to proactively defend their networks from this threat. nsa.gov/Press-Room/Press-Rel…
"NSA joins FBI and others in releasing: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data. Cybersecurity advisory.

ALT "NSA joins FBI and others in releasing: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data. Cybersecurity advisory.

19
121
10
248
58,966
NSA recommends implementing #ZeroTrust mitigation principles to enhance security of legacy #OperationalTechnology and prevent catastrophic impacts to U.S. national security, economic security, and public health and safety. Learn more: media.defense.gov/2026/Oct/0…
On the left side, text reads, "NSA Releases: Hardening Department of War (DOW) Critical Operational Technology (OT) Environments with Zero Trust (ZT) Principles." Below, it says, "Cybersecurity Information Sheet." The NSA logo is displayed in the top left corner.

ALT On the left side, text reads, "NSA Releases: Hardening Department of War (DOW) Critical Operational Technology (OT) Environments with Zero Trust (ZT) Principles." Below, it says, "Cybersecurity Information Sheet." The NSA logo is displayed in the top left corner.

22
102
15
368
35,597
NSA Cyber retweeted
NSA/CSS
@NSAGovOct 1
NSA is taking proactive steps to protect national security systems from quantum computing threats. Key initiatives include the launch of the Post-Quantum Cryptography Resources Hub, collaboration on standards and guidelines, raising awareness and education, and partnering with industry and academia. Learn more: nsa.gov/cybersecurity/post-q…
The image features a stylized design with the text "Post-Quantum Cryptography Resource Hub" and "Now Live" on a dark background. A logo resembling the letters "PQC" is on the left, and the NSA seal is in the lower right corner.

ALT The image features a stylized design with the text "Post-Quantum Cryptography Resource Hub" and "Now Live" on a dark background. A logo resembling the letters "PQC" is on the left, and the NSA seal is in the lower right corner.

81
203
35
734
47,698
NSA Cyber retweeted
NSA/CSS
@NSAGovOct 1
October is Cybersecurity Awareness Month! Throughout the month, we'll be sharing guidance to help you stay ahead of digital threats and keep your data safe. Visit our site for guidance and more: nsa.gov/cybersecurity-awaren…
60
242
29
855
41,184
NSA Cyber retweeted
NSA/CSS
@NSAGovSep 10
"The basics are no longer boring, and AI can’t outrun the basics.” Across two #BillingtonSummit panels, @NSACyber Director David Imbordino joined government, industry, and FVEY cyber leaders to discuss nation-state threats, AI, and strengthening collective cyber defense.
NSA Cybersecurity Director David Imbordino speaks during a panel at the 2026 Billington Cybersecurity Summit.

ALT NSA Cybersecurity Director David Imbordino speaks during a panel at the 2026 Billington Cybersecurity Summit.

NSA Cybersecurity Director David Imbordino speaks during a panel at the 2026 Billington Cybersecurity Summit.

ALT NSA Cybersecurity Director David Imbordino speaks during a panel at the 2026 Billington Cybersecurity Summit.

62
62
10
199
35,037
China-based AI companies are illicitly distilling U.S. frontier AI capabilities. Read NSA’s new report, co-sealed with @FBI, @CISAgov, highlighting AI knowledge distillation, TTPs used, and recommended mitigations: media.defense.gov/2026/Sep/0…
97
274
75
829
189,489
NSA’s latest guide captures foundational network actions that remain essential in keeping networks protected against traditional and AI-enhanced targeting. Review for immediate and long-term steps to help prioritize impactful defenses. media.defense.gov/2026/Sep/0…
47
97
7
312
27,709
The China-linked hacking group QTFY provides tools for targeting critical systems in the U.S. and abroad. The FBI, NSA, and CNMF recommend organizations implement the recommended mitigations to counter their malicious tools: nsa.gov/Press-Room/Press-Rel…
The China-linked hacking group QTFY provides tools for targeting critical systems in the U.S. and abroad. The FBI, NSA, and CNMF recommend organizations implement the recommended mitigations to counter their malicious tools.

ALT The China-linked hacking group QTFY provides tools for targeting critical systems in the U.S. and abroad. The FBI, NSA, and CNMF recommend organizations implement the recommended mitigations to counter their malicious tools.

54
77
7
200
23,291
NSA today released two technical reports addressing threats to application specific integrated circuits (ASICs) during the design and manufacturing process. Learn about the threats and appropriate mitigations to reduce risk: nsa.gov/Press-Room/Press-Rel…
The National Security Agency (NSA) today released two technical reports addressing threats to application specific integrated circuits (ASICs) during the design and manufacturing process. The reports — ASIC Best Practices Threat Catalog and the Application Specific Integrated Circuit (ASIC) Level of Assurance 1 (LoA1) Best Practices — explain the threats against ASICs and recommend mitigations to reduce risk.

ALT The National Security Agency (NSA) today released two technical reports addressing threats to application specific integrated circuits (ASICs) during the design and manufacturing process. The reports — ASIC Best Practices Threat Catalog and the Application Specific Integrated Circuit (ASIC) Level of Assurance 1 (LoA1) Best Practices — explain the threats against ASICs and recommend mitigations to reduce risk.

26
88
9
294
25,636
NSA and others releases guidance on applying prevention tactics to strengthen defense of U.S-based programmable logic controllers being targeted by cyber actors using AI. Learn more: media.defense.gov/2026/Aug/1… #cybersecurity #AI
51
134
15
468
72,143
NSA joins the @FBI and others in releasing a joint Cybersecurity Advisory, “#StopRansomware: Gunra Ransomware,” as an ongoing effort to publish information about various ransomware variants and threat actors. Learn more: media.defense.gov/2026/Aug/1…
31
34
1
68
11,644
Learn how your organization can leverage SBOMs to drive security decisions about your software systems in this updated report: 2026 Minimum Elements for a Software Bill of Materials (SBOM). media.defense.gov/2026/Jul/2…
28
39
1
70
10,183
Russian state-supported actors are targeting Zimbra Collaboration Suite users to exfiltrate sensitive communications and email directories. Reduce the risk of being a target. Read the full Cybersecurity Advisory for IOCs and recommended mitigations: media.defense.gov/2026/Jul/2…
13
39
2
41
9,306
A well-defined CVD program enhances a supplier's ability to engage with security researchers and efficiently address vulnerabilities. Read the report to learn more about CVD programs and how they can help you address security vulnerabilities. media.defense.gov/2026/Jul/1…
15
35
1
47
11,523
Russian cyber actors are targeting critical infrastructure networks worldwide. Follow the latest Cybersecurity Advisory from NSA and partners to harden your routers: media.defense.gov/2026/Jul/0… #cybersecurity
21
73
3
110
15,618
Load more