VulnHub

Real-time Cybersecurity News

2026 Minimum Elements for a Software Bill of Materials (SBOM)

All CISA Advisories

Overview

The Cybersecurity and Infrastructure Security Agency (CISA), along with the NSA and FBI, has released updated guidance on the minimum elements for a Software Bill of Materials (SBOM). This new framework, which replaces guidance from 2021, incorporates stakeholder feedback and reflects advancements in SBOM tools. An SBOM acts like an ingredients list for software, allowing organizations to understand the components within their software and manage supply chain risks more effectively. While the guidance applies broadly to all software, it notes that certain types, like artificial intelligence and cloud-based software, may need additional elements. The push for software transparency is crucial for improving security practices across various sectors.

Key Takeaways

  • Affected Systems: All software, especially artificial intelligence and SaaS in cloud environments
  • Action Required: Organizations should adopt the updated minimum elements for SBOMs as outlined in the new guidance.
  • Timeline: Disclosed on [October 2023]

Original Article Summary

CISA, the National Security Agency, the Federal Bureau of Investigation, and international partners released joint guidance, 2026 Minimum Elements for a Software Bill of Materials (SBOM), that updates and replaces the minimum elements for an SBOM published by the National Telecommunications and Information Administration (NTIA) in 2021. The new guidance incorporates stakeholder feedback from a 2025 public comment period and reflects current SBOM tools and needs while preserving the core principles of the original NTIA document. An SBOM serves as an “ingredients list” for software and is a key building block of software security and supply chain risk management. Organizations can use SBOM data to better understand the makeup of their software components and supply chains and make more risk-informed decisions. Minimum elements for an SBOM describe the baseline technologies and practices that an SBOM should include. While the minimum elements for an SBOM apply to all software, some software types—such as artificial intelligence and software as a service in cloud environments—may require additional elements. Any effort to improve software transparency, regardless of the software type, should begin with the application of minimum elements.

Impact

All software, especially artificial intelligence and SaaS in cloud environments

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on [October 2023]

Remediation

Organizations should adopt the updated minimum elements for SBOMs as outlined in the new guidance.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Hackers abuse npm mirrors to host phishing redirect pages

BleepingComputer

Hackers are taking advantage of npm and its mirrors to host fake HTML pages that mimic Cloudflare's CAPTCHA system. These pages trick users into clicking links that redirect them to websites controlled by the attackers. This tactic poses a significant risk, especially for developers and users who rely on npm for package management. By using trusted platforms like npm, attackers can increase the likelihood that users will fall for their scams. The incident raises concerns about the security of widely used software repositories and the potential for further exploitation if left unchecked.

Aug 25, 2026

The GTA VI leaks are breaking the internet. Security researchers have seen this before.

CyberScoop

Recent leaks related to the highly anticipated video game Grand Theft Auto VI have sent shockwaves through the gaming community and beyond. Over the span of a week, a series of daily leaks emerged, including a memecoin and a manifesto, drawing significant attention online. Security researchers note that this situation resembles familiar tactics used in extortion schemes, albeit with a much larger audience due to the game's popularity. The leaks not only compromise sensitive information but also raise concerns about the security practices of the companies involved. As the gaming industry grapples with the fallout, it serves as a reminder of the vulnerabilities that can arise during high-stakes product launches.

Aug 25, 2026

AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes

BleepingComputer

A new phishing-as-a-service platform named AnonyMousKIT has been discovered, which automates the process of stealing passcodes from iPhones. This service utilizes voice AI agents to trick users into providing their unlock codes, specifically targeting those who have had their Apple devices stolen. Once attackers obtain the passcodes, they can disable the Activation Lock, allowing them to access and potentially resell the stolen devices. This poses a significant risk to iPhone users, as it could lead to increased theft and exploitation of stolen devices. Users are urged to remain vigilant and skeptical of unsolicited calls requesting sensitive information.

Aug 25, 2026

Arrested man allegedly impersonated NSA elite hacking unit, Supreme Court chief justice

CyberScoop

Joshua Culver, also known as 'Maverick Young,' has been arrested for allegedly impersonating a high-ranking official from the NSA's Tailored Access Operations unit, which is known for its elite hacking capabilities. This incident reportedly took place during a period when the unit was not publicly referred to by that name, raising concerns about the potential for misuse of sensitive information and authority. Culver is also accused of impersonating the Chief Justice of the Supreme Court. This type of impersonation can have serious implications for national security and the integrity of government institutions, as it can undermine trust in official communications. Law enforcement continues to investigate the full extent of Culver's actions and any potential victims affected by his impersonations.

Aug 25, 2026

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

The Hacker News

The U.S. Department of the Treasury has imposed new sanctions on Iranian hackers linked to breaches of critical infrastructure. This move is part of a broader strategy to cut off Iran's financial resources and disrupt its cyber operations. The sanctions target individuals and entities believed to be involved in cyber attacks that threaten vital systems. By taking this action, the U.S. aims to hold accountable those responsible for these security breaches and to deter future cyber threats from Iran. This development is significant as it underscores the ongoing geopolitical tensions and the role of cyber warfare in international relations.

Aug 25, 2026

CISA adds Oracle WebLogic bug to its list of exploited vulnerabilities

SCM feed for Latest

The Cybersecurity and Infrastructure Security Agency (CISA) has added a newly identified vulnerability in Oracle WebLogic to its list of actively exploited security issues. This vulnerability allows attackers to gain access to core business applications within an enterprise, posing significant risks to sensitive data and operations. Organizations using Oracle WebLogic middleware need to be particularly vigilant, as this exploitation could lead to severe disruptions and data breaches. Experts recommend that affected companies prioritize patching this vulnerability to safeguard their systems. The urgency is underscored by the fact that attackers are actively exploiting this flaw.

Aug 25, 2026