CISA audited its own network tool and found a password hardcoded as 'Malcolm'
The lighter file this week is really a file about self-administration: the body that polices everyone's patching disclosed seven flaws in its own monitoring tool, including a password named after the product and an unauthenticated route to wiping forensic data. Alongside it, two US transparency portals returned access-control screens instead of notices, and HMRC amended the same export process twice in three months. The joke is free; the discipline it rewards is not.
- CISA advisory ICSA-26-280-01, updated 15 October 2026, lists seven CVEs in CISA's own Malcolm tool, including a passwordSecret hardcoded as "Malcolm".
- Malcolm fixes split across v26.08.0 and v26.09.0, so an operator who stops at v26.08.0 leaves CVE-2026-107333 and CVE-2026-107362 open.
- Federal Register pages for an SEC CME Securities Clearing notice dated 13 October and a Treasury information-sharing collection dated 9 October returned access-control screens with no operative text.
- HMRC amended its export examination-premises approval process on 8 October 2026, three months after an 8 July 2026 revision, and these notices carry the force of law.
- CISA reports no known public exploitation of the Malcolm flaws to date.