SECURITY Signal 51
CISA urges Secure by Design adoption to eliminate decades-old exploited vulnerabilities
↗
Organizations must adopt Secure by Design practices to prevent exploitation of long-known vulnerabilities like injection flaws.
CISA found that the majority of exploited flaws are decades old and could have been eradicated long ago, meaning a large share of today’s compromises is preventable. The root cause lies in organizational culture and workflow gaps rather than technical complexity.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Injection-related vulnerabilities such as XSS, OS command injection, and SQL injection dominate both CVE and KEV lists.
Improper input validation (CWE-20) is the single most-common weakness across the KEV catalog and registered CVEs.
Seven of the top ten CWEs in 2024-2025 are MITRE’s "stubborn weaknesses" that were already labeled unforgivable in 2007.
THE READ
What the cluster adds up to.
CISA’s latest review shows that most vulnerabilities receiving CVEs and appearing in the Known Exploited Vulnerability catalog belong to flaw classes that have been known for decades. The agency examined data from 2024 and 2025 and found that injection flaws and improper input validation are repeatedly among the most exploited. This indicates that the problem is not new technical challenges but long-standing gaps in how software is built.
Adopting Secure by Design would require organizations to invest in developer training on threat modeling, integrate automated input validation and memory-safe checks into CI pipelines, and refactor legacy components that lack these protections. The cost includes both upfront effort to change workflows and ongoing maintenance to ensure new code follows SBD principles. Vendors would also need to shift from releasing ever-larger patch bundles to delivering secure code from the start.
If organizational culture does not prioritize security outcomes, or if developers lack incentives to follow secure practices, the adoption effort will stall. Third-party libraries and older systems that cannot be easily updated may continue to harbor the stubborn weaknesses, limiting the overall impact of SBD initiatives. In such environments, exploit paths remain open despite any internal improvements.
The persistence of the same weakness types since 2007 demonstrates that technical fixes alone are insufficient; systemic changes in how software is conceived, built, and maintained are required. CISA’s recommendation to "own security outcomes" for customers places responsibility on vendors to eliminate these flaw classes before release. Only when both culture and workflows align with Secure by Design will the exploitation of decades-old vulnerabilities decline significantly.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER