Security Database Used by Apple Goes Independent After Funding Cut [Updated]

[MacRumors]

Update: Following the CVE Foundation's announcement (below), CISA has said the U.S. government is extending funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures (CVE) program (via Bleeping Computer). Original story follows.



Apple, along with other tech companies, relies on the Common Vulnerabilities and Exposures (CVE) program to identify and track security flaws in its software. This critical cybersecurity resource now faces an uncertain future, after federal funding was today abruptly cut off.

In response to the crisis, a coalition of longtime CVE Board members announced today the formation of the CVE Foundation, a non-profit organization dedicated to ensuring the continued operation of the vulnerability identification system.

"CVE, as a cornerstone of the global cybersecurity ecosystem, is too important to be vulnerable itself," said Kent Landfield, an officer of the newly formed Foundation. "Cybersecurity professionals around the globe rely on CVE identifiers and data as part of their daily work—from security tools and advisories to threat intelligence and response. Without CVE, defenders are at a massive disadvantage against global cyber threats."

The CVE program provides a standardized system for identifying and cataloging security vulnerabilities across all software and hardware, including Apple's macOS, iOS, iPadOS, and other products. When security researchers discover flaws, they're assigned unique CVE identifiers that allow companies like Apple to coordinate patches and updates.

MITRE Corporation, which has managed the program under contract with the U.S. Department of Homeland Security, confirmed that government funding expired on April 16. Reuters reports that the expiry may be linked to the federal government undergoing a radical downsizing driven in part by the Department of Government Efficiency (DOGE). The U.S. Cybersecurity and Infrastructure Security Agency (CISA), which is exposed to the downsizing, stated it is "urgently working to mitigate impact," as the sudden funding gap threatened to disrupt vulnerability management worldwide.

Security experts warned that without CVE, cybersecurity efforts would face "total chaos" as the common language used to communicate about vulnerabilities would effectively disappear. One researcher compared it to "suddenly deleting all dictionaries."

The newly established CVE Foundation aims to transition the program to a dedicated non-profit model that isn't dependent on a single government sponsor. The Foundation's organizers revealed they had been preparing for this possibility for the past year.

"For the international cybersecurity community, this move represents an opportunity to establish governance that reflects the global nature of today's threat landscape," the Foundation stated in its announcement.

The funding cut also affects the related Common Weakness Enumeration (CWE) program, which helps companies like Apple identify potential security issues before they become vulnerabilities.

The CVE Foundation is expected to release more details about its structure and funding plans in the coming days. Apple and other major tech companies will likely play a significant role in supporting it as a critical part of cybersecurity infrastructure.

Note: Due to the political or social nature of the discussion regarding this topic, the discussion thread is located in our Political News forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Article Link: Security Database Used by Apple Goes Independent After Funding Cut [Updated]

 

[klasma]

That isometric perspective never fails to upset me.

 

[arkitect]

MITRE Corporation, which has managed the program under contract with the U.S. Department of Homeland Security, confirmed that government funding expired on April 16. Reuters reports that the expiry may be linked to the federal government undergoing a radical downsizing driven in part by the Department of Government Efficiency (DOGE). The U.S. Cybersecurity and Infrastructure Security Agency (CISA), which is exposed to the downsizing, stated it is "urgently working to mitigate impact," as the sudden funding gap threatened to disrupt vulnerability management worldwide.

Just insanity from this administration…

Who in their right minds would defund this?

Almost as if they don't think of long term knock on effects.

 

[addamas]

If you think Putin’s puppet did the worst thing he comes with new ideals.
Well done! /s

Lucky they will start with CVE Foundation as stated in article so it’s not lost as money on HIV vaccine…

 

[thejadedmonkey]

That's like de-funding the national weather service, but for computers.

 

[SW3029]

Now you can thank Trump for your viruses and malware, too. The winning never stops!

 

[rorschach]

That's like de-funding the national weather service, but for computers.

Don't worry, they're doing that too.

National Weather Service Suspends Critical Service Again Amid DOGE Cuts

 

[nt5672]

Just insanity from this administration…

Who in their right minds would defund this?

Almost as if they don't think of long term knock on effects.

There is so much waste, fraud, and corruption in the US government that cutting it quickly takes broad strokes. Sure some useful things will get and have been cut, but they will either survive on their own or get brought back.

 

[JitteryJimmy]

Given that the database is now managed by an independent organization, it stands to reason that they can charge anyone anything they want for access to the database.

Therefore, I suggest that it be licensed to everyone at no charge... except to the US federal government (and its suppliers, contractors, and employees). For the federal government, $50k per hour is a very affordable rate for unlimited access/unlimited seats. That's far less than what the US government is paying for Green Fees.

 

[SW3029]

BTW - Marcrumors, whenever you use this photo for a security post, I immediately think the post is a story about Spider-Man.

 

[attohs]

That isometric perspective never fails to upset me.

I'm upset by the two missing legs.

 

[dumastudetto]

While some will be concerned, I think this will affect Android users more.

 

[PassiveSmoking]

Is there nothing of value that these idiots won't try to ruin?

 

[duffman9000]

There is so much waste, fraud, and corruption in the US government that cutting it quickly takes broad strokes. Sure some useful things will get and have been cut, but they will either survive on their own or get brought back.

Sure guy sure. If they were serious they’d start with the DoD and congress.

 

[tubular]

Trump likes Russian hackers. Saves him the trouble of posting war plans on Signal.

 

[tubular]

There is so much waste, fraud, and corruption in the US government that cutting it quickly takes broad strokes.

What’s getting cut in broad strokes is Elmo’s claims about how much waste he’s found.

And if you want to talk about corruption, have you looked at the Felon In Chief lately? He’s using his powers as POTUS like a two-bit shakedown artist.

 

[klasma]

I'm upset by the two missing legs.

Probably a bug.

 

[bluecoast]

I don’t know enough about us politics to comment on this either way but surely big tech has deep enough pockets to make up the funding as it’s in their interest

 

[CarAnalogy]

Just insanity from this administration…

Who in their right minds would defund this?

Almost as if they don't think of long term knock on effects.

It was probably not the intent, but this may wind up being a good thing.

Having this separate from the US government and a single corporation really is more reflective of today’s environment.

People only seem to remember this when it’s not their party in charge, but that government is best which governs least. The government should only be doing the things that only the government can do.

Edit: ha so many downvotes with so little explanation. I guess the automatic downvote brigade is to be expected if someone even implies that anything trump has ever done might result in a positive outcome some day whether he intended it that way or not.

And see the update. Now the government will be one sponsor of an independent industry organization. Seems like a better arrangement to me.

Edit edit: Think about it this way. Imagine Trump wakes up one morning and one of his buddies makes software that has a vulnerability and he doesn't want a CVE assigned, because in this imaginary scenario companies are actually legally liable for major vulnerabilities in their software that lead to real problems. If it's run by the government, he could do something crazy (like he just did, with this) and it would be in his direct legal line of sight. If it's an industry organization, it's not something he can just cancel the budget on.

 

[Scott6666]

When you have a $2T ANNUAL deficit everything is on the table to be cut.

Should be easy enough to get the private sector to find what is essentially an online database. Heck Mitre should have covered the site for a while.

 

[It’s always something]

There is so much waste, fraud, and corruption in the US government that cutting it quickly takes broad strokes. Sure some useful things will get and have been cut, but they will either survive on their own or get brought back.

Or they could, you know, stop doing stupid things by not using broad strokes at all.

 

[cocky jeremy]

This should be funded by the ones making the software to begin with.

 

[wanha]

This should be funded by the ones making the software to begin with.

in that case, it would actually then be funded by the people buying the devices and software

 

[Scott6666]

Or they could, you know, stop doing stupid things by not using broad strokes at all.

Our leaders have been claiming for decades they'd cut the size of government and it only get bigger. Cut as much as you can, then cut some more. Add back later if need be.

This is a perfect example of something the taxpayers do not need to pay for. Let see if it doesn't get covered by the private sector in no time.

Guess all those techies working for Elon Musk are so stupid they are happy to compromise their own internet security. Good thing we all know better.

 

[duffman9000]

It was probably not the intent, but this may wind up being a good thing.

Having this separate from the US government and a single corporation really is more reflective of today’s environment.

People only seem to remember this when it’s not their party in charge, but that government is best which governs least. The government should only be doing the things that only the government can do.

Government doesn’t build cars therefore should not regulate car safety AMIRITE?