Month: July 2025

Update (07/22/2025): This Alert was updated to reflect newly released information from Microsoft, and to correct the actively exploited Common Vulnerabilities and Exposures (CVEs), which have been confirmed as CVE-2025-49706, a network spoofing vulnerability, and CVE-2025-49704, a remote code execution (RCE) vulnerability.

CISA is aware of active exploitation of a spoofing and RCE vulnerability chain involving CVE-2025-49706 and CVE-2025-49704, enabling unauthorized access to on-premise SharePoint servers. While the scope and impact continue to be assessed, the chain, publicly reported as “ToolShell,” provides unauthenticated access to systems and authenticated access through network spoofing, respectively, and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network. 

While not actively exploited, Microsoft has identified the following new CVEs that pose a potential risk: 

CVE-2025-53771 is a patch bypass for CVE-2025-49706. 
CVE-2025-53770 is a patch bypass for CVE-2025-49704. 

CISA recommends the following actions to reduce the risks associated with the RCE compromise: 

• Apply the necessary security updates released by Microsoft.
• Configure Antimalware Scan Interface (AMSI) in SharePoint as indicated by Microsoft and deploy Microsoft Defender AV on all SharePoint servers.
  • If AMSI cannot be enabled, disconnect affected products from service that are public-facing on the internet until official mitigations are available. Once mitigations are provided, apply them according to CISA and vendor instructions.
  • Follow the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
• For information on detection, prevention, and advanced threat hunting measures, see Microsoft’s Disrupting active exploitation of on-premises SharePoint vulnerabilities and advisory for CVE-2025-49706. CISA encourages organizations to review all articles and security updates published by Microsoft on July 8, 2025, relevant to the SharePoint platform deployed in their environment.
• Rotate ASP.NET machine keys, then after applying Microsoft’s security update, rotate ASP.NET machine keys again, and restart the IIS web server.
• Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) from the internet. For example, SharePoint Server 2013 and earlier versions are end-of-life and should be discontinued if still in use.  
• Monitor for POSTs to /_layouts/15/ToolPane.aspx?DisplayMode=Edit
• Conduct scanning for IPs 107.191.58[.]76, 104.238.159[.]149, and 96.9.125[.]147, particularly between July 18-19, 2025.
• Update intrusion prevention system and web-application firewall (WAF) rules to block exploit patterns and anomalous behavior. For more information, see CISA’s Guidance on SIEM and SOAR Implementation.
• Implement comprehensive logging to identify exploitation activity. For more information, see CISA’s Best Practices for Event Logging and Threat Detection.
• Audit and minimize layout and admin privileges.

For more information on this vulnerability, please see Eye Security’s reporting and Palo Alto Networks Unit42’s post. CVE-2025-53770 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 20, 2025. Update: CVE-2025-49706 and CVE-2025-49704 were added to the KEV on July 22, 2025.

Note: This Alert may be updated to reflect new guidance issued by CISA or other parties.

CISA would like to acknowledge the contributions of the security researcher community in rapidly sharing insights that enabled CISA to notify critical infrastructure organizations impacted by this activity.

Organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at contact@mail.cisa.dhs.gov or (888) 282-0870.  

This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit  stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC)—hereafter referred to as the authoring agencies—are releasing this Joint Cybersecurity Advisory to disseminate known Interlock ransomware IOCs and TTPs identified through FBI investigations (as recently as June) and trusted third-party reporting.

The Interlock ransomware variant was first observed in late September 2024, targeting various business, critical infrastructure, and other organizations in North America and Europe. FBI maintains these actors target their victims based on opportunity, and their activity is financially motivated. FBI is aware of Interlock ransomware encryptors designed for both Windows and Linux operating systems; these encryptors have been observed encrypting virtual machines (VMs) across both operating systems. FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups. Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network.

Interlock actors employ a double extortion model in which actors encrypt systems after exfiltrating data, which increases pressure on victims to pay the ransom to both get their data decrypted and prevent it from being leaked.

The authoring agencies encourage organizations to implement the recommendations in the mitigations section of this advisory to reduce the likelihood and impact of Interlock ransomware incidents.

Wiper malware is a type of destructive malware that destroys organizational files and data, rendering them inaccessible and unusable. It typically spreads through phishing emails, malicious downloads, exploited vulnerabilities, Remote Desktop Protocol (RDP) exploits, and supply chain attacks. Wiper malware is commonly used to destroy critical assets and data and disrupt business operations, leading to financial losses and reputational damage. Threat actors use several techniques to destroy data, including overwriting files with other data (such as NULL or random bytes), encrypting files and destroying the decryption key, corrupting or overwriting the Master Boot Record (MBR), and corrupting the Master File Table (MFT).

It shares many features with ransomware except for its ultimate objective. Unlike ransomware, in which encrypted files may be recovered with a decryption key after a ransom is paid, wiper malware can masquerade as ransomware without a decryption capability. It intends to destroy data instantly and permanently, preventing data decryption and content recovery efforts even if a ransom is paid. The tactics of ransomware-as-a-service (RaaS) operations continue to evolve with emerging dual-threat capabilities combining file encryption and file destruction. The wiper feature is likely added to increase pressure on victims to pay the ransom more quickly instead of delaying or ignoring negotiations altogether.

The history of notable wiper malware started in 2012. Wiper malware was used sporadically over the following ten years to target organizations for sabotage, destruction of evidence, cyberwar, and some financial gain. Therefore, it was a preferred tool for nation-state actors and hacktivists over threat actors seeking profit. The United States government attributed the 2014 Sony Pictures Entertainment (SPE) hack to the Lazarus Group, alleged to be run by the North Korean government. SPE was the first US company to be impacted by wiper malware. In 2017, NotPetya was disguised as ransomware and intended to target Ukraine. However, it spread to many systems worldwide, including the United States and several New Jersey organizations.

Wiper malware activity surged in 2022, with attacks primarily targeting and crippling Ukranian infrastructure or organizations in the Ukraine-Russia war. It was also used by LokiLocker ransomware operators in 2022 and LockBit ransomware operators in 2023 to attack organizations that refused to negotiate a ransom payment. The use of wiper malware in ransomware attacks suggests a potential evolution of tactics by groups not linked to nation-state actors or hacktivists to retaliate and inflict maximum damage on uncooperative victims. In 2024, wiper malware continued with numerous variants, such as AcidPour targeting Linux devices in critical sectors, pro-Palestinian hacktivist group Handala Hacking Team targeting Windows and Linux environments of Israeli organizations, and Hamas-affiliated WIRTE group targeting Israeli organizations with phishing emails delivering SameCoin Wiper. Additionally, threat actors destroyed data of over half (54 percent) of global financial institutions in 2024, an increase of 12.5 percent since 2023.

At the beginning of 2025, wiper malware and ransomware were predicted to continue to increase and evolve, especially across government agencies and critical infrastructure sectors. Since then, there have been some notable wiper malware and ransomware incidents. Researchers discovered a destructive attack on a Ukrainian critical infrastructure organization using a previously unknown wiper malware. Dubbed PathWiper , the variant is likely attributed to a Russian advanced persistent threat (APT) actor that had access to the administrative console of a legitimate endpoint administration framework. The threat actors targeted the master boot record (MBR) and NTFS-related artifacts for corruption, issued malicious commands, and deployed PathWiper across endpoints in the victim organization’s environment. When executed, PathWiper dismounted volumes and overwrote artifacts with randomly generated bytes.

Threat actors also targeted Linux servers in a supply chain attack with wiper malware hidden in three Golang modules on GitHub. The malware overwrote every byte of data with zeros. In a separate campaign, threat actors used typosquatting of legitimate tools to publish eight malicious packages on NPM . The malicious packages destroyed framework files, corrupted core JavaScript methods, and sabotaged browser storage mechanisms.

Wiper malware showed an increasing and evolving trend in ransomware operations in 2025. SuperBlack ransomware operators exploited two Fortinet vulnerabilities and used wiper malware, as seen in previous ransomware incidents tied to LockBit and BrainCipher. The wiper file removed evidence of the ransom executable after encryption. ARCH WIPER ransomware operators destroyed data instead of extorting money by encrypting files without a ransom. A message was delivered stating that the files were permanently corrupted, and victims were advised to reset their systems. Anubis ransomware operators added wiper malware and claimed victims in healthcare, hospitality, business services, and construction in the United States. Anubis’s wiper feature used a /WIPEMODE parameter to permanently wipe the contents of files. Once wiped, the filenames and extensions remained displayed and untouched in the expected directories, but their file sizes were reduced to 0 KB.

A recent report revealed that ransomware is increasingly targeting cloud environments, and one of the most common types is data wiper ransomware. Threat actors, including ransomware operators, may leverage access to cloud environments to delete cloud storage, accounts, machine images, and other infrastructure that is critical to business operations. Although there is currently no evidence of wiper malware specifically targeting New Jersey, it does not mean that organizations, including critical infrastructure, are immune to this threat.

Many types of SMiShing scams continue to target New Jersey residents. Thank you and kudos to all who continue reporting scams to the NJCCIC. Each of you who reported scams recognized them for what they are: scams. Through reporting, the NJCCIC analyzes and paints a clearer picture of the current threat landscape, helps warn others, offers resources to those impacted, and takes action to help prevent any further expansion of these fraudulent campaigns.

The scope of these SMiShing campaigns is extensive, affecting numerous US states and resulting in significant financial losses. The FTC highlighted that consumers reported losses amounting to $470 million in 2024 due to scams initiated via text messages, marking a fivefold increase compared to 2020 figures. SMiShing text messages for unpaid tolls were specifically identified as a top text scam category.

Please read the NJCCIC report SMiShing at Scale: A Deep Dive into Toll Violation Text Scams for further information on how these scams are perpetrated and information to help prevent you from falling victim.

One Week Left to Comment—Small Business Cybersecurity: Non-Employer Firms

There is one week left to comment on the Initial Public Draft (IPD) of NIST Internal Report (NIST IR) 7621 Revision 2, Small Business Cybersecurity: Non-Employer Firms. The comment period closes at 11:59 p.m. EDT on June 30, 2025. 

Image Credit: Adobe

Brief Document Timeline

• October 2009 – NIST IR 7621, Small Business Information Security: The Fundamentals is first published. 
• November 2016 – NIST IR 7621 Revision 1 is published.
• March 2024 – NIST issues a pre-draft call for comments for NIST IR 7621, Revision 2.
• May 2025 – Draft NIST IR 7621 Revision 2 Initial Public Draft, Small Business Cybersecurity: Non-Employer Firms, is published for public comment. 

Key Updates within Revision 2

• This revision has a narrowed scope. Previous versions of this publication discussed the broader topic of information security; this revised publication is now focused specifically on cybersecurity, which is a subset of information security.
• The audience has also been narrowed. Prior versions were focused generally on “small business,” which is a very broad and diverse population. This revision is tailored to a more specific population—non-employer firms. 
• Revision 2 reflects changes in technology and recent updates to NIST publications, including the Cybersecurity Framework (CSF) 2.0 and the NIST IR 8286 series.
• The layout has also been updated to present the information in a tabular format to enhance readability.

Submitting Comments

We value and welcome your input and look forward to your comments. The comment period closes at 11:59 p.m. EDT on June 30, 2025. Please enter comments into this comment template (xlsx) and email the template to ir7621-comments@nist.gov with “Comments on NIST IR 7621 R2” in the subject field.

View the Publication

Multiple vulnerabilities have been discovered in Citrix products, the most severe of which could allow disclosure of sensitive data. Citrix ADC performs application-specific traffic analysis to intelligently distribute, optimize, and secure Layer 4 – Layer 7 network traffic for web applications. Successful exploitation of the most severe of these vulnerabilities could allow for memory overread, leading to disclosure of potentially sensitive information such as authenticated session tokens. Depending on the sensitive information retrieved via this technique, the attacker may gain further access to the appliance or systems.

THREAT INTELLIGENCE:
There are currently no reports of the vulnerabilities being exploited.

SYSTEMS AFFECTED:

• NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-43.56
• NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-58.32
• NetScaler ADC 13.1-FIPS and NDcPP  BEFORE 13.1-37.235-FIPS and NDcPP
• NetScaler ADC 12.1-FIPS BEFORE 12.1-55.328-FIPS

RISK:
Government:

• Large and medium government entities: Medium
• Small government entities: Medium

Businesses:

• Large and medium business entities: Medium
• Small business entities: Medium

Home users: N/A

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Citrix products, the most severe of which could allow disclosure of sensitive data. Details of the most severe vulnerabilities are as follows:

Tactic: Initial Access (TA0001):

Technique: Exploit Public-Facing Application (T1190):

• An out-of-bounds read vulnerability in NetScaler ADC and NetScaler Gateway affecting systems configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. It stems from insufficient input validation. Successful exploitation allows a remote, unauthenticated threat actor to trigger memory overreads on the affected interface. (CVE-2025-5777)

Additional lower severity vulnerabilities:

• An improper access control vulnerability in the NetScaler Management Interface of NetScaler ADC and NetScaler Gateway, affecting version 14.1 before 14.1-43.56 and version 13.1 before 13.1-58.32. It stems from insufficient enforcement of access restrictions on management endpoints. Successful exploitation allows an unauthenticated threat actor with access to the NSIP (NetScaler IP for management), Cluster Management IP, or local GSLB (Global Server Load Balancing) Site IP to interact with restricted management functions. (CVE-2025-5349)

Successful exploitation of the most severe of these vulnerabilities could allow for memory overread, leading to disclosure of potentially sensitive information such as authenticated session tokens. Depending on the sensitive information retrieved via this technique, the attacker may gain further access to the appliance or systems.

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply the stable channel update provided by Citrix to vulnerable systems immediately after appropriate testing. (M1051: Update Software)
  • Safeguard 7.1 : Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
  • Safeguard 7.2 : Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.
  • Safeguard 7.6 : Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets: Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.
  • Safeguard 7.7 : Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.
  • Safeguard 16.13 Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.
  • Safeguard 18.1 : Establish and Maintain a Penetration Testing Program: Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.
  • Safeguard 18.2 : Perform Periodic External Penetration Tests: Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.
  • Safeguard 18.3 : Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.
• Citrix recommends running the following commands to terminate all active ICA and PCoIP sessions after the appliances have been upgraded:
  • kill icaconnection -all
  • kill pcoipConnection -all

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)
  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.
  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.
• Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)
  • Safeguard 2.3: Address Unauthorized Software: Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently.
  • Safeguard 2.7: Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassessbi-annually, or more frequently.
  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.
  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.
• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)
  • Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.
• Block execution of code on a system through application control, and/or script blocking. (M1038: Execution Prevention)
  • Safeguard 2.5 : Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.
  • Safeguard 2.6 : Allowlist Authorized Libraries: Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.
  • Safeguard 2.7 : Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.
• Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. (M1040: Behavior Prevention on Endpoint)
  • Safeguard 13.2 : Deploy a Host-Based Intrusion Detection Solution: Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.
  • Safeguard 13.7 : Deploy a Host-Based Intrusion Prevention Solution: Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.

REFERENCES:

Citrix:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420

CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5349
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5777

Supply chain threat analysis is an essential component of security research. NIST Cybersecurity White Paper (CSWP) 46, Analyzing Collusion Threats in the Semiconductor Supply Chain, proposes a framework for analyzing threats related to the semiconductor supply chain. The framework introduces a metric that quantifies the severity of different threats subjected to a collusion of adversaries from different stages of the supply chain. Two different case studies are provided to describe the real-life application of the framework. The metrics and analysis aim to guide security efforts and optimize the trade-offs of hardware security and costs.

Read More

In November 2024, NIST’s Crypto Publication Review Board announced the review of NIST Special Publication (SP) 800-102, Recommendation for Digital Signature Timeliness (2009).  On April 10, 2025, NIST proposed withdrawing SP 800-102 and received one public comment in response, which agreed with NIST’s proposal. 

NIST has decided to withdraw this publication. 

Information about the review process is available at NIST’s Crypto Publication Review Project.

Read More

The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), the Department of Defense Cyber Crime Center (DC3), and the National Security Agency (NSA) (hereafter referred to as the authoring agencies) released a Joint Fact Sheet strongly urge organizations to remain vigilant for potential targeted cyber activity against US critical infrastructure and other US entities by Iranian-affiliated cyber actors.

Despite a declared ceasefire and ongoing negotiations towards a permanent solution, Iranian-affiliated cyber actors and hacktivist groups may still conduct malicious cyber activity. The authoring agencies are continuing to monitor the situation and will release pertinent cyber threat and cyber defense information as it becomes available.

Based on the current geopolitical environment, Iranian-affiliated cyber actors may target U.S. devices and networks for near-term cyber operations. Defense Industrial Base (DIB) companies, particularly those possessing holdings or relationships with Israeli research and defense firms, are at increased risk. Hacktivists and Iranian-government-affiliated actors routinely target poorly secured US networks and internet-connected devices for disruptive cyberattacks.

Iranian-affiliated cyber actors and aligned hacktivist groups often exploit targets of opportunity based on the use of unpatched or outdated software with known Common Vulnerabilities and Exposures (CVEs) or the use of default or common passwords on internet-connected accounts and devices. (Note: See CISA’s Known Exploited Vulnerabilities Catalog for more information on vulnerabilities that have been exploited in the wild). These malicious cyber actors commonly use techniques such as automated password guessing, cracking password hashes using online resources, and inputting default manufacturer passwords. When specifically targeting operational technology (OT), these malicious cyber actors also use system engineering and diagnostic tools to target entities such as engineering and operator devices, performance and security systems, and vendor and third-party maintenance and monitoring systems.

The Joint Fact Sheet contains threat activity, previous cyber campaigns, mitigation recommendations, additional resources, and is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals.

NIST maintains its cryptography standards and guidelines using a periodic review process. Currently, NIST seeks your feedback on all aspects of these two publications: 

• NIST Special Publication (SP) 800-57 Part 2, Revision 1, Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations (2019) 
• NIST SP 800-57 Part 3, Rev. 1, Recommendation for Key Management: Part 3 – Application-Specific Key Management Guidance (2015) 

The public comment period is open through September 30, 2025. Send comments to cryptopubreviewboard@nist.gov with “Comments on SP 800-57 Part 2” or “Comments on SP 800-57 Part 3” in the subject line. 

Comments received in response to this request will be posted on the Crypto Publication Review Project site after the comment due date. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed. Click the “Read More” button below for additional information about the review process. 

Read More