Search: “ncc”

Risky Bulletin: White House lets private companies carry out offensive cyber ops

A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.

A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.

Risky Business News·Aug 14, 04:42 UTC · Aug 14, 2026Policy & legal

Help shape the future of resilient private 5G

The UK NCSC invites organizations to collaborate on developing secure, resilient and deployable private 5G network technologies.

The UK National Cyber Security Centre is seeking collaboration with organizations developing technologies and approaches for secure, resilient and deployable private 5G networks. The blog post is an open call to help shape future private 5G resilience.

NCSC UK·Aug 12, 12:00 UTC · Aug 12, 2026Advisory

Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups

Trump White House memo directs NCC to build a program within 60 days authorizing vetted U.S. companies to conduct cyber surveillance and effects operations against foreign criminal groups.

A new White House memorandum instructs the National Coordination Center to establish, within 60 days, a program letting vetted private-sector companies, under federal oversight, conduct cyber surveillance operations (accessing sensitive data without authorization) and cyber effects operations (disruption, degradation, or destruction) against foreign Transnational Criminal Organizations. Targets are groups conducting cyber-enabled crime against U.S. government, persons, or interests that are not institutionally part of a foreign government. Companies must stop operations exceeding approved parameters, run minimization procedures, and alert the NCC, which notifies the Department of Justice. The fact sheet cites an estimated $20.8 billion in reported U.S. consumer losses to cyber-enabled crimes, and experts note legal and security risks since existing laws prohibit private companies from offensive cyber without court authorization.

The Hacker News·Aug 15, 00:00 UTC · Aug 15, 2026Policy & legal

Ncsc Raises Alarms Prompt

The UK NCSC raised alarms about prompt injection risks in LLM-integrated systems, urging organizations deploying AI to review exposure.

The UK National Cyber Security Centre (NCSC) has raised alarms about prompt injection attacks against systems using large language models. The warning highlights how attackers can manipulate model instructions to bypass safeguards, exfiltrate data, or trigger unintended agent actions. Organizations deploying LLM-based features are advised to assess and mitigate their exposure to this technique.

Infosecurity Magazine·Aug 19, 00:00 UTC · 28d agoAI safety & security

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.

Unit 42 connected Stately Taurus (aka Mustang Panda) espionage activity targeting ASEAN-affiliated organizations and Myanmar to the Bookworm malware family, first published in 2015. Earlier attacks delivered the PubLoad stager via DLL sideloading, with a PubLoad variant communicating with C2 at 123.253.32[.]15 while mimicking Windows Update URLs. Three previously unreported loader samples from 2021-2022 used UUID-decoded shellcode loaded via heap allocation and API callbacks, ultimately decrypting and loading Bookworm DLLs. A ToneShell backdoor variant shared debug paths with Bookworm loaders, and the January 2024 CSIRT CTI post corroborated the Myanmar attacks.

Palo Alto Unit 42·Aug 17, 10:54 UTC · Aug 17, 2026Threat actor in the wild

Managing the cyber risk of agentic AI

UK NCSC guidance recommends safeguards, sandboxing, and active oversight to manage cyber risks of autonomous agentic AI systems.

The UK National Cyber Security Centre published guidance on managing the cyber risk of agentic AI systems. It recommends safeguards, sandboxing, and active human oversight to limit unintended autonomous activity while realizing the benefits of these systems. The publication is official national guidance for organizations deploying agentic AI.

NCSC UK·Aug 20, 12:00 UTC · 27d agoAdvisory

You don’t have to join the hack-back program to inherit its risk

A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.

The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.

CSO Online·09:00 UTC · 7h agoPolicy & legal

Coast Guard says it is monitoring cyberattack that disrupted North Carolina's ports

CyberScoop·Aug 7, 14:24 UTC · Aug 7, 2026Exploit / PoC in the wild

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Oasis Security found NVIDIA NemoClaw's Ollama binding to 0.0.0.0 enables DNS rebinding attacks that let attacker pages poison model chat templates with persistent hidden instructions.

Oasis Security disclosed that NVIDIA NemoClaw on Windows/WSL paths binds Ollama to 0.0.0.0:11434 without authentication, exposing the API to browser-based DNS rebinding attacks from malicious webpages. An attacker can then modify the model's chat template via /api/create, planting hidden instructions that run on every subsequent inference and persist across conversations, invisible to API consumers. NemoClaw v0.0.35 fixed the issue on macOS and Linux; no fix exists for Windows and WSL paths beyond a warning in v0.0.34. Ollama's own 2024 fix (CVE-2024-28224) added Host header validation, but it is skipped when bound to non-loopback addresses. No exploitation has been reported as of August 25, 2026.

The Hacker News·Aug 25, 15:58 UTC · 22d agoAI safety & securityCVE-2024-282241

The GNU C Library security advisory update for 2026-09-10

glibc advisory GLIBC-SA-2026-0016: nscd can crash from a stack overflow when an untrusted DNS server returns oversized responses.

A new GNU C Library advisory (GLIBC-SA-2026-0016) describes a stack overflow in the nscd service caused by unbounded alloca use. glibc 2.3.4 and newer may crash when a malicious DNS server returns an oversized response, resulting in degraded DNS resolution. Exploitation requires nscd to be enabled and the system to be using an untrusted DNS server. The advisory was posted to oss-security by glibc maintainer Siddhesh Poyarekar.

oss-security·updated Sep 14, 19:54 UTC · 1d ago·first Sep 11, 01:59 UTC · 5d agoVulnerability 2 sources2

Your security vendor gets the frontier cyber model, you get the findings

Help Net Security·Aug 11, 00:00 UTC · Aug 11, 2026Vulnerability

10th August – Threat Intelligence Report

North Carolina Ports suffered a cyberattack forcing Wilmington and Morehead City operations onto manual processes; the authority says it is contained.

Check Point's weekly threat intelligence bulletin reports that North Carolina Ports, the US authority operating the ports of Wilmington and Morehead City among others, suffered a cyberattack. The incident forced some operations onto manual processes. The authority claims it has contained the attack.

Check Point Research·Aug 10, 13:53 UTC · Aug 10, 2026Data breach

Trump taps cyber firms to go on offensive against criminals

Presidential memorandum allows vetted private companies to conduct offensive cyber operations against transnational cybercrime with advance DOJ and DHS approval.

A presidential memorandum released Wednesday lets vetted US companies partner with the Justice and Homeland Security departments on offensive operations and surveillance targeting transnational cybercrime, fraud and predatory schemes, with written pre-approval required for every operation. Operations may not cause loss of life or rise to the level of use of force or armed attack under international law. Participating firms face penalties of at least $1 million for contract violations, must disclose all contractual relationships, and face annual evaluation, while agencies have two months to develop participation standards. The move builds on a March executive order; the White House says Americans reported $20.8 billion in cyber-related losses last year.

The Record·Aug 13, 13:40 UTC · Aug 13, 2026Policy & legal

NCSC Urges Stronger Controls for Agentic AI Systems

UK's NCSC urges organizations to apply sandboxing, human oversight, and strict access controls when deploying autonomous AI agents.

The UK National Cyber Security Centre published guidance recommending stronger controls for autonomous agentic AI systems. Recommended measures include sandboxing, active human oversight, and tightly scoped access controls to limit unintended agent activity. The guidance aims to help organizations realize the benefits of agentic AI while managing its cyber risk.

Infosecurity Magazine·Aug 20, 12:45 UTC · 27d agoAI safety & security

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News·Aug 31, 03:25 UTC · 16d agoPolicy & legal

Cyberattack on North Carolina Ports ‘contained’ as Coast Guard, state officials investigate

The Record·Aug 6, 17:16 UTC · Aug 6, 2026Ransomware

CMMC Hit Pause, the FAR Council Hit Play

DoD paused CMMC Phase 2 pending a 60-day review while a proposed FAR Council rule would extend NIST 800-171 Rev 3 to all federal contractors.

The Department of Defense suspended CMMC Phase 2 third-party certification requirements, but Phase 1 self-assessments under DFARS 252.204-7021 remain in force since November 2025, and prime contractors are still directing suppliers to proceed. A CMMC Reform Task Force must report recommendations to the DoD CIO within 60 days, likely by September or October 2026. Separately, the FAR Council's proposed CUI rule from June 23 would apply NIST 800-171 Revision 3, 72-hour incident reporting, and flowdown obligations to all FAR-based federal contracts, not just the defense industrial base. False Claims Act exposure grows as DIBCAC assessment teams now cooperate directly with the DOJ.

Huntress·Sep 2, 16:00 UTC · 14d agoPolicy & legal

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

NCSC links disruptive cyber activity to internet-exposed systems and edge devices, urging OT owners to fix avoidable vulnerabilities and improve resilience.

The UK's NCSC issued guidance following disruptive cyber activity that highlights the risk to internet-exposed systems and edge devices. It encourages owners of operational technology to remediate avoidable vulnerabilities and invest in long-term cyber resilience. The notice underscores that exposed edge devices remain a common entry point for attackers against OT environments.

NCSC UK·Aug 27, 12:00 UTC · 20d agoAdvisory in the wild

Zelensky appoints former police chief to lead Ukraine’s cyber coordination center

Zelensky appoints former police chief Ihor Klymenko to head Ukraine's National Cybersecurity Coordination Center amid broader security leadership reshuffle.

Ukrainian President Volodymyr Zelensky appointed Ihor Klymenko, former National Police head, interior minister, and NSDC secretary, to lead the National Cybersecurity Coordination Center (NCCC). The NCCC, created in 2016 under the National Security and Defense Council, coordinates government agencies' responses to major cyberthreats including Russian operations. The appointment comes amid a wider reshuffle of Ukraine's defense and security leadership.

The Record·Sep 15, 15:09 UTC · 1d agoPolicy & legal

Water sector example added to the NCSC’s Secure connectivity principles

NCSC UK adds a water sector example to its Secure Connectivity Principles, the first ICS community-authored content on its site.

The UK NCSC has added a water sector example to its Secure Connectivity Principles guidance. It is the first content authored by the Industrial Control System Community of Interest to appear on ncsc.gov.uk. The guidance helps ICS operators apply secure connectivity practices.

NCSC UK·Aug 11, 12:00 UTC · Aug 11, 2026Advisory

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project Zero·Sep 8, 07:00 UTC · 8d agoResearch1

FTC Withdraws Obsolete Policy Statement

The FTC rescinded its 2021 policy statement that applied the Health Breach Notification Rule to health apps and connected devices collecting consumer health data.

The Federal Trade Commission formally rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The statement had purported to apply the FTC's Health Breach Notification Rule to health apps and connected devices that collect consumer health information. The Commission considers the statement obsolete following its 2024 update to the Health Breach Notification Rule.

DataBreaches.net·Sep 10, 13:40 UTC · 6d agoPolicy & legal 2 sources

How BitLocker PINs help protect your data and devices

NCSC UK guidance explains that configuring BitLocker PINs mitigates many BitLocker vulnerabilities and urges readiness for future bypass flaws.

The UK National Cyber Security Centre published guidance explaining how BitLocker PINs strengthen protection of data and devices. According to NCSC, enabling a pre-boot PIN mitigates many known BitLocker vulnerabilities that rely on default TPM-only configurations. The guidance encourages organizations to configure PINs now to be prepared for the next disclosed BitLocker bypass.

NCSC UK·Aug 13, 12:00 UTC · Aug 13, 2026Advisory

US Defense Contractors Admit Their Rising CMMC Scores May Not Be Accurate

US defense contractors report rising self-assessed CMMC Phase I scores while doubting the accuracy of those self-evaluations.

Self-assessment scores under the US Department of Defense's Cybersecurity Maturity Model Certification (CMMC) Phase I have reportedly reached an all-time high. Contractors themselves doubt whether these self-reported scores accurately reflect their real security maturity. The uncertainty highlights concerns about the reliability of self-assessments in the program's initial phase.

Infosecurity Magazine·Aug 20, 12:40 UTC · 27d agoPolicy & legal

How to secure hybrid meeting rooms without sacrificing user experience

Sponsored Barco piece, citing IDC data, says security is now the top videoconferencing purchase criterion as NIS2 and Cyber Resilience Act compliance pressures mount.

The sponsored article cites IDC research showing security (31%) now outranks price (26%) and quality (25%) as the top videoconferencing purchase criterion. It highlights concerns like malware propagation (47%), missed patches (39%), and risky user behavior (37%), and references NIS2, the Cyber Resilience Act, the Radio Equipment Delegated Act, and ISO/IEC 27001. Barco ClickShare marketing director Yannic Laleeuwe argues security is now a prerequisite for market access and resilience, but warns that usability tradeoffs drive risky workarounds.

The Register · Security·Sep 8, 15:00 UTC · 8d agoIndustry

NCSC Warns Shadow AI Creates New Security Risks

UK NCSC warns that unapproved AI tools used by 71% of UK employees expose corporate data and create hard-to-detect organizational security risks.

The UK's National Cyber Security Centre warned on 7 September that shadow AI, unapproved AI tools used outside organizational controls, creates visibility gaps and raises risks of data breaches, intellectual property loss, and regulatory non-compliance. It cited Microsoft research finding 71% of UK employees had used AI tools not approved by their employer. NCSC also warned AI agents can carry critical vulnerabilities, allowing attackers who exploit one to inherit the agent's data access, services and privileges, and that attackers are highly likely to abuse agents with looser guardrails. The agency recommended reducing rather than eliminating shadow AI through positive security culture and clear guardrails.

Infosecurity Magazine·Sep 7, 14:00 UTC · 9d agoAI safety & security

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA Advisories·Sep 10, 12:00 UTC · 6d agoAdvisoryCVE-2026-87020

Cisco security advisory (AV26-876)

Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.

The Canadian Centre for Cyber Security advisory AV26-876 lists Cisco vulnerabilities affecting IOS XR, Nexus 9000 Series switches, and several IP phone series. Included are a Nexus 9000 Silicon One remote code execution vulnerability, a September 2026 IOS XR security hardening release, and SIP software denial-of-service flaws in Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875. The Cyber Centre urges users and administrators to review the Cisco advisories and apply updates as they become available. No active exploitation is reported in the advisory.

Canadian Centre for Cyber Security·Sep 3, 13:13 UTC · 13d agoAdvisory

The hidden risks of shadow AI

UK NCSC guidance warns shadow AI use by employees risks data exposure, lost data control, and attacker exploitation of vulnerable AI agents.

The UK NCSC warns that 'shadow AI'—use of AI tools not captured in organizational approved systems—is widespread, with 71% of employees reporting unapproved AI tool use. Risks include exposure of sensitive company and customer data, loss of visibility and control when data goes to consumer AI services, and new attack opportunities if adversaries exploit vulnerabilities in AI agents with access to corporate systems. The NCSC advises reducing rather than eliminating the risk through positive security culture, understanding employee needs, offering secure alternatives, and following its joint guidance on careful adoption of agentic AI services.

NCSC UK·Sep 7, 12:00 UTC · 9d agoAdvisory

Lightweight Zero Trust via Automotive SDN

Researchers map automotive SDN with MACsec/MKA and CORECONF/YANG to NIST SP 800-207, satisfying five of seven Zero Trust tenets without added infrastructure.

Zonal in-vehicle networks ship Ethernet, MACsec, and TSN but treat the network itself as trusted, with no standardized runtime way to revoke access, rotate keys, or contain a compromised ECU. The paper first analyzes what Open Alliance TC17 v1.0 MACsec/MKA with pre-shared CAKs already provides against the seven NIST SP 800-207 Zero Trust tenets. It then adds CORECONF/YANG management per Open Alliance TC19, mapping the SDN Controller and Agents one-to-one onto NIST's PE, PA, and PEP, and instantiates a YANG-based network-access-control flow and key-management scheme. The result fully covers five of the seven tenets and partially covers two, without any ZTA-specific infrastructure.

arXiv cs.CR·Sep 9, 07:20 UTC · 7d agoResearch