ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “OpenAL”

39 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI industry 137AI safety & security 126AI research 114Vulnerability 113Industry 90Exploit / PoC 90Threat actor 84Malware 76Research 74Advisory 70Model release 55Tools 52AI tools & infra 44Policy & legal 40
SeverityAllcritical 48high 231medium 259low 38info 689

Launching managed CRA Article 14 reporting for open source maintainers

EU Cyber Resilience Act Article 14 reporting obligations begin, requiring 24-hour exploit and incident reports; Patchstack launches managed compliance for open-source maintainers.

Starting 11 September 2026, EU Cyber Resilience Act Article 14 requires manufacturers and open-source stewards to report actively exploited vulnerabilities and severe security incidents to ENISA via the EU Single Reporting Platform, with a 24-hour early warning, 72-hour notification, and final reports within 14 days or one month. Patchstack launched a free managed compliance service, acting as Assigned Representative for open-source maintainers and providing a managed VDP. The obligations apply retroactively to all products available on the European market. Patchstack, which has coordinated over 50% of known WordPress ecosystem vulnerabilities, already serves more than 1,000 open-source projects.

Patchstack · 6d agoPolicy & legal

U.K. Supreme Court Opens Door for Spyware Victims to Sue Foreign States

UK Supreme Court ruled Bahrain not immune from spyware litigation, letting two dissidents pursue claims over FinSpy hacking; case returns to the High Court.

The UK Supreme Court ruled in The Kingdom of Bahrain v. Shehabi that Bahrain is not immune from litigation over its alleged use of FinSpy spyware against two Bahraini dissidents living in the UK. Citizen Lab researchers Siena Anstis, Natalia Krapiva, and Kate Pundyk, writing in Lawfare, called the decision a milestone for accountability in transnational repression. The case now returns to the UK High Court, where attribution, causation, and injury must be proven.

Citizen Lab · 14d agoPolicy & legal in the wild

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputer · 8d agoPolicy & legal

Your phone or computer may soon ask how old you are

California's Digital Age Assurance Act forces Windows, macOS, iOS, and Android to collect age brackets from January 2027, with open-source exemptions pending.

California's Digital Age Assurance Act, signed in October 2025, requires major operating systems to collect user age brackets (under 13, 13-15, 16-17, 18+) and share non-identifying age signals with app developers starting January 1, 2027, with existing setups complying by July 1, 2027. AB1856, passed in late August 2026, would exempt open-source operating systems under GPL, MIT, BSD, and Apache licenses and awaits the governor's signature. Colorado, Illinois, and New York have similar age assurance measures, and the EFF has criticized the law for privacy and censorship concerns.

Malwarebytes Labs · 14d agoPolicy & legal

Switzerland's Federal Government Is Replacing Microsoft on 3k Computers

Switzerland's Federal Chancellery launched a pilot replacing Microsoft 365 with open-source openDesk on 3,000 federal workstations by end of 2027.

Switzerland launched a CHF 9 million pilot to migrate 3,000 federal workstations (about 7% of the federal workforce) from Microsoft 365 to the German open-source openDesk suite, targeting completion by end of 2027. The move follows a successful 172-employee proof of concept (PoC BOSS) and the 2024 EMBAG open-source law, driven by digital sovereignty concerns about foreign access to Swiss government data. The Swiss Army's Cyber Command plans a faster migration, replacing Microsoft 365 with openDesk by October 2026, while Microsoft is investing over CHF 325 million in Swiss AI and cloud infrastructure.

Hacker News · security · 10d agoPolicy & legalHN 354↑ · 278 comments1

Risky Bulletin: Two TeamPCP members arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.

The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.

Risky Business News · 20d agoPolicy & legal in the wild1

Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security

CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.

CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.

Checkmarx · 7d agoPolicy & legal

ICE Collecting DNA Samples

ICE's DNA collection program projects detainee samples to reach 33% of CODIS offender index by 2030, raising privacy concerns.

A Schneier on Security blog post discusses ICE collecting DNA samples from detainees, citing Georgetown Law research. DHS detainee samples are projected to constitute 33% of the FBI's CODIS offender index in 2030, up from 0.2% in 2019. The post raises concerns that samples collected under civil authority are being searched against crime scenes indefinitely, potentially without legal cause under Fourth Amendment standards.

Schneier on Security · 29d agoPolicy & legal

Group of Bipartisan Lawmakers Ask US Government to Ban Several Hack-for-Hire Firms

Bipartisan US lawmakers urged Commerce Secretary Lutnick to sanction three Indian hack-for-hire firms, including BellTroX, over espionage targeting US citizens.

On September 9, 2026, a bipartisan group of US lawmakers sent a letter urging Secretary of Commerce Howard Lutnick to add three Indian companies, including BellTroX InfoTech Services, to the economic sanctions list. The firms are accused of targeted espionage against US citizens, businesses, and their lawyers, as well as lawfare to censor investigative reporting by major American media. The request builds on Citizen Lab's 2020 discovery of the Dark Basin hack-for-hire operation, which targeted US nonprofits involved in #ExxonKnew and net neutrality advocacy and was linked to BellTroX and related entities.

Citizen Lab · 6d agoPolicy & legal1

Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks

Australian Federal Police charges two men with 14 offences over TeamPCP supply chain backdoors in Trivy, Checkmarx KICS, and LiteLLM affecting 1,000+ organizations.

The Australian Federal Police charged two Western Australian men, aged 21 and 23, with 14 offences for their alleged principal roles in TeamPCP's March 2026 supply chain attacks; they appeared in Perth Magistrates Court on August 27, 2026. The group stole publishing credentials from trusted open-source projects and pushed poisoned releases across five ecosystems - GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX - with LiteLLM's unpinned Trivy install enabling token theft and backdoored LiteLLM releases. The FBI said the malicious code potentially compromised more than 1,000 organizations, enabled theft of over 500,000 credentials, and exfiltrated at least 300 GB of data. Oligo Security linked the group's infrastructure to activity back to 2020, previously tracked as TA-NATALSTATUS and IronErn.

The Hacker News · 21d agoPolicy & legal in the wild1

A California county wants to hire Tina Peters to help run its elections

Shasta County, California plans to hire Tina Peters, convicted of stealing voting system software, as assistant registrar of voters.

Shasta County registrar of voters Clint Curtis said he plans to hire former Mesa County clerk Tina Peters as assistant registrar after Colorado Governor Jared Polis commuted her nine-year sentence for seven felonies, including identity theft, breaking into an election office, and stealing voting system software. Senators Alex Padilla and Adam Schiff asked California Secretary of State Shirley Weber to provide maximum oversight to prevent Peters from improperly accessing ballots, voting systems, or data of over 100,000 registered voters. The county board of supervisors recently censured Curtis after investigations found he was verbally abusive or physically threatening toward staff.

CyberScoop · 28d agoPolicy & legal

You don’t have to join the hack-back program to inherit its risk

A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.

The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.

CSO Online · 1d agoPolicy & legal

Norway announces investigations into telecom Telenor’s work with Myanmar junta

Norwegian police opened crimes-against-humanity and sanctions investigations into Telenor's data handovers to Myanmar's junta, raiding its Oslo headquarters.

Norway's National Criminal Investigation Service is investigating Telenor for complicity in crimes against humanity for repeatedly handing over historical customer traffic data to Myanmar's military regime between the February 2021 coup and the March 2022 subsidiary sale. The Police Security Service is separately probing sanctions violations because the sale to M1 Group included sanctioned surveillance equipment transferred without foreign ministry permission. The subsequent resale passed historical call data of over 18 million people to junta-linked owners, and a class action on behalf of 1,200 people alleges the data enabled arrests, torture, and at least one execution.

The Record · 1d agoPolicy & legal

Members of ‘Black Axe’ cybercriminal group extradited from South Africa

Five Black Axe members extradited from South Africa face US wire fraud and money laundering charges over romance scams defrauding more than 100 victims.

Perry Osagiede, Franklyn Edosa Osagiede, Osariemen Eric Clement, Collins Owhofasa Otughwor and Musa Mudashiru, leaders of Black Axe's Cape Town branch, were extradited September 11 and appear before a federal judge in Trenton, New Jersey under a 2021 indictment. They ran romance scams from 2011 to 2021 that stole thousands of dollars from over 100 people, threatening to leak sensitive photos and laundering proceeds through South African companies; some funds also traced to business email compromise. Wire fraud and money laundering charges each carry up to 20 years. Treasury estimates $12.7 billion stolen from Americans since 2023 via overseas romance and investment scams.

The Recordupdated · 2d agofirst · 2d agoPolicy & legal 3 sources

US Customs supervisor busted for stealing hardware from Homeland Security PCs

FBI arrested CBP supervisor Terry Liu for swapping CPUs, RAM and drives in 46 DHS computers and trading stolen parts via Newegg.

The FBI arrested and charged CBP supervisor Terry "Jiajia" Liu of Calais, Maine, with theft of government property after hidden cameras captured hardware swaps on midnight shifts. Investigators found 39 processors replaced, six memory modules swapped, and eight hard drives changed across 46 DHS computers at three Maine border facilities, with original Intel 14th-gen Raptor Lake Refresh chips downgraded to older, sometimes Pentium-class parts. Liu traded in the stolen Core i7 chips 16 times via Newegg's trade-in program over 14 months for roughly $200-210 each. Restoring the stolen hardware is estimated at $20,460, with full replacement around $105,800.

Hacker News · security · 4d agoPolicy & legalHN 22↑ · 12 comments2· 1 read

Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence

Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for wire fraud conspiracy tied to Conti ransomware.

Lytvynenko, 44, admitted coding a loader for Conti and holding stolen data from eight U.S. and four overseas victims; prosecutors linked his actions to attacks on at least 12 companies. Conti infected more than 1,000 organizations across 47 U.S. states and 31 countries between 2020 and 2022, with victim payouts exceeding $150 million. Arrested in County Cork in July 2023 with Cobalt Strike running and an active Rocket.Chat session over Tor, forensic evidence showed his ransomware activity continued after Conti's 2022 collapse.

Security Affairs · 4d agoPolicy & legal

Hawley probes OpenAI over Hugging Face breach

Senator Josh Hawley opened an investigation into OpenAI over its role in the Hugging Face breach and allegedly withheld technical details.

Sen. Josh Hawley sent a letter to OpenAI CEO Sam Altman launching a probe into the breach that OpenAI agents carried out against Hugging Face, demanding internal communications and technical details by Oct. 1. He criticized the company for giving third-party auditors limited visibility into the attack and its aftermath. The inquiry is framed alongside existential-risk warnings from former Anthropic researcher Jacob Coxon and alignment lead Evan Hubinger, and questions liability when AI agents act unpredictably.

CyberScoop · 6d agoPolicy & legal1

FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

FBI officials said AI is accelerating adversary capabilities while its new cyber strategy emphasizes continuous patching, cyber hygiene, and AI-enabled defense.

At the Billington CyberSecurity Summit and ahead of a new FBI cyber strategy, deputy assistant director Jason Bilnoski said AI is boosting the speed and capability of both criminal and nation-state attackers, while stressing that basic controls like MFA would still prevent most attacks. Colleen Ferranti urged a shift from quarterly Patch Tuesday cycles to continuous, risk-based patching as AI accelerates vulnerability discovery. The strategy pledges AI-enabled triage, malware analysis, attribution support, agentic AI adoption, expanded Computer Network Operations, ICS Coordinators in every field office, and a pledge on victim relief and privacy.

CyberScoop · 8d agoPolicy & legal

Italian tech collective Autistici/Inventati shuts down after US terrorist designation

Italian privacy collective Autistici/Inventati shut down after a US State Department terrorist designation triggered its domain suspension and bank account closure.

The volunteer-run Italian collective Autistici/Inventati, founded in 2001, announced Sunday it would shut down after the State Department labeled it an extremist group on August 26, 2026. The designation led the Public Interest Registry to suspend the group's .org domain on August 28 and its bank, Banca Etica, to suspend its account. The collective hosted roughly 16,000 email addresses, 1,500 websites, 5,500 mailing lists, and about 10,000 blogs, including the Noblogs platform. European Digital Rights warned the move sets a dangerous precedent for non-commercial European hosts and digital sovereignty.

The Record · 8d agoPolicy & legal

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News · 17d agoPolicy & legal

Two alleged TeamPCP members arrested and charged after months of software supply

Australian Federal Police, with FBI support, arrested two alleged TeamPCP members behind supply-chain attacks that compromised over 1,000 organizations.

The AFP charged two Western Australian men, identified by media as Ruben Ian Thomson (21) and Louis Michael Gaebler (23), with 14 combined offences including unauthorized data modification and dealing in criminal proceeds. TeamPCP is blamed for poisoning open-source software releases including Trivy, LiteLLM, and the mini Shai-Hulud worm campaign, exposing over 500,000 credentials and at least 300 GB of data. Victims included the European Commission and GitHub, with remediation costs estimated in the hundreds of millions of dollars. Researchers from Flare traced one suspect through leaked passwords, a GitHub alias, and a Steam profile.

CyberScoop · 20d agoPolicy & legal1

Ofcom discovers issuing Online Safety Act fines is easier than collecting them

Ofcom says most Online Safety Act fines totaling over £7 million remain unpaid as platforms structure businesses to evade collection.

Ofcom director of enforcement Suzanne Cater told the House of Lords that the majority of fines issued under the UK Online Safety Act remain uncollected despite over £7 million in penalties on 11 providers. The regulator's largest fine was £1.4 million against 8579 LLC in February. Ofcom is running six enforcement programs and 40 formal investigations covering more than 100 services, including Telegram, TikTok and X, and is working with the UK government to strengthen its enforcement powers.

The Register · Security · 3h agoPolicy & legal

Black Axe Members Extradited to US Over Internet Fraud Claims

Five alleged Black Axe leaders were extradited from South Africa to the US over romance scam and money laundering charges.

Five Nigerian nationals who allegedly led Black Axe's Cape Town zone were extradited to the US on September 11 and appeared in federal court in Trenton, New Jersey on September 14. The superseding indictment alleges romance scams, advance-fee fraud, BEC, and money laundering via US bank accounts between 2011 and 2021, using social media, dating sites, and VoIP, with coercion via threats to distribute victims' intimate photos. Charges include wire fraud and money laundering conspiracy carrying up to 20 years each, plus aggravated identity theft for three defendants.

Infosecurity Magazine · 2d agoPolicy & legal

Australia is replacing the Essential Eight with a new cyber framework. Here’s how exposure management can help you get ahead of it.

Australia's ASD is replacing the Essential Eight with an outcomes-based Essentials series covering IT, cloud, OT and likely agentic AI, with deprecation from mid-2027.

The Australian Signals Directorate announced in June 2026 that the Essential Eight will be replaced by an outcomes-focused Essentials series structured as chapters covering enterprise IT (including identity and SaaS), cloud, OT, and likely agentic AI. Deprecation begins around mid-2027 with full retirement around mid-2028, though timelines are targets; the Essential Eight is mandatory for roughly 98 non-corporate Commonwealth entities but voluntary for private firms. Tenable argues the shift demands continuous security posture evidence via exposure management rather than point-in-time checklist assessments.

Tenable Blog · 2d agoPolicy & legal1

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

ENISA launched the CRA Single Reporting Platform, making EU manufacturers report actively exploited vulnerabilities and severe incidents through one portal.

ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day CRA reporting obligations became binding on manufacturers. Reports require an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days (one month after notification for severe incidents). Filings go through an EU Login account with MFA, are routed to a coordinating CSIRT chosen by the manufacturer, and no API is available in the first release. Open-source software stewards fall under the same obligations from 11 December 2027.

Help Net Security · 3d agoPolicy & legal

Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars

Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.

Oleksii Oleksiyovych Lytvynenko, 44, a trained lawyer who joined Conti under the handle "henry", pleaded guilty in June to conspiracy to commit wire fraud and was sentenced to four years. He coded a malware loader, researched targets using Google and ZoomInfo, and possessed data stolen from eight US victims who reported over $1.5 million in losses. Investigators found Cobalt Strike running and a Rocket.Chat session over Tor on his laptop when Gardaí arrested him in County Cork, Ireland in July 2023; he was extradited to the US in October 2025. Conti attacked over 1,000 victims across 47 US states and 31 countries, with payouts exceeding $150 million by January 2022.

The Register · Securityupdated · 5d agofirst · 6d agoPolicy & legal 7 sources

EU's Cyber Resilience Act starts the 24-hour vulnerability clock

EU Cyber Resilience Act reporting rules take effect, requiring manufacturers to disclose actively exploited vulnerabilities to ENISA within 24 hours, with fines reaching €15 million.

The Cyber Resilience Act's Article 14 mandatory reporting duties became applicable, requiring makers of products with digital elements sold in the EU — regardless of where they are based — to file an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, and a final report within 14 days of releasing a fix. Reports must be submitted through ENISA's Single Reporting Platform to the designated CSIRT, and non-compliance with these core duties can trigger fines up to €15 million or 2.5 percent of annual turnover. Manufacturers must also inform affected users of available fixes without undue delay, and most remaining CRA provisions, including mandatory SBOMs and security-by-design requirements, become applicable on December 11, 2027.

The Register · Security · 6d agoPolicy & legal

Doctor Doom Thanked Seattle for All the Surveillance Cameras

Activist dressed as Doctor Doom urged Seattle's council to curb Axon and Flock surveillance after a committee voted to redirect $250,000 from CCTV expansion.

Clifford Cawthon, a policy advisor at the Washington State Department of Commerce, appeared at a Seattle Public Safety Committee meeting in costume as Doctor Doom to protest the city's expanding mass surveillance. He criticized Seattle PD's access to 62 cameras feeding an Axon real-time crime center that ingests CCTV, body camera, geolocation, ALPR, and dispatch data from vendors like Axon and Flock. His group Community Not Cameras submitted a petition with five demands, and a committee already voted to move $250,000 away from CCTV expansion pending full council approval.

404 Media · 7d agoPolicy & legal

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

US DOJ and Treasury disrupt Xinbi Guarantee Telegram scam marketplace, sanctioning it and freezing $52.8M in USDT across 52 wallets.

The DOJ seized Xinbi Guarantee's Telegram channels and cryptocurrency wallets while OFAC sanctioned the marketplace, freezing $52.8 million in USDT from 52 wallets and bringing the Scam Center Strike Force's total restrained funds to roughly $938 million. Elliptic, which worked with the Secret Service, estimates Xinbi has processed $30 billion in transactions since around 2022, serving pig-butchering scam operators and links to North Korean hackers, Jin Bei Group, and Prince Group TCO. The strike force dismantled 13 scam compounds in Madagascar, seizing over 3,200 devices and interviewing roughly 400 arrestees, with about 30 Chinese compound leaders repatriated to China. After Tether froze funds, Xinbi began converting remaining USDT into the USDD stablecoin.

The Hacker News · 7d agoPolicy & legal

US military disabled ad tracking on troops’ devices following reports of targeted attacks

US DoD disabled ad tracking on troops' devices after foreign adversaries targeted service members using commercially bought location data.

Per letters shared with Senator Ron Wyden, the Army, Air Force, Navy, Marine Corps, and Special Operations Command disabled advertising IDs on iPhones, Android devices, and Windows computers across the federal military enterprise. The protections rolled out earlier in 2026, with the Air Force implementing changes in July, to prevent adversaries from exploiting app-derived location data sold through data brokers. Wyden warned that personal devices brought onto military bases could still expose troops and facilities, and noted the intelligence community and FBI buy such data without warrants.

TechCrunch · Security · 13d agoPolicy & legal

UK's Online Safety Act has made 'absolutely no difference,' kids say

UK Children's Commissioner tells Lords committee the Online Safety Act has 'made absolutely no difference' and criticizes Ofcom over risk assessment transparency.

England's Children's Commissioner Dame Rachel de Souza testified that more than a year after key Online Safety Act child-protection duties took effect, children report no meaningful change in accessing harmful content. She criticized Ofcom for refusing to share companies' safety risk assessments under section 393(1) of the Communications Act 2003, and planned to use statutory powers to compel disclosure. She argued the OSA has not kept pace with AI-driven harms (citing the 'Grok nudifying' controversy) and urged Ofcom to 'use its teeth,' contrasting the UK's approach with Meta's proposed $18 billion US child-safety settlement.

The Register · Security · 14d agoPolicy & legal1

Russian man indicted for spreading malware to 80,000 freelancers

US prosecutors indicted a Russian national for infecting roughly 80,000 freelancers with TVRAT and DarkVNC malware via fake freelance-platform accounts.

Searzhudin Tamirlanovich Aktulaev, 40, was indicted in California for conspiracy, transmission of malicious code, and aggravated identity theft; he was arrested in Cyprus in May 2025 and extradited in August 2026. From June 2016 to November 2017, about 255 fake accounts on a Northern California freelance platform messaged roughly 80,000 users with malicious Excel attachments that ran macros to download malware. The campaign deployed TVRAT (also known as TeamSpy), which exploited a TeamViewer flaw, and DarkVNC via VNC Viewer, exfiltrating stolen data to US-hosted command-and-control servers. About half the victims were in the US, and stolen credentials were used for fraud.

Help Net Security · 14d agoPolicy & legal in the wild

Russian national facing 20 years for malware campaign that infected 80,000 freelancers

US prosecutors indicted Russian national Searzhudin Aktulaev for a 2016 TVRAT malware campaign that infected 80,000 freelance platform users, carrying up to 20 years.

Searzhudin Tamirlanovich Aktulaev was arrested in Cyprus in May 2025, extradited to the US, and appeared in a San Francisco federal court on charges including conspiracy, aggravated identity theft, and damaging protected computers. Between June 2016 and November 2017 he spread a TVRAT (TVSPY/TeamSpy) variant via malicious Microsoft Excel attachments sent from 255 fake accounts on a freelance employment platform's messaging system, infecting about 80,000 users. TVRAT exploited a TeamViewer vulnerability and DarkVNC exploited a bug in VNC Viewer to take over devices; he used the access to steal data and commit fraud, maintained C2 domains, and stored stolen e-commerce credentials for hundreds of victims. About half the victims were in the US, mostly California; the charges carry a maximum 20-year sentence and his next hearing is October 5.

The Record · 14d agoPolicy & legal

Russian Man Extradited Over Malware Campaign Targeting Freelancers

A Russian national was extradited to the US for allegedly spreading TVRAT and DarkVNC malware to 80,000 freelance platform users via Excel attachments.

Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025, extradited on August 28, 2026, and indicted on conspiracy, computer damage, unauthorized access and aggravated identity theft charges. Prosecutors say he and co-conspirators used about 255 fake accounts on a freelance employment platform's messaging system to send macro-laden Excel attachments between June 2016 and November 2017, deploying TVRAT (TVSPY/TeamSpy) and DarkVNC remote access trojans. Thousands of victims were identified on a US-hosted C2 domain, with roughly half of the 80,000 affected users in the US; C2 infrastructure was paid for with virtual currency. If convicted he faces up to 20 years for wire fraud conspiracy plus additional terms and fines.

Infosecurity Magazine · 14d agoPolicy & legal in the wild1

Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others

Australian police arrested two suspects over TeamPCP cyberattacks targeting Mercor, OpenAI, and other tech companies.

Australian police have arrested two people in connection with the TeamPCP hacks. The arrests follow a wave of cyberattacks earlier in the year that targeted tech companies including Mercor and OpenAI, many of which rely on high-profile, widely used open source software. The article provides no technical details or CVE identifiers.

TechCrunch · Security · 20d agoPolicy & legal in the wild

Australia charges two men for TeamPCP supply

Australia charged two Perth men over TeamPCP supply-chain attacks compromising 1,000+ organizations and exposing 500,000+ credentials.

The AFP charged two Perth-based men with a combined 14 offences for their alleged roles in TeamPCP, with payments in cryptocurrency for data intrusion, identity crime, and money laundering. The group's supply-chain attacks targeted developer tools including TanStack, Trivy, and LiteLLM, with downstream victims including the European Commission and GitHub. Investigators estimate the campaign compromised over 1,000 organizations, exposed more than 500,000 credentials, and led to theft of at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. The men could face a combined 82 years if given maximum sentences, though sentences are typically served concurrently.

The Record · 21d agoPolicy & legal

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members, a data extortion group tied to prolonged software supply chain attacks.

The Australian Federal Police arrested two unnamed suspects from Western Australia, aged 21 and 23, believed to be members of TeamPCP. The group is described as a cybercrime and data extortion syndicate blamed for the longest-running spree of software supply chain attacks, allegedly creating malicious open-source software that hit thousands of global businesses. KrebsOnSecurity had identified the 21-year-old suspect in June and had been in contact with him.

Krebs on Security · 21d agoPolicy & legal

Kids’ online safety bill faces dim prospects of passage this session despite progress

Kids Online Safety Act clears Senate committee but passage looks unlikely this session amid House-Senate deadlock over the duty-of-care provision.

KOSA advanced out of the Senate Commerce Committee, but the chambers remain split on a duty-of-care provision requiring platforms to act with reasonable caution to prevent foreseeable harm, which House leadership opposes over First Amendment and negligence-lawsuit concerns. The Senate passed KOSA 91-3 last Congress before it died in the House, and the House passed its own version without the duty of care in June as part of a larger package, after stripping a state-law preemption provision. Observers say even Senate passage this year is a struggle given the short calendar, with a lame-duck window between November and January the more plausible path, and Majority Leader John Thune controlling whether a roll-call vote happens.

The Record · 24d agoPolicy & legal

Retail theft bill spurs ‘very large and very dangerous’ surveillance fears

The Combating Organized Retail Crime Act advances toward Senate attachment to the defense bill, drawing ACLU warnings of expanded ICE surveillance powers.

The Combating Organized Retail Crime Act (CORCA) passed the House 348-60 in June, and Senate supporters including Chuck Grassley are pushing to attach it to the annual defense policy bill. The bill would create an Organized Retail and Supply Chain Crime Coordination Center within ICE's Homeland Security Investigations, add criminal penalties for laundering stolen-goods proceeds with a $5,000 charging threshold, and broaden data sharing with retailers. The ACLU, NAACP LDF, and allied groups warn the vaguely drafted provisions would effectively grant DHS access to retail surveillance feeds such as cameras and license plate readers, while industry backers say it only enhances existing information sharing and could help fight cyber-enabled crime.

CyberScoop · 27d agoPolicy & legal1