ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “security update”

24 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 183Advisory 178Vulnerability 157Industry 66Malware 61Threat actor 53AI safety & security 43Tools 39Data breach 35Phishing & fraud 29Research 25AI industry 24Policy & legal 24Model release 7
SeverityAllcritical 82high 349medium 231low 53info 223

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business News · 22d agoPolicy & legal1

Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security

CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.

CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.

Checkmarx · 7d agoPolicy & legal

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News · 13d agoPolicy & legal

Wyden seeks upgraded NSA security guidance on commercial VPN use

Senator Ron Wyden asked the NSA to update public guidance on commercial VPN security risks and answer questions about foreign surveillance threats against single-hop VPNs.

Sen. Ron Wyden sent a letter to NSA Director Gen. Joshua Rudd urging the agency to revise public guidance on commercial VPNs, following earlier letters to federal agencies in March and July. He argues single-hop VPNs offer little protection against sophisticated adversaries able to compel or compromise the single provider, citing a Congressional Research Service paper favoring multi-hop and mixnet architectures. The letter references a September NSA advisory on a China-sponsored campaign against telecom, government and military networks and asks unclassified questions about multi-hop systems such as Apple Private Relay, Tor and Nym versus mixnets.

CyberScoop · 14d agoPolicy & legal

EU's Cyber Resilience Act starts the 24-hour vulnerability clock

EU Cyber Resilience Act reporting rules take effect, requiring manufacturers to disclose actively exploited vulnerabilities to ENISA within 24 hours, with fines reaching €15 million.

The Cyber Resilience Act's Article 14 mandatory reporting duties became applicable, requiring makers of products with digital elements sold in the EU — regardless of where they are based — to file an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, and a final report within 14 days of releasing a fix. Reports must be submitted through ENISA's Single Reporting Platform to the designated CSIRT, and non-compliance with these core duties can trigger fines up to €15 million or 2.5 percent of annual turnover. Manufacturers must also inform affected users of available fixes without undue delay, and most remaining CRA provisions, including mandatory SBOMs and security-by-design requirements, become applicable on December 11, 2027.

The Register · Security · 6d agoPolicy & legal

Risky Bulletin: Two TeamPCP members arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.

The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.

Risky Business News · 20d agoPolicy & legal in the wild1

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News · 17d agoPolicy & legal

CISA decides weekly vulnerability bulletin isn't necessary anymore

CISA will discontinue its weekly vulnerability bulletin on September 28, pushing users toward KEV, alerts, and CVE data under risk-based prioritization.

CISA announced its weekly vulnerability bulletin will stop on Monday, September 28, as part of a shift from static CVSS severity scores to a modern, risk-based approach detailed in a June Binding Operational Directive. The directive prioritizes federal remediation based on exposure, exploitation evidence, control granted by exploitation, and whether exploitation can be automated. CISA directs bulletin subscribers to rely instead on its Known Exploited Vulnerabilities catalog, cybersecurity alerts and advisories, and the CVE catalog, requiring users to enable those subscriptions in GovDelivery or Granicus to avoid missing critical notices.

The Register · Security · 17h agoPolicy & legal

CISA review makes the case for eliminating vulnerability classes

CISA's FY2024-2025 vulnerability review urges eliminating recurring vulnerability classes, finding 41.5% of 2025 KEV entries map to persistent 'stubborn weaknesses'.

CISA's Vulnerability Review for fiscal years 2024 and 2025 found most compromises stemmed from opportunistic exploitation of known, exposed vulnerabilities rather than nation-state zero-days or advanced tradecraft. The review found 41.5% of 2025 KEV catalog entries map to 'stubborn weaknesses' - injection flaws, improper input validation, memory-safety failures, path traversal and broken access control - recurring on the CWE Top 25 since 2019. CISA advocates Secure by Design practices, vulnerability class elimination, and buyer-driven 'Secure by Demand' contract requirements, while warning that AI-enabled vulnerability discovery will soon accelerate exploitation.

Help Net Security · 16d agoPolicy & legal

Why APAC Enterprises Need Real-Time Threat Intelligence as Singapore, Malaysia, and Thailand Tighten Cyber Compliance in 2026

Singapore, Malaysia, and Thailand all tightened cyber compliance in 2026, mandating continuous monitoring and rapid incident reporting for critical infrastructure.

Singapore's CSA issued the Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026, adding board cyber-resilience duties, annual training, and controls on Interconnected Systems, with most obligations effective by 29 July 2027. Malaysia's Cyber Security Act 2024 requires NACSA-licensed providers, audits, and fast incident notification, with fines up to RM500,000 and up to ten years' imprisonment. Thailand's NCSA cloud security standard has been enforced since 10 September 2026, with a Website Security Standard effective 16 September 2026. The vendor article argues detection speed has become a compliance metric driving demand for real-time threat intelligence.

Cyble · 4h agoPolicy & legal

U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks

The U.S. State Department offered up to $10 million for information on Amir Yaryab, an IRGC cyber chief linked to critical infrastructure attacks.

The U.S. State Department's Rewards for Justice program offers up to $10 million for information identifying or locating Amir Yaryab, who allegedly oversees the Cyber Operations Command of Iran's IRGC Cyber-Electronic Command (IRGC-CEC). Officials tie him to units called Shahid Hemmat and Shahid Shushtari conducting cyber and information campaigns against defense, telecommunications, energy, and finance sectors across the US, Europe, and the Middle East, and to groups including CyberAv3ngers and Dadeh Afzar Arman. CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024.

Cyber Security News · 9d agoPolicy & legal

Cyber Essentials Has Record Year but Takeup Remains Low

UK Cyber Essentials certifications hit a record 61,430 in the year to June 2026, up 20%, but uptake remains low among 5.7 million SMEs.

The UK government awarded a record 61,430 Cyber Essentials certificates between July 2025 and June 2026, a 20% year-over-year increase, including 46,245 basic self-assessed and 15,185 audited CE+ certifications. Roughly three-quarters were recertifications, and uptake remains low against an estimated 5.7 million UK SMEs. An ESET survey found 49% of UK SMEs suffered a cyber incident in the past year, while the Cyber Resilience Pledge and the Cyber Security and Resilience Bill aim to push certification through supply chains.

Infosecurity Magazine · 1h agoPolicy & legal

Trump Targets Foreign Technology in New U.S. Power Grid Security Order

Trump's Executive Order 14420 declares a national emergency to restrict foreign-made bulk-power grid equipment over cyber, sabotage and supply-chain risks.

Executive Order 14420, signed August 26, declares a national emergency regarding the foreign supply of bulk-power system electric equipment to the United States. It empowers the Energy Secretary to restrict transactions with designated Covered Foreign Entities involving equipment, software, firmware, digital services, maintenance services, and remote-access capabilities. Covered equipment includes transformers, generators, inverters, RTUs, PLCs, intelligent electronic devices, and protective relays, with transmission rated 69 kV or higher in scope while local distribution is excluded. Already-installed foreign equipment may be subject to identification, isolation, monitoring, or replacement requirements, with phased compliance and pre-qualified vendor exemptions permitted.

Security Affairs · 19d agoPolicy & legal

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business News · 28d agoPolicy & legal1

UK government seeks powers to secretly block risky tech suppliers

UK amendments to the Cyber Security and Resilience Bill would let ministers secretly ban risky tech suppliers across critical sectors.

The UK government published amendments to the Cyber Security and Resilience Bill creating 'vendor-related directions' that allow ministers to order companies in critical sectors to stop buying from a supplier, restrict its products, or remove installed equipment on national security grounds. The powers extend beyond telecoms to managed service providers, data centers, digital infrastructure and the energy, water, transport and health sectors, adapting the mechanism used to restrict Huawei in UK 5G while removing some transparency safeguards. Ministers would not have to publicly name the vendor, could withhold details on national security or commercial grounds, and could bar recipients and consultees from discussing the orders, though the government would report annually to Parliament on directions issued. The amendments will be considered at committee stage in the House of Lords in September.

The Record · 22d agoPolicy & legal

Confused about which VPN is right, US senator asks the NSA for guidance

Senator Ron Wyden asked the NSA to update public guidance on VPN configurations, questioning single-hop designs and services like Tor.

Sen. Ron Wyden (D-Ore.) sent a letter Wednesday to NSA director Gen. Joshua Rudd requesting updated public guidance on VPN best practices for Americans facing advanced foreign threats, including government personnel, contractors, and journalists. The letter highlights limitations such as decrypted traffic at single-hop termination servers, metadata like timestamps enabling nation-state profiling, and asks the NSA to assess multi-hop architectures, random delays, cryptographic padding, and specific services including Apple Private Relay, Nym, and Tor.

Ars Technica · Security · 13d agoPolicy & legal

Australia is replacing the Essential Eight with a new cyber framework. Here’s how exposure management can help you get ahead of it.

Australia's ASD is replacing the Essential Eight with an outcomes-based Essentials series covering IT, cloud, OT and likely agentic AI, with deprecation from mid-2027.

The Australian Signals Directorate announced in June 2026 that the Essential Eight will be replaced by an outcomes-focused Essentials series structured as chapters covering enterprise IT (including identity and SaaS), cloud, OT, and likely agentic AI. Deprecation begins around mid-2027 with full retirement around mid-2028, though timelines are targets; the Essential Eight is mandatory for roughly 98 non-corporate Commonwealth entities but voluntary for private firms. Tenable argues the shift demands continuous security posture evidence via exposure management rather than point-in-time checklist assessments.

Tenable Blog · 2d agoPolicy & legal1

Bipartisan Senate bill aims to prepare energy sector for Q

Bipartisan Senate bill would direct FERC to factor quantum computing threats and post-quantum cryptography into US electric grid cybersecurity reliability standards.

The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Senators Mike Rounds and Chris Coons, would require FERC to consider quantum computing threats when reviewing electric reliability standards and to explore post-quantum cryptography use in both IT and OT systems, plus a technical sandbox to study quantum impacts. It aligns with NIST's post-quantum algorithm work, and a June executive order moved the federal PQC migration deadline from 2035 to 2030. Industry experts noted the hard part is upgrading infrastructure such as SCADA communications and software update integrity ahead of those deadlines.

CyberScoop · 23d agoPolicy & legal

Delaware Consumer Privacy and Data-Breach Law Updates

Delaware's governor signed HB 380 and HB 381 amending the state privacy act and breach notification law.

On September 2, 2026, Delaware's Governor signed House Bill 380 and HB 381. HB 380 amends the Delaware Personal Data Privacy Act (DPDPA), enacted in 2023 and effective January 1, 2025. HB 381 separately amends Delaware's computer security breach notification law. Joseph J. Lazzarotti of JacksonLewis summarizes the changes.

DataBreaches.net · 3d agoPolicy & legal

Nearly half of enterprises have no one leading PQC migration

Axiad survey finds 46% of enterprises lack a single leader for post-quantum cryptography migration despite most maintaining cryptographic inventories.

Axiad research on post-quantum cryptography (PQC) readiness found 75% of respondents maintain continuously updated inventories of certificates, keys, and algorithms, but 46% have no single person owning the migration. About half have never formally assessed whether public-facing infrastructure supports post-quantum key exchange. 67% said the harvest-now-decrypt-later threat is an active priority, with competing priorities, budget constraints, and lack of regulatory guidance cited as top obstacles; executives were more confident than PKI practitioners.

Help Net Security · 27d agoPolicy & legal

‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

White House launches Watershed 250, a six-month Texas pilot using volunteer vendor cyber and AI tools to harden water utility defenses.

The Office of the National Cyber Director and Texas Cyber Command will oversee the six-month Project Watershed 250 pilot to improve water sector cybersecurity through industry-donated red teaming, system hardening and AI tooling. Twelve companies including Microsoft, Fortinet, Google Cloud, Palo Alto Networks, AWS, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos participated in the rollout. Officials cited recent attacks including an Iranian-backed campaign against 30 water systems in 12 states and a 2024 incident in Muleshoe, Texas. Some water-security professionals criticized the program as lacking dedicated funding.

CyberScoop · 16d agoPolicy & legal1

White House bans foreign-made equipment for power generation over cyber backdoor concerns

Trump executive order bans acquisition of foreign-made bulk-power system equipment over cyber backdoor and supply-chain concerns for US electricity infrastructure.

The White House issued an executive order declaring foreign-made bulk-power system electric equipment an "unusual and extraordinary threat," banning its acquisition or installation in the US. The order covers technology managing transmission lines rated at 69,000 volts or higher, substations, control rooms, power generating stations, reactors, and associated remotely accessible software and firmware. It follows recent cyberattacks on water utilities in at least 12 states, malicious activity targeting over 100 internet-exposed water and wastewater systems, and an NSA/FBI advisory on an AI-powered threat to operational technology. The Defense, Commerce, and Energy Departments have 120 days to create rules, identify countries warranting scrutiny, and inventory at-risk equipment.

The Record · 20d agoPolicy & legal

Grindr settles HIV status data-sharing lawsuit for $35 million

Grindr agreed to pay about $35 million to settle a UK privacy suit alleging it shared users' HIV status and sensitive data with advertisers without consent.

The claim, brought by London firm Austen Hays on behalf of roughly 12,000 UK users, alleges Grindr breached privacy and data-protection laws during a period ending in early 2020, when it was owned by Beijing Kunlun Tech. Shared data may have included ethnicity, HIV status, last HIV test date, and PrEP use. Per an SEC filing, Grindr will make two payments of £13 million (totaling about $35 million), one by December 31, 2026 and one by March 31, 2027, without admitting liability. The settlement follows a Norwegian Data Protection Authority enforcement finding over ad sharing without a valid legal basis.

Malwarebytes Labs · 9d agoPolicy & legal

Peers ask why UK cyber bill leaves execs off the personal liability hook

UK peers propose amendments to the Cyber Security and Resilience Bill adding personal executive liability and board-level cyber responsibility; government defends fines-only approach.

Baronesses Kidron and Ludford backed amendments to the UK Cyber Security and Resilience Bill that would introduce personal civil liability for senior executives and mandate board-level cybersecurity responsibility, citing NIS2 and financial-sector accountability rules. Cybersecurity minister Baroness Lloyd defended the bill's existing regime of fines up to £17 million or 4% of annual turnover, with governance requirements to come via secondary legislation. Peers also debated the bill's 24-hour and 72-hour incident reporting requirements, with Baroness Harding proposing an additional 14-day intermediate report and a one-month final report.

The Register · Security · 10d agoPolicy & legal