ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “analysis”

19 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 4967Vulnerability 3709Ransomware 3251Exploit / PoC 1738Threat actor 1576Data breach 1315Industry 1160Policy & legal 987Phishing & fraud 924Research 287AI safety & security 202AI tools & infra 171AI research 144Advisory 121
SeverityAllcritical 7238high 6263medium 4474low 2119info 733

25 Years of Mass Surveillance Is Enough

Bruce Schneier and Cindy Cohn argue post-9/11 mass surveillance expanded far beyond its counterterrorism justification and should be reevaluated for costs to rights.

An essay by Bruce Schneier and Cindy Cohn (originally in Lawfare) traces the post-9/11 shift from targeted surveillance to mass collection of telephone and internet metadata. It cites the Section 215 bulk phone records program, struck down in interpretation by the Second Circuit in 2015 and curtailed by the USA Freedom Act, and the NSA's Upstream program under Section 702 of the 2008 FISA Amendments Act, which ended content searches in 2017. The authors note mass surveillance now serves routine law enforcement and immigration actions, with FBI Director Kash Patel confirming purchases of Americans' data from brokers, and private systems like Flock license plate readers and venue facial recognition feeding government access.

Schneier on Security · 2d agoPolicy & legal

What the 3M ChatGPT case reveals about AI governance

3M litigation shows ChatGPT prompts can become discoverable evidence, forcing enterprises to govern AI conversation records.

In the Watson Grinding explosion litigation, an engineering expert retained by 3M had used ChatGPT, and a surfaced prompt asked the system to 'show how 3M is 0% at fault'; after an off-record deposition demand, more than 350 pages of previously unproduced ChatGPT material were provided. The author argues AI interaction histories are becoming part of decision records and discovery material, a trend the American Bar Association has already examined. Enterprises are urged to manage retention, ownership, sharing, and deletion of AI conversation logs across tools like ChatGPT, Copilot, Claude, and Gemini.

CSO Online · 3d agoPolicy & legal

Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security

CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.

CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.

Checkmarx · 7d agoPolicy & legal

The Government is Monitoring Anti

Fusion center bulletins reveal US law enforcement monitoring anti-Flock social media accounts and warning police ahead of the DeFlock Week of Action against license plate readers.

Public records requests by 404 Media and journalist Dan Boguslaw exposed intelligence bulletins from fusion centers in Colorado, Wisconsin, and Florida tracking anti-Flock sentiment, camera vandalism videos, and the DeFlock National Week of Action against automated license plate readers scheduled for August 16-22. The bulletins highlight Instagram accounts like Nomark.Project posting daily camera takedowns, and a device found during a June 25 traffic stop that could locate Flock cameras. Police are advised to increase patrols around ALPR locations and warned about upcoming DeFlock events, including 11 Florida cities signed up. DeFlock creator Will Freeman said the project never called for vandalism and that over 100 surveillance contracts have been canceled through civic engagement.

404 Media · Aug 12, 2026Policy & legal1

Flock camera use by internal affairs unit puts DC police at odds with officers’ union

DC's Metropolitan Police Department used Flock license plate cameras to track officers under internal affairs investigation, prompting a union grievance and council scrutiny.

The DC Police Union learned in July 2026 that MPD Internal Affairs used Flock ALPR cameras to monitor officers under investigation without their knowledge, filing a grievance that management denied. Secure Justice found more than 90 US cities and counties ended Flock contracts in August 2026 alone, with over 200 terminations since 2021, while Texas and Florida announced new usage restrictions. On September 14, DC Councilmember Brooke Pinto asked Interim Chief Jeffery Carroll ten questions about the department's use of Flock data.

The Record · 23h agoPolicy & legal

You don’t have to join the hack-back program to inherit its risk

A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.

The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.

CSO Online · 1d agoPolicy & legal

Cyberattack causes a flight delay? Airlines won’t owe you a hotel or meal

A new DOT rule exempts airlines from providing meal vouchers or hotels for cyberattack-caused delays if carriers comply with applicable cybersecurity regulations.

A Department of Transportation rule published in September 2026 adds "cybersecurity attacks" to a list of 10 "not controllable" flight disruption causes, creating a new delay tracking category and relieving compliant airlines of customer service obligations like meal vouchers and hotels. The rule stems from the FAA Reauthorization Act of 2024 and applies only when carriers demonstrate compliance with applicable cybersecurity regulations. Consumer groups reacted cautiously: FlyersRights criticized the lack of public comment, while the National Consumers League saw both certainty benefits and risks from ambiguous wording. The article cites prior aviation incidents including Scattered Spider's airline attacks and the 2024 Collins Aerospace hack that disrupted European flights.

CyberScoop · 5d agoPolicy & legal

FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors

The FBI published its first-ever Cyber Strategy on September 9, outlining four pillars for investigating and disrupting cyber threat actors and supporting victims.

The FBI's Cyber Strategy, published September 9, defines four pillars: investigate and impose costs on cyber adversaries, support victims, expand partnerships, and enhance the agency's cyber capabilities. It reflects a broader US shift toward proactive disruption, building on an August memorandum signed by President Trump authorizing collaboration with private firms on offensive cyber operations. The strategy includes expanding the Industrial Control Systems Coordinator program to every field office and deploying AI-enabled tools for triage, malware analysis, and attribution.

Infosecurity Magazine · 7d agoPolicy & legal

FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

FBI officials said AI is accelerating adversary capabilities while its new cyber strategy emphasizes continuous patching, cyber hygiene, and AI-enabled defense.

At the Billington CyberSecurity Summit and ahead of a new FBI cyber strategy, deputy assistant director Jason Bilnoski said AI is boosting the speed and capability of both criminal and nation-state attackers, while stressing that basic controls like MFA would still prevent most attacks. Colleen Ferranti urged a shift from quarterly Patch Tuesday cycles to continuous, risk-based patching as AI accelerates vulnerability discovery. The strategy pledges AI-enabled triage, malware analysis, attribution support, agentic AI adoption, expanded Computer Network Operations, ICS Coordinators in every field office, and a pledge on victim relief and privacy.

CyberScoop · 8d agoPolicy & legal

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputer · 8d agoPolicy & legal

CIA official touts agency’s Cyber Mission Center in capture of Venezuela’s Maduro

CIA deputy director credits the Cyber Mission Center's cyber operations for the intelligence picture behind Nicolás Maduro's capture.

CIA Deputy Director Michael Ellis said at the Billington Cybersecurity Summit that cyber operations built the 'flawless intelligence picture' enabling US special forces to locate Nicolás Maduro in his Caracas bunker and apprehend him within four minutes of landing during January's Operation Absolute Resolve. Director John Ratcliffe elevated the Center for Cyber Intelligence to a standalone mission center, which Ellis said smooths reporting chains and aligns resources. Ellis also said AI will 'permeate' every aspect of intelligence work, with human-in-the-loop safeguards and multi-vendor approaches to avoid model lock-in. The US has unsealed narcoterrorism charges against Maduro and his wife, who are seeking dismissal under immunity claims.

The Record · 8d agoPolicy & legal 2 sources

Where the backlash against Flock Safety is having the biggest impact

More than 90 cities ended Flock Safety contracts in August as Texas and Florida restrict license plate reader use amid privacy protests.

Over 90 cities and counties terminated Flock Safety contracts in August, per Secure Justice, which has tracked more than 200 municipal terminations since 2021. Texas Gov. Greg Abbott barred state agencies from funding Flock cameras on Aug. 28 after a report that a state agency secretly diverted $30 million; Florida's transportation department banned ALPRs on state highways and Gov. Ron DeSantis criticized the technology. Los Angeles chose not to renew its LAPD contract over data-ownership terms, and Atlanta's mayor ordered a 30-day review of the roughly 5,000 ALPR cameras in the metro area. Several Flock-related police abuse cases, including a Texas officer indicted on 100 felony counts, have fueled the backlash.

The Record · 8d agoPolicy & legal

A Secretive DHS ‘Predictive Policing’ Unit is Analyzing Americans’ Financial Habits and Pulling Them Over

404 Media reveals DHS Border Patrol's secretive Predictive Intelligence Targeting Teams (PITT) analyzing Americans' financial activity and feeding intelligence to local police for traffic stops.

404 Media identified Predictive Intelligence Targeting Teams (PITT) in the Spokane Sector (Washington) and Laredo Sector (Texas), which review law enforcement-sensitive databases including Americans' financial activity and pass intelligence to local police. In one case, a PITT analyst flagged financial patterns associated with narcotics activity, leading Montana Highway Patrol to stop a driver for an obstructed license plate and charge him with DUI and possession with intent to distribute. CBP declined to say what financial data is monitored or whether warrants are obtained; the program extends AP's earlier reporting on ALPR-based predictive policing.

404 Media · 9d agoPolicy & legal

UK's Online Safety Act has made 'absolutely no difference,' kids say

UK Children's Commissioner tells Lords committee the Online Safety Act has 'made absolutely no difference' and criticizes Ofcom over risk assessment transparency.

England's Children's Commissioner Dame Rachel de Souza testified that more than a year after key Online Safety Act child-protection duties took effect, children report no meaningful change in accessing harmful content. She criticized Ofcom for refusing to share companies' safety risk assessments under section 393(1) of the Communications Act 2003, and planned to use statutory powers to compel disclosure. She argued the OSA has not kept pace with AI-driven harms (citing the 'Grok nudifying' controversy) and urged Ofcom to 'use its teeth,' contrasting the UK's approach with Meta's proposed $18 billion US child-safety settlement.

The Register · Security · 14d agoPolicy & legal1

CMMC Hit Pause, the FAR Council Hit Play

DoD paused CMMC Phase 2 pending a 60-day review while a proposed FAR Council rule would extend NIST 800-171 Rev 3 to all federal contractors.

The Department of Defense suspended CMMC Phase 2 third-party certification requirements, but Phase 1 self-assessments under DFARS 252.204-7021 remain in force since November 2025, and prime contractors are still directing suppliers to proceed. A CMMC Reform Task Force must report recommendations to the DoD CIO within 60 days, likely by September or October 2026. Separately, the FAR Council's proposed CUI rule from June 23 would apply NIST 800-171 Revision 3, 72-hour incident reporting, and flowdown obligations to all FAR-based federal contracts, not just the defense industrial base. False Claims Act exposure grows as DIBCAC assessment teams now cooperate directly with the DOJ.

Huntress · 14d agoPolicy & legal

Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

US DoJ charged extradited Russian Searzhudin Aktulaev for a 2016-2017 Excel macro campaign infecting ~80,000 freelance platform users with TVRAT and DarkVNC.

Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited to the US on August 28, facing charges including wire fraud conspiracy and aggravated identity theft. The indictment alleges ~255 fake freelance-platform accounts were used to send Excel macro attachments to about 80,000 users in 2016-2017, deploying TVRAT (TeamSpy/TVSPY) and DarkVNC RATs for remote access and data theft. Thousands of infected machines called back to a US-hosted C2 domain, with stolen credentials and PII stored in the shared email account used in the scheme.

The Hacker News · 15d agoPolicy & legal

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

U.S. Treasury sanctioned nearly 60 Iran-linked entities, including MOIS-affiliated Mabna Institute hackers behind breaches of U.S. critical infrastructure and millions in crypto theft.

The U.S. Treasury launched Operation Economic Outcast, designating nearly 60 Iran-linked entities, individuals, and vessels across nuclear, missile, oil, cyber, and digital asset networks. Five sanctioned individuals are members of the Tehran-based Mabna Institute indicted last week; three allegedly breached and exfiltrated data from U.S. energy, defense, healthcare, IT, and financial organizations since late 2023. TRM Labs traced roughly $16.8 million across 30 wallets tied to the members, and the State Department announced a reward of up to $10 million. The action follows Iranian hacking of FBI Director Kash Patel's email and attacks on over 30 U.S. water and wastewater utilities.

The Hacker News · 22d agoPolicy & legal in the wild

Brazil orders Discord to suspend livestreaming after teen suicide

Brazil's data protection authority orders Discord to disable its Go Live livestreaming feature nationwide until child-safety safeguards are demonstrated.

Brazil's National Data Protection Authority (ANPD) found robust evidence that Discord failed to protect children from harmful content and ordered the Go Live feature suspended until effective safeguards are shown, following the July death of a 13-year-old girl during a roughly 45-minute livestream; five teenagers were arrested. Discord has three business days to implement the suspension and could face fines of up to 50 million reais (about $10 million) per violation. Regulators criticized the March addition of end-to-end encryption to Go Live for limiting real-time content detection, and are also investigating Discord's age-verification and content-removal practices, while a parallel probe tied neo-Nazi recruitment communities to Telegram.

The Record · Aug 13, 2026Policy & legal

Germany moves to give spy agencies hacking and sabotage powers

Germany's cabinet approved a 732-page bill granting BND and BfV intelligence agencies new hacking, sabotage, and disinformation powers pending parliamentary approval.

Germany's cabinet approved draft legislation that would give the foreign intelligence service BND and domestic agency BfV active operational powers, including hacking foreign systems, sabotaging supply chains with faulty components, disabling servers of hostile state-sponsored hackers, and feeding false information to extremists inside Germany. The 732-page bill, the largest overhaul of postwar German spy laws, requires telecom carriers and digital providers to assist the agencies, bars measures endangering life, and imposes new statutory controls on how agencies use AI analysis, including judge-supervised spot checks of machine-generated outputs. The reforms stem from a Federal Constitutional Court ruling on surveillance proportionality and are expected to pass parliament, with the government aiming for the law to take effect next year; civil liberties groups plan to challenge it.

The Record · Aug 13, 2026Policy & legal