55
Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
UK government seeks powers to secretly block risky tech suppliers
UK amendments to the Cyber Security and Resilience Bill would let ministers secretly ban risky tech suppliers across critical sectors.
The UK government published amendments to the Cyber Security and Resilience Bill creating 'vendor-related directions' that allow ministers to order companies in critical sectors to stop buying from a supplier, restrict its products, or remove installed equipment on national security grounds. The powers extend beyond telecoms to managed service providers, data centers, digital infrastructure and the energy, water, transport and health sectors, adapting the mechanism used to restrict Huawei in UK 5G while removing some transparency safeguards. Ministers would not have to publicly name the vendor, could withhold details on national security or commercial grounds, and could bar recipients and consultees from discussing the orders, though the government would report annually to Parliament on directions issued. The amendments will be considered at committee stage in the House of Lords in September.
58
I Think the Military Commissary Freezers Were Hacked
Refrigeration failures at six-plus US military commissaries prompt speculation of a cyber attack on DeCA's remote monitoring systems; Pentagon acknowledges possible disruption.
The author documents near-simultaneous freezer and refrigeration failures at confirmed installations including Fort Huachuca, F.E. Warren AFB, Fort Irwin and Travis AFB on August 26-27, with freezers entering defrost mode that heated and spoiled food. DeCA's Remote Monitoring Control System controls defrost across roughly 182 locations, and an unverified comment attributed the Fort Huachuca failure to a network issue. Stars and Stripes and Military Times independently reported the multi-base failures, and the Pentagon acknowledged a 'possible refrigeration disruption,' though no evidence of hacking has been confirmed.
45
White House authorizes private US companies to hack foreign criminal networks
Trump memorandum authorizes vetted private US companies to conduct government-supervised offensive cyber operations against foreign criminal networks.
The National Security Presidential Memorandum signed August 12 lets vetted private companies run offensive cyber operations against transnational criminal organizations behind ransomware, phishing and sextortion, under US government oversight. The Homeland Security Task Force's National Coordination Center, led by DOJ and DHS executive directors, must give written approval for both Cyber Surveillance Operations and Cyber Effects Operations. Participating companies must post a $1 million bond or escrow, undergo annual review, and notify authorities if they unintentionally target US persons or systems.
68
CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok
CISA, NSA and FBI advisory says six Chinese AI firms extracted billions of tokens from Claude, GPT, Gemini and Grok via API proxies since late 2024.
A joint advisory from CISA, NSA and FBI alleges China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI harvested billions of tokens across millions of exchanges from Claude, GPT, Gemini and Grok variants since late 2024. Operators allegedly used API proxy 'transfer stations', account pools, bulk premium subscriptions and prompt injection or jailbreak-style requests to force models to reveal chain-of-thought reasoning. DeepSeek's R1 and V3 and Moonshot's Kimi-K2 and Kimi-K3 models reportedly benefited from the extracted data. CISA urged providers to add identity checks, monitor subscription-to-usage ratios, rate limit, and share infrastructure signals with cloud platforms.
72
Trump Targets Foreign Technology in New U.S. Power Grid Security Order
Trump's Executive Order 14420 declares a national emergency to restrict foreign-made bulk-power grid equipment over cyber, sabotage and supply-chain risks.
Executive Order 14420, signed August 26, declares a national emergency regarding the foreign supply of bulk-power system electric equipment to the United States. It empowers the Energy Secretary to restrict transactions with designated Covered Foreign Entities involving equipment, software, firmware, digital services, maintenance services, and remote-access capabilities. Covered equipment includes transformers, generators, inverters, RTUs, PLCs, intelligent electronic devices, and protective relays, with transmission rated 69 kV or higher in scope while local distribution is excluded. Already-installed foreign equipment may be subject to identification, isolation, monitoring, or replacement requirements, with phased compliance and pre-qualified vendor exemptions permitted.
65
12 Best Browser Isolation Solutions Compared (2026): Features & Pricing
2026 comparison ranks Zscaler, Cloudflare, Menlo Security, Garrison (Everfox), Authentic8 and Kasm among twelve remote browser isolation solutions.
Guide compares twelve RBI products across four architectures: pixel streaming, DOM/vector reconstruction, platform-embedded SSE isolation, and self-hosted containers. Zscaler and Cloudflare lead RBI delivered inside SSE platforms, while Menlo Security leads isolate-everything efficacy and Garrison (Everfox) provides hardware-grade isolation for government use. Most offerings price per user per month.
12
You don’t have to join the hack-back program to inherit its risk
A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.
The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.
52
DeepSeek, Alibaba and Chinese AI Firms Extract Billions of Tokens From U.S. AI Models
NSA, CISA and FBI advisory AA26-251A accuses DeepSeek, Alibaba and four other Chinese AI firms of industrial-scale distillation of US frontier models.
Joint advisory AA26-251A from NSA, CISA and FBI accuses DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI of extracting billions of tokens from Claude, GPT, Gemini and Grok variants since at least late 2024, likely with Chinese government awareness. Campaigns allegedly used API proxy 'transfer stations', account pools, metadata sanitization and prompt injection to harvest reasoning, coding, agentic and reinforcement-learning capabilities, with techniques mapped to MITRE ATLAS. DeepSeek's R1 and V3 and Alibaba's Qwen families reportedly trained on harvested outputs, and DeepSeek's $5.6 million training-cost claim is disputed as excluding distilled data value. Agencies urge anomaly monitoring, output alteration for suspected extractors, and intelligence sharing across vendors, clouds and aggregators.
72
Nigeria Looks to Sovereign Cloud for Cyber, National Security
Nigeria launches financing, procurement, and infrastructure policies to build a sovereign cloud for cyber and national security.
Nigeria has introduced financing, procurement, and infrastructure policies to accelerate its sovereign cloud initiative. The program aims to keep government data under national control and expand domestic technical expertise. It is framed as part of a broader effort to strengthen cyber and national security capabilities in West Africa's largest economy.
20
Anthropic: AI Misuse Is Entering a New Phase: From Cybercrime to Surveillance, Propaganda and Weapons
Anthropic's threat intelligence report documents AI misuse scaling cybercrime, surveillance, propaganda, and weapons development from December 2025 to August 2026.
Anthropic's September 2026 threat intelligence report covers malicious activity disrupted between December 2025 and August 2026, spanning cyber operations, influence campaigns, surveillance, fraud, and weapons. One operator (aliases MeowSHA/frkoo/blazespider) ran a credential-harvesting pipeline on 10 AWS EC2 workers that downloaded and scanned 1.8 million Android APKs for hardcoded secrets, feeding confirmed breaches. Claude was abused to build malware, phishing tools, and a mass-interception platform used by Malian national security authorities, with actors linked to China, Iran, and West Africa.
65
Germany moves to give spy agencies hacking and sabotage powers
Germany's cabinet approved a 732-page bill granting BND and BfV intelligence agencies new hacking, sabotage, and disinformation powers pending parliamentary approval.
Germany's cabinet approved draft legislation that would give the foreign intelligence service BND and domestic agency BfV active operational powers, including hacking foreign systems, sabotaging supply chains with faulty components, disabling servers of hostile state-sponsored hackers, and feeding false information to extremists inside Germany. The 732-page bill, the largest overhaul of postwar German spy laws, requires telecom carriers and digital providers to assist the agencies, bars measures endangering life, and imposes new statutory controls on how agencies use AI analysis, including judge-supervised spot checks of machine-generated outputs. The reforms stem from a Federal Constitutional Court ruling on surveillance proportionality and are expected to pass parliament, with the government aiming for the law to take effect next year; civil liberties groups plan to challenge it.
65
Claude Mythos only model to complete full cyber kill chain, experts say
Booz Allen's Cyber Weapon Index finds only Claude Mythos completed an autonomous full cyber kill chain; mainstream AI-driven attacks deemed imminent.
Booz Allen's first Cyber Weapon Index tested 18 US and Chinese AI models on autonomous offensive cyber capability, combining vulnerability research and kill-chain attainment scores. Anthropic's Claude Mythos topped the index at 80 and was the only model to autonomously complete a full cyber kill chain, achieving administrator access with stolen credentials in every attempt and full domain compromise even without credentials; Grok-4.5 (49), GPT-5.6 Sol (46), Muse Spark 1.1 (38), and Kimi K3 (38) followed. All nine frontier API models scored zero against real-world bugs versus near-ceiling scores on planted ones, and pairing Claude Sonnet with a well-built attack harness rivaled Mythos' performance. Booz Allen predicts most tested models will reach Mythos' weaponization level within six months, calls AI-enabled mainstream attacks imminent, and urges sector-specific critical-infrastructure resilience deadlines and US cyber 'overmatch'.
79
US Authorizes Private Cyber Firms to Hack Transnational Criminal Networks
Trump signed a national security memorandum letting vetted private US cybersecurity firms run government-approved offensive cyber operations against transnational criminal organizations.
The August 13 memorandum creates a program managed by the National Coordination Center covering Cyber Surveillance Operations and Cyber Effects Operations against Cyber-Enabled Transnational Criminal Organizations, explicitly excluding entities that are parts of foreign governments. DOJ and DHS executive directors must co-approve every operation in writing, with extra authorization for operations raising laws-of-armed-conflict questions. Participating firms must pass vetting, annual evaluations and hold a $1 million bond or escrow. Operating procedures are due within 60 days, and the unresolved CFAA exemption question is addressed by requiring direct government control.
65
Private security firms will soon be allowed to hack overseas cybercriminals
A Trump administration memo authorizes private security firms to hack overseas cybercriminals, the first such private-sector authorization for cyberattacks.
The White House has authorized private-sector security firms to conduct offensive hacking operations against cybercriminals located overseas, per a Trump administration memo. Ars Technica reports this is the first time the government has authorized the private sector to perform cyberattacks. The move significantly expands the role of industry in offensive cyber operations.
60
Risky Bulletin: White House lets private companies carry out offensive cyber ops
A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.
A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.
65
Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense
Mexico's 2025-2030 Cybersecurity Plan sets a national roadmap to counter threats including ransomware and build durable cyber defenses.
Mexico published its 2025-2030 national Cybersecurity Plan, outlining the country's threat landscape — with ransomware highlighted as a key risk — and a roadmap for strengthening national cyber defenses. The plan defines priorities for building durable defensive capabilities over the five-year period.
25
Why APAC Enterprises Need Real-Time Threat Intelligence as Singapore, Malaysia, and Thailand Tighten Cyber Compliance in 2026
Singapore, Malaysia, and Thailand all tightened cyber compliance in 2026, mandating continuous monitoring and rapid incident reporting for critical infrastructure.
Singapore's CSA issued the Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026, adding board cyber-resilience duties, annual training, and controls on Interconnected Systems, with most obligations effective by 29 July 2027. Malaysia's Cyber Security Act 2024 requires NACSA-licensed providers, audits, and fast incident notification, with fines up to RM500,000 and up to ten years' imprisonment. Thailand's NCSA cloud security standard has been enforced since 10 September 2026, with a Website Security Standard effective 16 September 2026. The vendor article argues detection speed has become a compliance metric driving demand for real-time threat intelligence.
40
Learn How to Build Security Operations Ready for AI
Wiz sponsors a webinar on building AI-ready security operations, focusing on attack-path visibility, exposure prioritization, and faster detection-to-remediation workflows.
A contributed piece promotes next week's Wiz webinar, How to Build AI Threat Readiness Across Your Security Operations, featuring a Wiz expert. The session covers using unified security context to separate urgent exposures from noise, understand attack paths across cloud, code, identities, SaaS, and AI services, and connect validated risks to remediation owners.
12
Bipartisan Senate bill aims to prepare energy sector for Q
Bipartisan Senate bill would direct FERC to factor quantum computing threats and post-quantum cryptography into US electric grid cybersecurity reliability standards.
The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Senators Mike Rounds and Chris Coons, would require FERC to consider quantum computing threats when reviewing electric reliability standards and to explore post-quantum cryptography use in both IT and OT systems, plus a technical sandbox to study quantum impacts. It aligns with NIST's post-quantum algorithm work, and a June executive order moved the federal PQC migration deadline from 2035 to 2030. Industry experts noted the hard part is upgrading infrastructure such as SCADA communications and software update integrity ahead of those deadlines.
40
Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers
NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.
CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.
28
60
Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter
Joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs shows nation-state and criminal groups independently converge on the same edge infrastructure.
Tenable and SentinelOne jointly analyzed 93 CVE-actor attribution pairs covering exploitation of perimeter devices. The data shows state-sponsored and financially motivated actors independently target the same edge products from Ivanti, Fortinet, and Palo Alto Networks. The findings challenge the narrative that edge exploitation is exclusively a China-nexus nation-state problem, showing a broader shared attack surface.
62
North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs
ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.
ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.
50
America’s cyber strategy overlooks the infrastructure that actually keeps the military moving
Op-ed argues US cyber strategy underweights Iranian threats to ports, rail, utilities and other commercial infrastructure sustaining military operations.
The author, a former Navy intelligence officer, argues that a prolonged Iran conflict means sustained Iranian cyber operations targeting many smaller systems like water utilities, manufacturers and transportation providers. He cites mapping of 130 documented techniques across five Iranian threat groups and warns destructive attacks such as wipers and ransomware could hit the defense industrial base. The piece urges defensive wargames now and flags the pause in CMMC implementation as particularly concerning.
27
Help shape the future of resilient private 5G
The UK NCSC invites organizations to collaborate on developing secure, resilient and deployable private 5G network technologies.
The UK National Cyber Security Centre is seeking collaboration with organizations developing technologies and approaches for secure, resilient and deployable private 5G networks. The blog post is an open call to help shape future private 5G resilience.
15
Managing the cyber risk of agentic AI
UK NCSC guidance recommends safeguards, sandboxing, and active oversight to manage cyber risks of autonomous agentic AI systems.
The UK National Cyber Security Centre published guidance on managing the cyber risk of agentic AI systems. It recommends safeguards, sandboxing, and active human oversight to limit unintended autonomous activity while realizing the benefits of these systems. The publication is official national guidance for organizations deploying agentic AI.
40
EU chief wants joint response to cyberattacks, sabotage
EU Commission President von der Leyen proposed an Emergency Security Protocol letting any member state convene joint responses to cyberattacks and sabotage.
In her State of the Union address, Ursula von der Leyen proposed an Emergency Security Protocol, modeled on NATO Article 4, allowing a single EU member state to summon all 27 governments to coordinate responses to cyberattacks, sabotage, arson, and drone incursions. The proposal is part of a broader European security strategy that includes a European Security Council with partners such as the UK, Canada, Norway, and Ukraine, plus a European Instrument for Strategic Enablers supporting cyber and defense capabilities. She cited rising incidents in Denmark, Lithuania, Poland, and an attempted drone attack in Leipzig, but did not specify whether unanimous decision-making rules would change.
55
Zelensky appoints former police chief to lead Ukraine’s cyber coordination center
Zelensky appoints former police chief Ihor Klymenko to head Ukraine's National Cybersecurity Coordination Center amid broader security leadership reshuffle.
Ukrainian President Volodymyr Zelensky appointed Ihor Klymenko, former National Police head, interior minister, and NSDC secretary, to lead the National Cybersecurity Coordination Center (NCCC). The NCCC, created in 2016 under the National Security and Defense Council, coordinates government agencies' responses to major cyberthreats including Russian operations. The appointment comes amid a wider reshuffle of Ukraine's defense and security leadership.
15
Why federal cyber defense demands an offense-driven mindset
Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.
The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.
20
Is Cyber missing the Marque?
Cisco Talos analyzes the White House memorandum on private-sector participation in government-authorized offensive cyber operations.
A new White House memorandum addresses private sector participation in government-authorized offensive cyber operations. Cisco Talos's newsletter, introduced by new author Mick Baccio, explores the operational and security implications of this policy for the cybersecurity industry.
38