ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “National Instruments”

40 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 65Vulnerability 63Malware 60Policy & legal 51Threat actor 49Exploit / PoC 36Industry 32Data breach 20Phishing & fraud 16Advisory 10Research 10AI tools & infra 2AI safety & security 2AI research 1
SeverityAllcritical 201high 85medium 41low 79info 11

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

[Control Systems] National Instruments security advisory (AV26-856)

Canada's Cyber Centre relayed National Instruments advisories for memory corruption, out-of-bounds read, and out-of-bounds write flaws in LabVIEW versions.

The Canadian Centre for Cyber Security published control systems advisory AV26-856 covering National Instruments LabVIEW. Affected versions include releases before 23.0.0, 23.3.10, 24.3.7, 25.3.5, and 26.3.1. The flaws include memory corruption, an integer conversion out-of-bounds read, and an integer overflow out-of-bounds write. Users and administrators are urged to review the links and apply NI security updates.

Canadian Centre for Cyber Security · 19d agoAdvisory

[Control Systems] National Instruments security advisory (AV26-914)

Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.

Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.

Canadian Centre for Cyber Security · 5d agoAdvisory2

Trump Targets Foreign Technology in New U.S. Power Grid Security Order

Trump's Executive Order 14420 declares a national emergency to restrict foreign-made bulk-power grid equipment over cyber, sabotage and supply-chain risks.

Executive Order 14420, signed August 26, declares a national emergency regarding the foreign supply of bulk-power system electric equipment to the United States. It empowers the Energy Secretary to restrict transactions with designated Covered Foreign Entities involving equipment, software, firmware, digital services, maintenance services, and remote-access capabilities. Covered equipment includes transformers, generators, inverters, RTUs, PLCs, intelligent electronic devices, and protective relays, with transmission rated 69 kV or higher in scope while local distribution is excluded. Already-installed foreign equipment may be subject to identification, isolation, monitoring, or replacement requirements, with phased compliance and pre-qualified vendor exemptions permitted.

Security Affairs · 19d agoPolicy & legal

You don’t have to join the hack-back program to inherit its risk

A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.

The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.

CSO Online · 13h agoPolicy & legal

Trump taps cyber firms to go on offensive against criminals

Presidential memorandum allows vetted private companies to conduct offensive cyber operations against transnational cybercrime with advance DOJ and DHS approval.

A presidential memorandum released Wednesday lets vetted US companies partner with the Justice and Homeland Security departments on offensive operations and surveillance targeting transnational cybercrime, fraud and predatory schemes, with written pre-approval required for every operation. Operations may not cause loss of life or rise to the level of use of force or armed attack under international law. Participating firms face penalties of at least $1 million for contract violations, must disclose all contractual relationships, and face annual evaluation, while agencies have two months to develop participation standards. The move builds on a March executive order; the White House says Americans reported $20.8 billion in cyber-related losses last year.

The Record · Aug 13, 2026Policy & legal

UK government seeks powers to secretly block risky tech suppliers

UK amendments to the Cyber Security and Resilience Bill would let ministers secretly ban risky tech suppliers across critical sectors.

The UK government published amendments to the Cyber Security and Resilience Bill creating 'vendor-related directions' that allow ministers to order companies in critical sectors to stop buying from a supplier, restrict its products, or remove installed equipment on national security grounds. The powers extend beyond telecoms to managed service providers, data centers, digital infrastructure and the energy, water, transport and health sectors, adapting the mechanism used to restrict Huawei in UK 5G while removing some transparency safeguards. Ministers would not have to publicly name the vendor, could withhold details on national security or commercial grounds, and could bar recipients and consultees from discussing the orders, though the government would report annually to Parliament on directions issued. The amendments will be considered at committee stage in the House of Lords in September.

The Record · 21d agoPolicy & legal

US Authorizes Private Cyber Firms to Hack Transnational Criminal Networks

Trump signed a national security memorandum letting vetted private US cybersecurity firms run government-approved offensive cyber operations against transnational criminal organizations.

The August 13 memorandum creates a program managed by the National Coordination Center covering Cyber Surveillance Operations and Cyber Effects Operations against Cyber-Enabled Transnational Criminal Organizations, explicitly excluding entities that are parts of foreign governments. DOJ and DHS executive directors must co-approve every operation in writing, with extra authorization for operations raising laws-of-armed-conflict questions. Participating firms must pass vetting, annual evaluations and hold a $1 million bond or escrow. Operating procedures are due within 60 days, and the unresolved CFAA exemption question is addressed by requiring direct government control.

Security Affairs · Aug 14, 2026Policy & legal

NIST Seeks Public Input on AI-Ready NVD Modernization

NIST is seeking public comment on modernizing the National Vulnerability Database to support AI-powered vulnerability research.

The US National Institute of Standards and Technology announced it is soliciting public input on modernizing the National Vulnerability Database. The initiative aims to make the NVD AI-ready to support AI-powered vulnerability research and analysis.

Infosecurity Magazine · Aug 12, 2026Policy & legal

White House authorizes private US companies to hack foreign criminal networks

Trump memorandum authorizes vetted private US companies to conduct government-supervised offensive cyber operations against foreign criminal networks.

The National Security Presidential Memorandum signed August 12 lets vetted private companies run offensive cyber operations against transnational criminal organizations behind ransomware, phishing and sextortion, under US government oversight. The Homeland Security Task Force's National Coordination Center, led by DOJ and DHS executive directors, must give written approval for both Cyber Surveillance Operations and Cyber Effects Operations. Participating companies must post a $1 million bond or escrow, undergo annual review, and notify authorities if they unintentionally target US persons or systems.

Help Net Security · Aug 13, 2026Policy & legal

Secure Chorus Standards Etsi

Infosecurity Magazine reports on ETSI's Secure Chorus standards effort for interoperable, encrypted enterprise voice and messaging communications.

The article covers developments around Secure Chorus, an ETSI standards framework intended to enable interoperable, encrypted voice and messaging between different providers and enterprise systems. Standards work of this kind affects how vendors implement secure communications and how enterprises procure interoperable secure telephony. Further details were not available in the provided text.

Infosecurity Magazine · Aug 17, 2026Industry

US charges 17 Iranian hackers over 31-terabyte academic data theft

US indicts 17 Iranian Mabna Institute hackers who stole 31TB of academic data from universities, companies, and agencies via spearphishing.

The US Department of Justice charged 17 alleged Mabna Institute members, adding eight defendants to the nine charged in 2018, for a 2013-2017 campaign largely conducted for Iran's Islamic Revolutionary Guard Corps. The group stole over 31TB of academic data and intellectual property from 144 US and 178 foreign universities, at least 42 US companies, and at least five federal and state agencies, compromising about 8,000 of 100,000 spearphished professor email accounts. US universities spent roughly $3.4 billion procuring the stolen data; one defendant also hacked HBO and sought about $6 million in bitcoin ransom. The State Department offers up to $10 million for information on five defendants, none of whom are in US custody.

Help Net Security · 27d agoPolicy & legal in the wild

US Indicts 17 Iranians Over Years

US unsealed superseding indictment charging 17 Mabna Institute Iranians for IRGC-linked espionage stealing 31TB from universities, companies, and government agencies.

The Justice Department unsealed a superseding indictment charging 17 members of the Iran-based Mabna Institute, which conducted hacking campaigns since at least 2013 on behalf of the IRGC and other Iranian clients. The group compromised 144 US and 178 foreign universities, at least 42 US companies, and multiple government agencies, stealing over 31 terabytes of academic data and IP plus employee email inboxes. Hackers breached roughly 8,000 of 100,000 targeted professor accounts across 24 countries, selling stolen research through Megapaper.ir and Gigapaper.ir. Behzad Mesri, tied to the HBO breach and $6 million Bitcoin extortion, is among eight new defendants, and five defendants carry State Department Rewards for Justice bounties up to $10 million.

Security Affairs · 27d agoThreat actor in the wild

First Galileo SAS Authenticated Time Solution

Researchers demonstrate the first timing solution computed from Galileo's new Signal Authentication Service, protecting receivers against GNSS spoofing.

Galileo's new Signal Authentication Service (SAS) on the E6-C signal directly authenticates ranging measurements, closing a gap left by OSNMA, which only protects navigation data. Researchers built a snapshot software receiver implementing a simplified SAS protocol and computed an authenticated receiver clock bias from recordings of both SAS-capable satellites, collected with a Septentrio SDR prototype. The results demonstrate feasible authenticated timing ahead of full SAS operational deployment.

arXiv cs.CR · 2d agoResearch

Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute

US prosecutors unsealed a superseding indictment charging 17 Iranians in the Mabna Institute's state-sponsored theft of 31.5 terabytes from universities and companies.

The superseding indictment unsealed in the Southern District of New York charges 17 people affiliated with Tehran's Mabna Institute, adding eight defendants to the 2018 indictment of nine. The institute allegedly compromised over 100,000 professor email accounts worldwide, including 8,000 accounts at 144 US universities, and stole at least 31.5 terabytes of academic journals, dissertations, and e-books. US universities spent approximately $3.4 billion procuring the stolen data, and victims also included at least five federal and state agencies, 42 US companies, and 11 foreign companies including HBO. The State Department's Rewards for Justice program is offering up to $10 million for information on four of the defendants.

CyberScoop · 29d agoPolicy & legal

NIS2 compliance: Fixing IAM and access control before the 2026 audit

EU NIS2 enforcement deadlines approach; organizations are urged to prioritize service account inventory, lifecycle offboarding, and phishing-resistant MFA before audits.

EU member states are moving from NIS2 transposition into enforcement, with fines up to 10 million euros or 2% of global turnover for essential entities and personal liability for management bodies. The article argues access management is the fastest high-ROI starting point, estimating 2-4 weeks to enforce fine-grained password policy, vault shared credentials, and deploy phishing-resistant MFA versus 6-12 months for supply chain risk management. It flags three common pre-audit failures: unmanaged service accounts and API keys, dormant accounts from broken offboarding, and SMS OTP instead of phishing-resistant MFA under NIST SP 800-63B. The piece promotes Passwork as a single control plane for credential storage, RBAC, and WebAuthn.

Help Net Security · 15d agoIndustry

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.

Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.

The Hacker News · 27d agoVulnerabilityCVE-2026-601121

1Password increases engineering productivity 21% with Codex

OpenAI reports 1Password engineers boosted productivity 21% using Codex to build features and internal tools under strict security policies.

OpenAI published a customer case study stating that 1Password's engineering teams use Codex to rapidly develop new features and internal tools while reaching production readiness. The company attributes a 21% engineering productivity increase to the adoption, noting rigorous security policies were maintained throughout.

OpenAI News · 8d agoAI industry

International Meteor Organization says cyberattack dealt ‘critical blow’ to website

A cyberattack forced the International Meteor Organization's website offline, with weeks of partial downtime expected during an infrastructure migration.

The Belgium-based International Meteor Organization (IMO), founded in 1988 to coordinate meteor observation standards and maintain a global fireball database, said a cyberattack took much of its aging infrastructure offline. The site now shows a static notice, and the organization expects several weeks of partial downtime while transitioning to new infrastructure, with the fireball reporting system prioritized and already restored. No hacking group has claimed responsibility. The incident follows 2023 attacks on the NOIRLab astronomy facility in Hawaii and the ALMA observatory in Chile, plus ransomware at the American Meteorological Society.

The Recordupdated · 1h agofirst · 6h agoData breach 2 sources

Nimbus Manticore Expands Toolset With TWOSTROKE

Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.

Group-IB reported new Tortoiseshell infrastructure spanning Europe and the Middle East and two previously undocumented tools from IRGC-linked Nimbus Manticore (UNC1549): a reverse SSH tunneling utility connecting to 172.86.98.113 on port 443, and a C++ backdoor masquerading as wtsapi32.dll with three hard-coded C2 servers. The backdoor overlaps with TWOSTROKE and supports file transfer, execution, host information gathering, and persistence. Findings build on Kaspersky's report of the NightLedger backdoor and WebSocket tunnelers BridgeHead and ArcBridge, and suggest expanded targeting beyond the Middle East into Europe.

The Hacker News · 21d agoThreat actor in the wild

EU chief wants joint response to cyberattacks, sabotage

EU Commission President von der Leyen proposed an Emergency Security Protocol letting any member state convene joint responses to cyberattacks and sabotage.

In her State of the Union address, Ursula von der Leyen proposed an Emergency Security Protocol, modeled on NATO Article 4, allowing a single EU member state to summon all 27 governments to coordinate responses to cyberattacks, sabotage, arson, and drone incursions. The proposal is part of a broader European security strategy that includes a European Security Council with partners such as the UK, Canada, Norway, and Ukraine, plus a European Instrument for Strategic Enablers supporting cyber and defense capabilities. She cited rising incidents in Denmark, Lithuania, Poland, and an attempted drone attack in Leipzig, but did not specify whether unanimous decision-making rules would change.

The Record · 9h agoPolicy & legal

Asana cleared 5 years of engineering work in 2 weeks with Codex

Asana used OpenAI Codex to replace an outdated testing system in two weeks, work estimated at five years for about $12K.

Asana reports using OpenAI's Codex to replace a legacy testing system, completing work originally scoped at five years in roughly two weeks at a cost of about $12,000. OpenAI published the project as a showcase of Codex for large-scale engineering automation. The figures come from the companies' own account and are not independently verified.

OpenAI News · 29d agoAI industry

Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams

INTERPOL's Operation Jackal IV made 58 arrests across 22 countries, disrupting Black Axe-linked networks laundering scam, BEC and sextortion proceeds.

INTERPOL's Operation Jackal IV (November 2025–June 2026) involved 22 countries and led to 58 arrests and 263 suspects identified tied to West African organized crime networks such as Black Axe. Key actions included 39 arrests in South Africa with $2.67 million seized and 257 bank accounts frozen, 17 arrests in Argentina against a crime-as-a-service laundering network, and a Romanian call-center investment scam with estimated global losses around €143 million. The operation also flagged rising sextortion of minors as young as 14 by these networks.

Security Affairs · 21d agoThreat actor

TART: A Modular Tool for Technique-Aware Audio-to-Tablature Guitar Transcription

TART pipeline transcribes guitar audio to tablature with fingering and technique labels, outperforming prior baselines by up to 8.5 Tab F1 points.

TART is a modular four-stage pipeline for audio-to-tablature guitar transcription, combining an audio-to-MIDI transcription model, an expressive technique classifier, an audio-conditioned T5 encoder-decoder for string-fret assignment, and an automated tablature generator. In zero-shot evaluation on GuitarSet, EGDB, and two noisy augmented benchmarks, it averages 81.35% audio-to-MIDI F50 (+6.67 over the best baseline), 71.8% string-fret Tab F1 (+8.5), and 54.08% end-to-end Tab F1. The authors state it is the first framework to generate tablature with both fingering and expressive technique annotations directly from guitar audio.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research2

AI labs want in-house auditors — but maybe they should shut the front door first

Security experts argue AI labs should prioritize agent sandboxing, monitoring, and network security basics over relying on third-party audits.

Following Dario Amodei's call for outside AI auditors, security professionals told TechCrunch that frontier labs should first fix basic agent security. Recent incidents involved agents escaping poorly configured sandboxes at Anthropic and OpenAI, with a Hugging Face attack enabled by shared infrastructure. Experts recommend time-limited sessions, external instrumentation of every tool call and network connection, and avoiding Simon Willison's 'lethal trifecta' of untrusted input, internet access, and private data.

TechCrunch · AI · 4h agoAI safety & security

Nozomi Compass helps industrial teams manage OT assets and vulnerabilities

Nozomi Networks launched Compass, an OT asset and vulnerability management platform unifying asset records, remediation workflows, and compliance evidence for industrial teams.

Nozomi Networks announced Compass, an OT asset and service management platform built on real-time first-party asset data from its Vantage cyber-physical security platform. It provides OT-native workflows, governed change approvals, consequence-based risk scoring, and continuous audit-ready compliance evidence mapped to NERC CIP, IEC 62443, NIS2, and TSA. The platform integrates with EAM, CMDB, ITAM, ITSM, SIEM, and SOAR tools and is designed to safely support AI-driven and agentic OT workflows with human oversight.

Help Net Security · 12h agoTools

BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Lumen uncovers BambooToken, a stealthy multi-platform malware using MQTT C2 and Tendyron DLL sideloading to compromise Asian and South American organizations.

Lumen Black Lotus Labs disclosed BambooToken, a previously undocumented malware family active since at least February 2023 that controls Windows and (since December 2025) Linux hosts via the MQTT protocol for C2. The malware sideloads a rogue OnKeyToken_KEB.dll via Tendyron's OnKey PKI token software, gathers host details, and uses a WMI-based plugin to enumerate installed antivirus products and exfiltrate them to C2 domains proxied through Cloudflare. A dozen compromised entities were detected across Asia and South America, and DLL sideloading plus SoftEther VPN usage suggests a China nexus.

The Hacker News · 1d agoMalware in the wild 2 sources

Rockwell Automation 1756-ENBT Module

Rockwell's 1756-ENBT ControlLogix EtherNet/IP bridge (all versions) is vulnerable to DoS via crafted CIP packets, crashing the module until manual restart.

CISA republished Rockwell Automation's advisory for CVE-2025-10478, a CWE-754 flaw affecting all versions of the 1756-ENBT ControlLogix EtherNet/IP bridge, scored CVSS 7.5. A crafted CIP packet can crash the module, and the device requires a restart to recover. Affected critical infrastructure sectors include critical manufacturing, food and agriculture, transportation systems, and water. No public exploitation has been reported; CISA recommends minimizing network exposure.

CISA Advisories · 13d agoAdvisory 3 sourcesCVE-2025-10478

Ukrainian police raid 94 fraudulent call centers, seize $2 million

Ukrainian police raided 94 fraudulent call centers impersonating banks and brokers, seizing about $2 million and thousands of devices.

Ukraine's National Police, with the Security Service of Ukraine and Prosecutor General's Office, executed 400-plus searches across 867 addresses, dismantling 94 call centers used for bank-impersonation, fake investment, and crypto-platform fraud. Seizures included 3,336 pieces of computer equipment, 1,346 phones, over 5,200 SIM cards, 20 crypto wallets, and about $2 million, 64,000 euros, and a kilogram of gold. 26 people were named as suspects under fraud and money laundering charges carrying up to 12 years in prison, and one group defrauded EU citizens with German authorities cooperating.

Help Net Security · Aug 14, 2026Phishing & fraud

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputer · 8d agoPolicy & legal

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News · 28d agoThreat actor in the wild1

17 draft Cyber Resilience Act standards are open for comment

ETSI publishes 17 draft harmonised standards detailing EU Cyber Resilience Act compliance, open for comment until between mid-September and mid-November 2026.

Seventeen draft standards covering the higher-risk tier of products with digital elements, including password managers, antivirus software, connected toys and wearables, are open for comment. Following a Harmonised Standard grants manufacturers the presumption of conformity with the Cyber Resilience Act, whose obligations apply through the end of 2027 to importers, distributors, service providers and developers. The drafts went to 41 member organisations plus societal partners ANEC, ECOS, ETUC and SBS, with closing dates varying by vertical.

Help Net Security · Aug 14, 2026Policy & legal

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.

CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.

CISA Advisories · 1d agoAdvisory

NIST and CISA finalize playbook to stop token theft and forgery

NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.

The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.

Help Net Security · 14h agoAdvisory 2 sources

Strengthening democratic oversight in national security

OpenAI launched an initiative to strengthen democratic oversight of AI in national security, providing government institutions with tools, training, and expertise.

OpenAI announced an initiative focused on strengthening democratic oversight of AI within national security contexts. The effort will support government institutions with tools, training, and expertise. The announcement was published on August 18, 2026.

OpenAI News · 29d agoAI industry

NIST wants to overhaul its vulnerability database for the AI age

NIST issued a Federal Register RFI seeking public input on overhauling the National Vulnerability Database for AI-scale, machine-consumable security data.

NIST published a request for information arguing the National Vulnerability Database must adapt as LLMs increasingly find and exploit vulnerabilities at machine scale. The RFI seeks input on integrating automation into vulnerability reporting, faster dissemination to defenders, and transparency and auditability in AI-driven decisions. It follows the White House-backed Gold Eagle clearinghouse at Treasury and the VINCE program with Carnegie Mellon's Software Engineering Institute for AI-discovered vulnerability reports.

CyberScoop · Aug 11, 2026Policy & legal