30
55
60
60
NIST wants to overhaul its vulnerability database for the AI age
NIST issued a Federal Register RFI seeking public input on overhauling the National Vulnerability Database for AI-scale, machine-consumable security data.
NIST published a request for information arguing the National Vulnerability Database must adapt as LLMs increasingly find and exploit vulnerabilities at machine scale. The RFI seeks input on integrating automation into vulnerability reporting, faster dissemination to defenders, and transparency and auditability in AI-driven decisions. It follows the White House-backed Gold Eagle clearinghouse at Treasury and the VINCE program with Carnegie Mellon's Software Engineering Institute for AI-discovered vulnerability reports.
46
55
45
60
60
30
Sophisticated Cyberattack Exposes Data of 678,000 French Taxpayers
Hackers stole personal and tax data of 678,000 individuals and businesses from France's tax agency DGFiP, prompting a Paris criminal investigation.
France's Directorate-General for Public Finances (DGFiP) confirmed a sophisticated cyberattack exposed data on 678,000 users of the tax system, including income figures, tax rates and family circumstances for individuals and SIREN registration data for businesses. The Paris prosecutor's cybercrime unit opened a probe and referred it to the French anti-fraud office OFAC after a threat actor claimed the breach in late June. Officials stressed the stolen data does not grant access to secure accounts on impots.gouv.fr, and taxpayer notification begins Monday with warnings about identity theft and fraudulent follow-up requests. The incident follows recent breaches at the ANTS documents agency and the INSEE statistics authority.
80
42
60
60
60
60
60
30
57
55
57
30
55
60
Risky Bulletin: The EU publishes its upcoming cybersecurity standards
ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.
The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.
78
60
60
60
42
30
60
42
60
30
30
55
30
57
60
30