ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity policy news, analysis, and intelligence.
Chinese APT groups are escalating attacks on Indian banks and South Korean policymakers via phishing and malware, aiming to gather intelligence on economic systems and regional security. The campaigns demonstrate state-level coordination and reflect broader strategic competition in South Asia and Ea
NIST will cease rating low and medium severity vulnerabilities, redirecting resources to critical flaws amid unprecedented submission volumes. Security teams must find alternatives for patch prioritization as the shift trades granular threat intelligence for faster processing of high-impact vulnerab
White House Chief of Staff meeting with Anthropic CEO on AI security reflects a shift from regulation-focused oversight to proactive, direct government engagement with advanced AI developers.
Lawmakers met privately over AI fears, expressing alarm about rapid advancement and regulation gaps. The session highlights urgency for governance frameworks addressing existential risks.
Google blocked 8.3 billion policy-violating ads and suspended 24.9 million developer accounts in 2025, targeting malware, scams, and fraud. Android 17 adds tighter privacy controls to prevent unauthorized data access.
Government cannot defend critical infrastructure without private sector partnerships. Private companies offer essential technical expertise and real-time threat intelligence government agencies lack.
NIST is fast-tracking enrichment of actively exploited vulnerabilities and critical software to address the backlog. The move prioritizes real-world threats amid a surge in CVE disclosures (29,000+ in 2023) that exceeds analysis capacity.
Sweden attributed an energy infrastructure cyberattack to a pro-Russian group, part of escalating cyber operations targeting NATO members. The attack involved prolonged unauthorized access to critical systems, reflecting growing state-sponsored threats against strategic allies.
Tech firms are ignoring half of California residents' privacy opt-out requests, violating state law and enabling unauthorized tracking and data collection. This puts millions of consumers at risk.
Organizations rapidly deploy AI without adequate security oversight, especially autonomous systems. CISOs must distinguish between deterministic, predictable AI and risky agentic systems that operate autonomously to maintain meaningful control.
FBI and Indonesian police dismantled W3LL, a phishing toolkit behind $20M in fraud. This accessible tool enabled thousands of criminals to steal credentials worldwide. Authorities arrested the suspected developer.
Americans lost $14 billion to AI-enhanced cryptocurrency scams in 2023-24, with the FBI warning of explosive growth. AI amplifies fraud through deepfakes, personalized targeting, and automation, making scams more convincing and scalable while dramatically lowering barriers to entry for criminals.
Industrial control systems face unprecedented state-sponsored cyber threats. Organizations operate outdated SCADA with inadequate security, threatening global critical infrastructure.
LinkedIn secretly scans users' 6,000+ browser extensions without consent to infer sensitive personal information like job-hunting status and medical conditions. This undisclosed surveillance operation reveals a significant privacy violation and raises critical questions about corporate transparency
The FBI reports $21 billion in 2025 cybercrime losses, though actual costs likely exceed this due to underreporting and undetected incidents. Sophisticated criminal enterprises increasingly target US businesses, SMBs, and individuals, with losses ranging from thousands to millions per victim.
Trump administration proposes $707M CISA budget cut, drawing concern from security experts over U.S. defense against cyber threats to federal and critical infrastructure systems.
Chinese APT group TA416 resumes European operations after a 2-year hiatus, deploying PlugX RAT and OAuth phishing against government agencies and diplomatic targets. The mid-2025 campaign reflects renewed strategic interest in European intelligence collection amid geopolitical tensions.
AI dominated RSAC 2026 with promised 30-40% improvements in detection and response, but sessions revealed skepticism about automation and notably lacked U.S. government input on cybersecurity AI governance.
Latin American governments face coordinated cyberattacks from nation-states and ransomware operators. Recent incidents in Puerto Rico disrupted energy and water systems, exposing the region's fragmented cybersecurity defenses.
UK Companies House confirmed an 8-month security breach (October 2025–early 2026) in its WebFiling system that exposed thousands of businesses' sensitive corporate data. The vulnerable system was immediately taken offline for remediation after discovery.
CISA issued an emergency directive for critical Ivanti vulnerabilities actively exploited by Chinese state-backed actors. CVE-2025-0282 allows unauthenticated remote code execution while CVE-2025-0283 enables privilege escalation.
The Cyber Resilience Act enforced January 2026 establishes binding cybersecurity standards for connected devices. With severe penalties, manufacturers must comply to access EU markets—making it a de facto global standard.
The cybersecurity industry has a 4.8 million-person skills gap despite workforce growth, with the shortage expanding 15% year-over-year. Employers reject entry-level talent while demand from AI/ML expertise and regulatory compliance outpaces workforce expansion.