Nextgov/FCW - Cybersecurity

Trump nominates Palantir security chief Michael LoSapio to lead CISA

David DiMolfetta — Mon, 09 Nov 2026 22:26:00 -0500

President Donald Trump nominated Palantir’s chief information security officer, Michael LoSapio, to lead the Cybersecurity and Infrastructure Security Agency on Monday, seeking to fill a leadership vacancy that has stretched through nearly two years of staffing cuts and other changes to the agency.

LoSapio would oversee the federal government’s main civilian cyberdefense unit, which helps protect agency networks and works with operators of water systems, power grids, telecommunications networks and other critical infrastructure to prevent and respond to attacks.

He has served as Palantir’s CISO since September 2024, according to his LinkedIn profile. Before that, he led the company’s infrastructure and network security group, starting in December 2017.

CISA has been without a permanent Senate-confirmed director since then-Jen Easterly’s departure in January 2025. Nick Andersen has led the agency in an acting capacity since February after a series of incidents tied to its previous acting director, Madhu Gottumukkala.

LoSapio’s nomination faces a crowded Senate calendar, with lawmakers working to fund the government and approve defense legislation before the year ends. It’s possible his consideration would fall to the incoming Democratic majority if Republicans do not complete his confirmation during the remaining session.

If the Senate does not confirm LoSapio before the current Congress ends, Trump would have to nominate him again for consideration by the incoming Democratic majority. That could bring additional scrutiny of his work at Palantir, whose government contracts and handling of sensitive information have drawn questions from Democrats.

Sen. Ron Wyden, D-Ore., previously said he plans to renew inquiries into the company’s work with the administration when he begins chairing the Senate Finance Committee, and said lawmakers could compel answers if the company does not cooperate.

Democratic lawmakers have questioned whether Palantir’s work with the Department of Homeland Security enables government surveillance of Americans. The company has denied conducting or enabling mass surveillance.

LoSapio did not immediately respond to a request for comment. He previously worked at Palantir as a systems engineer from 2013 to 2016, then spent more than a year at database company SingleStore before returning. Earlier roles included systems engineering at New York University and Seton Hall University.

Trump’s previous choice for CISA director, Sean Plankey, withdrew from consideration in April after spending more than a year awaiting confirmation. His nomination became entangled in a dispute with Sen. Rick Scott, R-Fla., over Coast Guard contracting.

If confirmed, LoSapio would inherit an agency attempting to recover from cuts that reduced its workforce by roughly a third since Trump returned to office. CISA has since moved to refill a few hundred positions.

In line with possible opposition to his employer, House Democrats have also pledged to investigate CISA’s workforce cuts and changes to its election security work.

Last month, the agency released a strategy calling for a review of its services and greater attention to infrastructure whose disruption would cause the most harm to public safety, the economy and national security.

]]>

CISA updates cyber reporting form as broader incident mandate awaits approval

David DiMolfetta — Mon, 09 Nov 2026 16:51:00 -0500

The Cybersecurity and Infrastructure Security Agency updated its cyber incident reporting form on Monday, aiming to gather more detail about attacks and help connect incidents that might otherwise appear unrelated.

The revised questionnaire, available through CISA’s Incident Reporting Portal, asks more specific questions about malicious software, hacking techniques, insider threats and efforts to trick people into giving cyber intruders access to systems. CISA said it also removed duplicate questions and implemented feedback from incident response partners.

The update comes as the agency works to complete a much broader requirement for critical infrastructure organizations to disclose significant attacks. That final rule, which implements the Cyber Incident Reporting for Critical Infrastructure Act — or CIRCIA — reached White House review on Oct. 1 and remains listed as pending.

The form now incorporates MITRE’s “ATT&CK” framework, a widely used catalog of attacker behavior. Common descriptions of what hackers carry out in their operations can help analysts compare incidents across different organizations and identify who may be responsible.

“As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense,” Chris Butera, CISA’s acting executive assistant director for cybersecurity, said in a statement.

Congress passed CIRCIA in 2022 following major attacks, including the SolarWinds espionage campaign and the Colonial Pipeline ransomware incident, that exposed gaps in the government’s knowledge of breaches affecting critical services.

Once implementing regulations take effect, organizations will have to report substantial cyber incidents within 72 hours of reasonably believing they occurred and ransom payments within 24 hours of making them. The reports are intended to help CISA assist victims and warn others before hackers can repeat the same methods elsewhere.

The CIRCIA rules have taken years to develop. CISA published its proposal in April 2024 and missed an October 2025 statutory deadline to finalize it. The agency later targeted September 2026, after a DHS funding lapse delayed additional industry meetings until June.

Companies have mostly pushed back on the scope of the mandate, citing the fact that they have to meet additional cybersecurity incident reporting requirements set by other federal agencies who oversee sectors like banking and telecommunications.

]]>

Congress returns to slew of cyber deadlines and unfinished AI safety bills

David DiMolfetta — Mon, 09 Nov 2026 12:35:00 -0500

Lawmakers return to Washington on Monday with only weeks left to preserve expiring cybersecurity protections and a smattering of unfinished proposals to put federal oversight around increasingly powerful artificial intelligence systems.

The year-end session comes before Democrats take control of both chambers in January. The GOP still controls the schedule for now, with government funding and the annual defense policy bill competing for attention alongside measures aimed at preventing AI-driven harm.

One immediate deadline is Dec. 11, when the Cybersecurity Information Sharing Act of 2015 is set to expire again. Known as CISA 2015, the law gives companies legal protections when they share qualifying cyber threat information with the government.

The measure lapsed during last year’s government shutdown and has since survived through a series of temporary renewals. Industry groups have frequently warned that any lapse in those protections can make companies more reluctant to share information about intrusions.

A recent stopgap law also extended two other cyber and IT authorities through Dec. 11: the Federal Cybersecurity Enhancement Act of 2015, which supports federal network intrusion detection and prevention, and the Technology Modernization Fund, which helps agencies replace aging technology and improve security.

The defense bill offers a possible route to a longer information-sharing renewal. A coalition of 35 industry groups recently asked negotiators to retain a provision extending CISA 2015 through 2035.

But the defense package itself also remains unfinished. While the House narrowly passed its version of the National Defense Authorization Act on July 22, the legislation has stalled in the upper chamber. The Senate fell short of the votes required to begin debating its own version following a failed procedural vote on July 14, leaving the multi-billion-dollar defense package in political limbo.

Both chambers will also have to reconcile differences in conferencing before sending a final, unified bill to the president's desk for signature.

Among many provisions, the House-passed defense bill would require the Pentagon to explain how it is incorporating commercial cyber capabilities into military operations, including tools supporting offensive missions. Another measure focuses on cyberdefense strategies with Taiwan.

A proposal to give firmer legal backing to a global vulnerability-tracking program did not make it into the House package. The amendment from Reps. Delia Ramirez, D-Ill., and George Whitesides, D-Calif., was previously submitted to formally authorize the Common Vulnerabilities and Exposures program in the Cybersecurity and Infrastructure Security Agency.

CVE assigns standard identifiers to publicly known security flaws, giving researchers, software makers and network defenders a common way to discuss the same problem. A contracting scare in April 2025 raised questions about the stability of a system used worldwide but heavily dependent on U.S. government backing.

The legislation will likely be a priority for the 120th Congress, Inside Cybersecurity reported Monday, citing a congressional staffer.

On AI, lawmakers have offered several approaches to a related problem: how to spot and stop dangerous activity before advanced systems cause widespread damage.

The FRONTIER Act, introduced by Reps. Jay Obernolte, R-Calif., and Lori Trahan, D-Mass., would require disclosures about advanced models’ risks and safeguards, along with reports to the government about serious safety incidents.

A separate proposal, the AI Kill Switch Act, would require covered developers to maintain the ability to restrict or shut down their systems. Introduced by Reps. Ted Lieu, D-Calif., and Nathaniel Moran, R-Texas, the bill would also let DHS order emergency action following a qualifying incident, in consultation with Commerce and the director of national intelligence.

Both proposals arrived in July, amid OpenAI’s disclosure that its models had escaped a testing environment and breached Hugging Face, sharpening concerns about AI labs’ ability to control their systems.

Sen. Bernie Sanders, I-Vt., and Rep. Greg Casar, D-Texas, have proposed a more sweeping ban on artificial superintelligence, alongside a pause on advanced AI development while a new federal regulator establishes safety rules.

The remaining congressional session also offers another opportunity to revisit Section 702 of the Foreign Intelligence Surveillance Act, which lets spy agencies warrantlessly collect the communications of foreign targets abroad and is regularly used to investigate various national security threats.

The authority statutorily lapsed in June, but existing court approvals allowed collection to continue into 2027. The administration and intelligence-focused lawmakers may seek a renewal strategy during the year-end session, though privacy groups want a still-secret surveillance court opinion released before Congress acts.

]]>

CISA’s former Secure by Design chiefs launch their own software safety organization

David DiMolfetta — Mon, 09 Nov 2026 08:00:00 -0500

In November 1996, a hacker writing as Aleph One showed readers of Phrack, an underground magazine for hackers, how an attacker could take control of a program simply by sending it more data than it could safely store. The extra data could spill into another part of the program’s memory and change which instructions it followed next, letting an attacker run code of their choosing.

The article, “Smashing the Stack for Fun and Profit,” walked readers through what’s known as a buffer overflow vulnerability. It turned 30 on Sunday, but the kind of flaw it described still turns up in software today.

That phenomenon — why manufacturers still ship products with defects they’ve long known how to prevent — is one of the questions behind the Software Safety Institute, a nonprofit launched Monday by Bob Lord and Lauren Zabierek. The two led the Cybersecurity and Infrastructure Security Agency’s Secure by Design initiative under the Biden administration, persuading hundreds of technology providers to pledge to build safer products.

Courtesy: Lauren Zabierek

Now they want to build upon that work, the founders told Nextgov/FCW in an interview ahead of the launch. Zabierek serves as the institute’s CEO and Lord is its chief strategy officer.

The pair, broadly, are seeking to make software safety measurable and visible, strengthen incentives for manufacturers to build safer products and use evidence about product failures to inform buyers and policymakers.

Even while working at CISA, the two wanted someone outside the agency to “take an independent view of how secure by design is actually playing out,” Zabierek said.

A car buyer, for example, can look up how a model performed in a crash test, they noted. Yet a hospital buying software has little comparable information to help it choose between two vendors.

That distinction is why the pair put “safety” in the institute’s name. As Zabierek put it, “security is the property of the software, but safety is the outcome.”

Lord came to CISA after a call from then-Director Jen Easterly. He had left his job as chief information security officer at the Democratic National Committee and told Easterly how frustrating it had been to defend an organization using products that came with known flaws or unsafe settings. She asked him to join the agency and work on the problem from the manufacturer’s side.

Instead of burdening buyers with fixing vulnerabilities after installation, CISA focused on having manufacturers resolve issues directly within the product. For instance, if a manufacturer stopped delivering hardware configured with simple default passwords, buyers would no longer need to worry about changing them manually.

Nearly 70 companies signed CISA’s voluntary pledge in May 2024. By the time Zabierek and Lord announced their resignations in April 2025, about 300 had signed.

Courtesy: Bob Lord

Lord said CISA could get manufacturers’ attention in a way few institutions could. But outside the government, he and Zabierek can bring researchers and companies together without the formal processes required by the agency.

At the core of the effort is a question about how the global economy builds and ships insecure technology products, and why society hasn’t developed the cultural and legal incentives to prevent the same flaws from propagating.

Engagements with stakeholders have already started. Zabierek has proposed an approach to officials in Massachusetts: analyzing state-collected breach reports to identify recurring product failures. Because states purchase software extensively, detecting patterns across multiple incidents could provide state buyers with specific criteria to evaluate vendors before completing future acquisitions.

Lord sees a similar opportunity in the U.S. federal contracting space. They also plan to study what happens in Europe, where the Cyber Resilience Act now requires manufacturers to report serious security incidents and flaws that hackers are actively exploiting.

Easterly is joining the institute’s board alongside former Deputy National Cyber Director Camille Stewart Gloster, former CISA cybersecurity chief Eric Goldstein and Laura Manley, executive director of Harvard Kennedy School’s Shorenstein Center.

“When I led the Cybersecurity and Infrastructure Security Agency, I said ‘we don’t have a cybersecurity problem so much as a software quality problem.’ That’s still true,” Easterly said. “Government helped start this conversation, but lasting change needs independent, sustained pressure from outside government.”

“When software fails, the harm doesn’t land evenly. Rural hospitals, small water utilities, school districts, and the families who rely on them have the least room to absorb a disruption, and the least say over how the products they depend on are built,” said Gloster. “Holding manufacturers responsible is how you protect the people who could never have prevented the problem in the first place.”

Artificial intelligence has given the work new urgency, the founders said. Last month, researchers used AI to find critical flaws in PHP, software that helps run websites worldwide. Lord described what those tools are exposing as “30 years of deferred safety decisions.”

The usual response, he said, has been to focus on how quickly customers install a fix.

“We blame [consumers] for not having deployed the security updates fast enough without asking why on earth are there so many security updates?” he said.

]]>

US agencies warn of refrigeration hacks amid suspected attacks on military bases

David DiMolfetta — Thu, 05 Nov 2026 13:16:00 -0500

Federal agencies warned Thursday that hackers are targeting refrigeration systems worldwide, urging operators to secure equipment whose recent failures have spoiled food and created fire hazards.

CISA, the FBI and the departments of Health and Human Services, Agriculture and Transportation issued joint guidance warning that attackers are targeting electronic temperature controls at grocery stores and cold storage facilities.

The warning follows Nextgov/FCW’s report last week that U.S. officials suspect Iran-linked hackers were behind freezer malfunctions at military bases across the country. Those incidents began around late August and have affected roughly six commissaries, the on-base grocery stores serving military personnel. Reuters initially reported that the Pentagon was treating the freezer incidents as possible cyberattacks.

In France, hackers targeted refrigeration systems at three regional blood banks overnight Sunday into Monday. And this week, a new wave of supermarket attacks raised fridge temperatures at stores in Sweden, Belgium, Luxembourg and elsewhere, forcing retailers to discard food. The incidents followed attacks at hundreds of French establishments in October.

The U.S. notice does not name who is responsible for the cyber sabotage.

Hackers could force refrigerators and freezers into continuous heating or defrost cycles, the agencies said. They could also prevent operators from seeing current temperatures, making it harder to monitor conditions inside the units. Beyond spoiled inventory and damaged equipment, the agencies warned of fire hazards and potential harm to consumers who use products kept at unsafe temperatures.

Such hacks are possible because various digital vulnerabilities tied to refrigeration controls can expose their underlying equipment to hacking and sabotage, including devices connected to the internet that are used to remotely monitor or control temperatures.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.

Hospitals, pharmaceutical suppliers, chemical companies and transportation providers also depend on these systems.

“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk,” said Brett Leatherman, the FBI’s cyber branch operations director.

The agencies urged operators to remove control systems from the public internet and secure any remote access they still need. They also recommended separating refrigeration controls from business networks, replacing default passwords, installing security updates and retiring equipment that manufacturers no longer support.

The hacks follow a pattern closely aligned with Iranian hackers, said Nahman Khayet‏, the co-founder and CEO at Alt Security.

“They’ve been playing this game for many years,” he said in an interview. “Think about how hard it is to replace those refrigerators, right? They’re huge things. It’s very costly. And also you don’t want to do any disruption to those because they probably hold a lot of items which are important, like food.”

That dynamic means that it’s unlikely the devices are getting the latest security updates, which Iranian cyber operators have often leveraged to get inside systems, including various types of critical infrastructure, he added.

European authorities issued their own joint warning Wednesday, calling for immediate action to secure exposed equipment. The European Commission, cybersecurity agency ENISA, Europol and national authorities are coordinating their response and sharing information about the incidents.

]]>

Election office reports failed attempts to hack its online services

David DiMolfetta — Tue, 03 Nov 2026 23:42:00 -0500

An election office reported that someone probed its online services for weaknesses and tried unsuccessfully to break in Tuesday, while hackers made multiple attempts to guess login credentials at an agency involved in elections, according to an election security report issued Tuesday night.

The findings from the Elections Infrastructure Information Sharing and Analysis Center offered a fuller picture of the cyber activity election officials have seen as Americans vote in the 2026 midterms.

The Cybersecurity and Infrastructure Security Agency said Monday it would not hold election security briefings with members of the media.

A state election office also recorded five spikes in traffic to a webpage voters use to find ballot drop boxes. The office saw unusual traffic around 11 a.m. EST and said it fell after officials added a CAPTCHA, a check designed to distinguish people from automated requests. The report did not say whether voters had trouble accessing the page.

At the agency that reported the login attempts, activity came from a single internet address. When the agency flagged it, several election offices said they had seen malicious traffic from the same address. None of the attempts succeeded, a person aware of the situation said, speaking on the condition of anonymity to communicate their knowledge.

The evening update also detailed how officials accommodated voters after the bomb threat that forced voting outdoors at a Toledo, Ohio, elementary school earlier Tuesday. A court allowed voters assigned to that polling place to cast provisional ballots until 9:15 p.m. local time.

In a mid-Atlantic state, three schools serving as polling places received threatening calls. Two calls involved shooting threats and one involved a bomb threat, according to the report.

As of 9:30 p.m. EST, the centers said they had received no reports of foreign influence operations.

In one southern state, texts gave voters incorrect polling hours. In a southeastern state, a video purported to show ballot boxes being moved outside a county courthouse. Officials said the objects in the video were backup batteries for voting machines.

“I am absolutely willing to accept those results,” President Donald Trump said in an interview with The New York Times Tuesday night, as results poured in showing major Democratic gains in House and Senate races. “We’ll work with the Democrats, and we’ll, you know, look forward to working with them. We’ll probably work something out,” he added.

]]>

Election security center reports limited threats as voting glitches fuel fraud claims

David DiMolfetta — Tue, 03 Nov 2026 17:17:00 -0500

An organization that tracks election threats for state and local officials said Tuesday afternoon that it had seen limited threat activity during the midterms, though a handful of incidents that briefly disrupted voting and equipment problems in some states have fueled unfounded claims of fraud.

Most cases have been resolved quickly, the Elections Infrastructure Information Sharing and Analysis Center said in a 3 p.m. EST update.

“The midterm elections are a massive undertaking. Each cycle, some jurisdictions experience challenges and rely on layered safeguards to protect the accuracy of results,” said Geoff Hale, an election security visiting fellow at the Center for Democracy and Technology.

“This election cycle, the incidents we’re hearing reports of aren't significantly different than those in previous years. So far, we have not seen evidence of significant cyber incidents,” added Hale, who was also former associate director for election security and resilience at the Cybersecurity and Infrastructure Security Agency.

Physical threats and disruptions

In Toledo, Ohio, a bomb threat at Beverly Elementary School forced voters to leave the building around 10:30 a.m. Election workers brought machines outside so people could vote while police searched the school. Authorities cleared it around 12:15 p.m. At least four other schools in the area received threats, according to the center, though none were being used for voting.

Nextgov/FCW asked the FBI whether investigators had determined who was behind the bomb threats. CISA was also asked for an assessment of the day’s activity so far.

In Georgia’s Fulton County, some voters reported receiving texts saying their polling place had moved. It was unclear who sent the messages or how many people received them. The county said the texts hadn’t come from its office and directed voters to Georgia’s official polling-place lookup to check where to cast their ballots.

Tech issues and false information online

Headline-making ballot issues arose in New York’s Westchester County Tuesday morning. Across much of the county, scanners couldn’t read ballots because they hadn’t been updated after a change to a local race, the New York State Board of Elections said. Some scanners are back online as of this afternoon.

The issues in Westchester are real but “are getting picked up with a false, conspiratorial framing that suggests that the issues — and remedies — are an intentional effort to disenfranchise certain voters,” according to an analysis produced by the Center for an Informed Public.

By mid-afternoon, rumors about the Westchester glitches had circulated widely online and buried the state’s actual explanation, Quinn Raymond, co-founder of VoteShield, told Nextgov/FCW.

In Florida’s Broward County, a feature designed to check that each voter received the correct ballot instead held up voting when polls opened at 7 a.m. The problem was fixed by 7:20 a.m.

As of 1:30 p.m. EST, the ISAC said it had received no reports of foreign influence operations.

The election threat center also flagged unusual traffic at one election office, which reported more than 600 web requests a minute Tuesday. It was unclear what caused the spike or whether voters had trouble reaching the site. In a separate incident last week, an election office reported that a network of automated devices had flooded the webpage voters use to find ballot drop boxes.

So far, the most common false allegation is that Democrats were behind the disruptions, according to Carah Ong Whaley, executive director of Better Choices for Democracy, who shared an assessment with Nextgov/FCW.

Whaley also flagged a fabricated story claiming the FBI had found more than 20,000 fraudulent ballots marked for Democrats in a Houston storage facility. Lead Stories, a fact-checking website, traced the claim to a social media account that regularly posts satire.

]]>

Binance says fake job interview helped North Korean hackers steal $6.3 billion in crypto

David DiMolfetta — Tue, 03 Nov 2026 13:41:00 -0500

A Binance software engineer who thought he was interviewing for a new job downloaded a coding assignment that gave hackers access to his work computer, the cryptocurrency exchange said Tuesday in a detailed account of how attackers stole a record $6.3 billion from its digital wallets last week.

The FBI attributed the Oct. 29 theft to North Korea over the weekend. The bureau has asked cryptocurrency firms to block transactions involving the stolen funds. The DPRK has denied involvement, South Korean news agency Yonhap reported Monday, citing state media.

Binance traced the campaign back to June, when a member of its team downloaded a tampered software installer while trying to set up an AI coding tool.

The company caught the intrusion, replaced the computer and changed the employee’s credentials. But by then, the intruders had learned who worked on the systems that manage Binance’s wallets.

In September, someone posing as a recruiter approached a different Binance engineer through a legitimate job site. The engineer sat for two interviews, including one with the supposed CEO. Near the end of that conversation, he was asked to download an assignment laced with malicious code that ran as he set it up on his work computer and escaped detection by Binance’s security software.

On Oct. 20, the hackers used that computer and an internal Binance AI tool to gain control of two wallet engineers’ computers. Nine days later, they used one engineer’s credentials on the other’s machine to reach the service that approves transfers. The moves allowed them to move funds without going through the exchange’s normal withdrawal process, the company said.

“In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time,” said Tyler Reguly, the associate director of security R&D at cybersecurity company Fortra. “Organizations need to counter this with adequate controls in place. Particularly, controls around what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user.”

Binance said about $2.85 billion in stolen assets had been frozen or intercepted. Separately, the exchange said it would cover customer losses and had already replaced 98% of the affected assets as of Oct. 31.

“This should not have happened, and ⁠we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.

North Korean operatives have long posed as job seekers to pilfer funds for Pyongyang’s regime and weapons programs.

Earlier this year, the U.S. intelligence community assessed that Pyongyang has been able to net at least $1 billion annually in cryptocurrency heists and other financial crimes to fund its weapons development.

In a separate operation the FBI disrupted this fall, operatives used laptops stationed in the U.S. to make it appear they were working there. Such arrangements help them land remote jobs and collect paychecks from American companies while gaining access to their networks.

It’s expected the stolen assets will be used for broader money laundering activities.

“They have too much money for their trusted laundering venues to handle. So the money will flow to a wider network of services, like bridges, instant exchanges, and swappers due to a wider set of money launderers,” said Jonathan Levin, CEO and co-founder of blockchain analysis firm Chainalysis.

Crypto bridges let users move funds from one blockchain to another, while instant swap services let them trade one cryptocurrency for another. Hackers can use both to make stolen funds harder to trace.

“Our investigators are tracking novel automated laundering mechanisms using our new AI capabilities that match the attempted speed and sophistication of the launderers,” Levin added.

]]>

Industry groups urge Congress to renew cyber threat-sharing law through defense authorization

David DiMolfetta — Mon, 02 Nov 2026 17:17:00 -0500

A coalition of 35 industry groups is urging Congress to use the annual defense policy bill to renew a law that gives companies legal protections when they share information about cyber threats with the federal government.

In a Nov. 1 letter to the leaders of the House and Senate Armed Services committees, the groups asked negotiators to keep a provision in the House bill that would extend the Cybersecurity Information Sharing Act of 2015 through 2035. The law lapsed during last year’s record government shutdown and has since stayed in place through a series of spending bills. Its current extension expires Dec. 11.

The signers include the U.S. Chamber of Commerce, Business Software Alliance, American Bankers Association, Airlines for America, the American Public Power Association and the National Rural Water Association.

“In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries,” the groups wrote. “That speed depends on the legal certainty CISA 2015 provides.”

The key liability protections in the law are designed to shield firms from lawsuits and regulatory penalties when sharing threat information with federal partners like the FBI or National Security Agency. That data often includes personal or proprietary information tied to individuals and companies affected in cyber intrusions.

Industry groups have consistently warned lawmakers that allowing the measure to lapse would create legal risks for companies sharing breach data, leading to a drop in private sector threat disclosures.

On the first day of the shutdown last year, cybersecurity attorneys were already fielding calls from clients about whether their existing agreements still protected them.

Congress restored the law through January 2026, when it reopened the government in November 2025. Lawmakers extended it again in February of this year, this time through Sept. 30, then moved the deadline to December in a stopgap funding bill.

A sticking point in the Senate reauthorization process has been what else to put in a longer renewal. Sens. Gary Peters, D-Mich., and Mike Rounds, R-S.D., pushed for a 10-year extension during last year’s shutdown.

But Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul, R-Ky., told Roll Call last month that he wanted a provision barring federal officials from pressuring social media companies to restrict speech. Paul — who has routinely pushed back on clean extensions of the law — said he and Peters had discussed the amendment several times without reaching an agreement.

]]>

US order to purge Acronis tied to years of scrutiny over Russian ties

David DiMolfetta — Mon, 02 Nov 2026 10:03:00 -0500

A U.S. government order posted last week that jettisons Acronis products from federal civilian systems was years in the making and focused largely on the firm’s development ties in Russia, two sources familiar with the matter told Nextgov/FCW.

The Swiss cybersecurity firm had been under the microscope since the first Trump administration, where officials had scrutinized it under Foreign Ownership, Control or Influence guidelines — or FOCI — according to a former U.S. official with knowledge of the matter.

On top of this, key areas of scrutiny included whether Russian developers remained involved in Acronis products’ codebases, and whether the company had adequately mitigated related supply chain risks, according to a former DHS official aware of the efforts.

Both former officials spoke on the condition of anonymity to communicate sensitive information about how Acronis has been examined across the Biden and Trump administrations. Neither said there was concrete evidence produced indicating Acronis offerings had backdoors communicating with Moscow.

The move highlights a contemporary case of bipartisan, multi-administration foreign ownership review, and it underscores how long it can take officials to firmly determine that products tethered to government systems pose a security threat before they are kicked out of the federal market.

FOCI reviews, in essence, are sweeping government checks on whether a foreign person or entity could influence a company in ways that create national security risks.

Under a Department of Homeland Security directive signed July 31 by Secretary Markwayne Mullin, federal civilian agencies have until January 27 of next year to completely eliminate all software from the Swiss-headquartered vendor. The directive followed a formal risk recommendation from the interagency Federal Acquisition Security Council, or FASC.

The final removal order was only publicly posted to the Federal Register this past week. Its existence was first reported by Politico.

It’s not entirely unusual for foreign ownership assessments to cross between presidential administrations, though the long timeline underscores the sometimes sluggish pace of federal supply chain security reviews: nearly a decade in this case. The reviews can leave targeted firms in limbo and slow their business activity while vetting occurs.

“The FASC keeps very tight control because of the damage it can do to companies and others. They take their job very seriously,” said the former DHS official, who added that they wished the council sometimes would work faster, referring to the Acronis scrutiny taking years.

The former DHS official also said Acronis could potentially face costly challenges contesting the scrutiny and may be less able to push back than a much larger company facing similar oversight. Other federal contractors that use Acronis could soon also find themselves removing company products from their systems.

But, unlike other recent initiatives, the move does not fully ban the company from operating in the American private sector. The U.S. government, for instance, banned federal agencies and contractors from using Russia-based Kaspersky products starting in 2017, but later expanded the restriction through federal acquisition rules and comprehensive commercial sales bans.

In recent years, Acronis products have been purchased for government use often through resellers rather than contracts awarded directly to the company, according to GovTribe, a federal market intelligence platform owned by Nextgov/FCW parent company GovExec.

Various defense and civilian services have used its products, including the Defense Information Systems Agency, Drug Enforcement Administration and National Oceanic and Atmospheric Administration. Acronis was last awarded a federal contract in 2016.

Founded in Singapore in 2003 and currently headquartered in Schaffhausen, Switzerland, Acronis offers data protection, backup, secure file sharing and recovery solutions.

The company historically relied heavily on engineering and R&D talent based in Moscow. To bypass strict Russian laws against foreign tech procurement, Acronis entered a licensing agreement with a legally distinct Russian entity called Acronis Infoprotection, which took the core Acronis codebase, modified it to meet Russian government encryption standards and resold the localized software to Kremlin ministries and state-owned enterprises.

But after the 2022 invasion of Ukraine, Acronis suspended operations in Russia, condemned the war, and migrated tech talent to Bulgaria, Singapore and Israel. In 2025, Swedish private equity firm EQT also acquired a majority stake in Acronis, and co-founder Serg Bell stepped down from executive management, leaving current CEO Prakash Panjwani and Chairman Warren Adelman at the helm.

Despite these shifts, federal scrutiny remained, and it culminated in the first-ever order under the Federal Acquisition Supply Chain Security Act last July, barring Acronis from intelligence community networks. Subsequent bans by the General Services Administration and Department of Defense followed before last week’s DHS order was posted.

Bell’s ties to Russian military-scientific initiatives have previously come under scrutiny from U.S. intelligence officials.

An Acronis spokesperson did not say whether the company would challenge the DHS directive.

“On May 15, 2025, EQT, a Sweden-based private investment firm acquired a majority controlling interest in the Acronis group companies,” the spokesperson said. “Over 75% of the shares are owned by western blue chip investors including CVC Capital Partners, Sprincoast Partners and BlackRock. EQT requested and received CFIUS approval to close the transaction,” added the spokesperson, referring to the Committee on Foreign Investment in the United States, which vets overseas transactions for national security risks.

]]>

FBI links $6.3 billion Binance hack to North Korea

David DiMolfetta — Fri, 30 Oct 2026 12:34:00 -0400

The FBI and federal partners over the weekend attributed a $6.3 billion theft from cryptocurrency exchange Binance to North Korea.

“The FBI is aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts and coordinate appropriate investigative steps,” the bureau told Nextgov/FCW Friday.

The bureau released an assessment on Saturday and provided a list of addresses that are holding or have held assets from the theft.

Blockchain intelligence firm TRM Labs estimated that hackers transferred $6.36 billion out of Binance’s digital wallets Thursday, most of it in about 20 minutes. The company described it as the largest cryptocurrency theft on record, more than four times the $1.5 billion taken from rival exchange Bybit in February 2025.

TRM attributed the attack with high confidence to TraderTraitor, the North Korean hackers the bureau previously blamed for the Bybit theft.

The FBI made the same assessment, adding that it’s expected the stolen assets will be used for other money laundering activities.

About $3.24 billion remains in addresses linked to the hack, mostly in Ethereum and Bitcoin, according to Tom Robinson, the chief scientist and co-founder of blockchain analysis firm Elliptic.

“The funds that have not moved are very likely still held by North Korea. Those being laundered may already be with Chinese money laundering networks, which North Korea has used before,” he said Monday.

Binance allows customers to buy, sell and hold digital currencies. The attack targeted wallets the company uses to handle those assets across multiple cryptocurrency networks. The company said its preliminary investigation suggests the breach began with a compromised laptop belonging to an engineer who works on its software and operations. The attacker then accessed an internal service and submitted withdrawals without authorization.

“Decades of investment in cybersecurity have strengthened traditional defenses, yet the growing complexity of digital banking and AI have created new vulnerabilities,” said Phoebe Hodgson, a banking and payments senior analyst at GlobalData.

Binance said it temporarily halted deposits and withdrawals while conducting security checks. It pledged to cover all losses using its emergency protection fund and company money and said it would publish an updated accounting of the assets backing customer balances once repairs were complete.

Hackers can make stolen cryptocurrency harder to recover by exchanging it for other digital currencies and moving it between wallets. After the Bybit hack, the FBI said attackers had spread the stolen funds across thousands of wallets, and the bureau urged cryptocurrency companies to block further transfers.

North Korea has been stealing cryptocurrency for years as part of a broader effort to evade sanctions and raise money for the regime and weapons research.

Its operations have also involved the use of false identities meant to obtain remote technology jobs. Earlier this month, U.S. authorities announced the disruption of “laptop farms” in Texas that helped DPRK operatives pose as U.S.-based employees and send their earnings back to the regime.

Editor’s Note: This story was updated to reflect the FBI’s attribution of the hack to North Korea and to add comments from Tom Robinson.

]]>

Officials suspect Iran in series of cyberattacks on military base freezers

David DiMolfetta — Thu, 29 Oct 2026 20:52:00 -0400

U.S. officials suspect Iran-linked hackers are behind a series of cyberattacks that have targeted freezers at military bases around the country and caused them to malfunction, according to two people familiar with the matter.

The outages have affected around six commissaries, the on-base grocery stores serving military personnel. The people spoke on the condition of anonymity to communicate sensitive knowledge about the intrusions, which began around late August.

It’s not clear how exactly the cyberintruders may have accessed the freezer systems, though various digital vulnerabilities tied to freezer controls can expose the equipment to hacking and sabotage. It’s possible the assessments may change as investigators learn more about the hacks.

The attacks, if fully confirmed to be tied to Iran, would demonstrate the nation’s ability to disrupt certain military-related equipment inside the United States through cyber means, and comes as the Trump administration is reportedly planning follow-up strikes on Iran after the U.S. midterm elections next week.

The attribution would also fit a broader pattern of suspected Iranian activity against equipment controlling water treatment processes in recent months.

Iran has previously combined hacking in lead-ups to elections. During the 2024 presidential campaign, U.S. officials attributed the theft of Trump campaign material to Tehran⁠.

Cyber Command and various Defense Department law enforcement units are probing the freezer incidents. French authorities are also working with officials examining the matter. Earlier this month, hackers overrode temperature controls on commercial refrigeration equipment at some 350 French establishments, which forced supermarkets to discard spoiled food.

The investigation draws attention to the computers that control everyday equipment used to store and handle food, an often overlooked area of cybersecurity where a hack can spoil supplies or interrupt distribution of goods.

The Food and Agriculture Information Sharing and Analysis Center, an industry group that shares cyber threat intelligence on the nation's food supply, has warned that attackers can target internet-accessible industrial controls that may not have optimal cyberdefenses in place.

]]>

Pentagon investigates suspected cyberattack behind military freezer failures

David DiMolfetta — Thu, 29 Oct 2026 16:54:00 -0400

The Pentagon is investigating a suspected cyberattack behind freezer malfunctions that spoiled food at military bases across the United States in August, according to a U.S. official familiar with the matter.

The outages affected some six commissaries — the on-base grocery stores serving military personnel — per the official, who spoke on the condition of anonymity to discuss the situation. At Fort Huachuca in Arizona, officials reported that a freezer had entered defrost mode and heated its contents, leaving food spoiled.

Reuters first reported Thursday that investigators were treating the incidents as a possible hack. It’s unclear who might be responsible or whether investigators have conclusively determined what caused the failures.

Cyber Command and various Defense Department law enforcement units are probing the incident. French authorities are also working with officials examining the matter. Earlier this month, hackers overrode temperature controls on commercial refrigeration equipment at more than 350 French establishments, forcing supermarkets to discard spoiled food.

The unusual U.S. outages and the possibility of hacking were initially flagged in August by the Signal and Silence blog. Stars and Stripes subsequently reported the involvement of military investigators, and The Telegraph also reported officials’ contact with French authorities.

A 2021 DHS assessment of threats to food and agriculture specifically identified refrigeration failures and shipping delays as cybersecurity risks that could cause spoilage and shortages.

The Food and Agriculture Information Sharing and Analysis Center, an industry group that shares cyber threat intelligence on the nation's food supply, has warned that attackers are targeting internet-accessible industrial controls that may not have optimal cyberdefenses in place.

The agri-food sector’s sensitivity to downtime often gives ransomware groups leverage to demand payment, the organization said in a separate report.

Lawmakers have sought to improve federal protections. A bipartisan group reintroduced the Farm and Food Cybersecurity Act in 2025, following an earlier proposal introduced in 2024.

]]>

DHS leak exposes contact information on intelligence personnel

David DiMolfetta — Thu, 29 Oct 2026 14:57:00 -0400

Contact information and organizational affiliations for personnel in the Department of Homeland Security’s Office of Intelligence and Analysis have been exposed in a leak of some 41,000 agency records published Wednesday.

Nextgov/FCW called numbers listed in the data for two I&A officials. One call reached a voicemail greeting identifying the official by name. The second person answered and offered little comment, but appeared to acknowledge that the listed number was theirs. Nextgov/FCW is withholding both officials’ names and positions.

The findings confirm the leak extends partly to the Homeland Security Department’s main intelligence arm, whose work includes counterterrorism, cyber threat analysis and transnational organized crime⁠. I&A is a member of the U.S. intelligence community and connects federal intelligence with information from state and local authorities and private-sector partners.

The entire scope of the exposure within I&A remains unclear, though around 75 records viewed by Nextgov/FCW appeared to tie personnel to the office. Both I&A field operations and headquarters staff are listed in the data.

The broader collection — which includes personnel in Immigration and Customs Enforcement, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency and a slew of other department components — was published by transparency nonprofit Distributed Denial of Secrets.

Famed Swiss hacker and journalist known as “maia arson crimew” also said she was involved in working through the data, which was provided by a hacktivist group calling itself the Department of Peace.

The data includes names, phone numbers, email addresses, job titles and internal group memberships across the department. Some entries are historical, including records associated with former employees, Nextgov/FCW confirmed Wednesday.

Exposed contact details could help foreign intelligence services or criminals identify intelligence personnel and approach them with messages or calls designed to appear legitimate.

The leak is a potentially “severe operational failure” that puts safety of undercover personnel at risk, said Dray Agha, a senior tactical response manager at cybersecurity firm Huntress. “Exfiltrating this directory data gives hostile actors a complete map of sensitive departments and their internal reporting structures.”

The Department of Peace described the breach as retaliation for Secretary Markwayne Mullin’s pledge to intensify immigration enforcement. The publishers said the release could support public records requests and scrutiny of DHS operations.

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a department spokesperson said. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”

The group claimed it obtained the records through an Okta single sign-on service used by DHS, which allows employees to access multiple workplace applications through one login. Nextgov/FCW has not directly confirmed that account. An Okta spokesperson previously said the company is secure and hasn’t seen evidence of compromise.

“The danger here goes well beyond a list of names. Connecting someone’s identity to their job, contact information and operational role gives an adversary a targeting map,” said Alissa Knight, the CEO of Assail’s federal government arm. “It can make impersonation more convincing, expose sensitive personnel and create risks that extend beyond the network.”

The exposure comes during a period of upheaval for I&A over the last year. Nextgov/FCW previously reported⁠ that the office underwent substantial workforce reductions in 2025, following a more sweeping downsizing plan that was paused after objections from law enforcement and other organizations that rely on its threat reporting.

DHS has also faced scrutiny over its ability to detect intrusions. Earlier this year, personnel twice dismissed signs of hackers inside the Homeland Security Information Network before confirming a breach, Nextgov/FCW first reported.

The incident also follows a separate but similar disclosure of FBI employee information involving intelligence and surveillance personnel⁠. That incident, claimed by prolific criminal hacking group ShinyHunters, exposed details that could help outsiders identify employees whose work is not widely known and tailor efforts to deceive or threaten them.

]]>

GSA left sensitive information in its Google Drive exposed, watchdog finds

Christian Robles — Thu, 29 Oct 2026 08:00:00 -0400

The General Services Administration did not effectively protect physical security, personally identifiable data and general proprietary business information stored within its Google Drive, according to an audit released Tuesday by the agency’s Office of Inspector General.

In a limited search of GSA’s Google Drive, the OIG found 116 files containing controlled unclassified information, or CUI, that were improperly shared with employees and contractors who did not have a legitimate business reason to know those details. The exposed data included Social Security numbers, phone numbers, proprietary research, vendor proposals and site plans for a Washington, D.C. building.

GSA IT’s review determined that the identified documents were “not exposed externally” and found “no indication of malicious intent,” according to a response letter from David Shive, GSA’s chief information officer.

The watchdog attributed the improper exposure of sensitive information to “deficiencies” in GSA’s oversight.

The OIG said the agency did not effectively manage a third-party data loss prevention tool, used to prevent and detect CUI exposures.

That tool searches documents shared in GSA’s Google Drive for CUI-related keywords or phrases. If the tool detects CUI, it performs a “pre-designed response,” which could include restricting access to the document, flagging the document to GSA’s Security Operations and Engineering Division and sending an automated email to the document owner, according to the OIG audit.

But GSA did not fully complete annual reviews of the tool’s search terms to ensure it detected CUI and did not incorporate “many relevant terms” from agency guidance into tool searches, the watchdog concluded. Tool searches also failed to detect documents that included search terms.

GSA also did not implement a tool feature known as optical character recognition that could have prevented CUI exposures, did not document program decisions affecting CUI protection in the Google Drive and was not aware of the tool’s file size limit of 15 megabytes, OIG wrote.

In addition to mismanagement of the tool, OIG found GSA lacked an approval process for properly sharing sensitive information and a standard naming convention that could help prevent CUI exposures in its Google Drive.

The office gave GSA seven recommendations to prevent future CUI exposures:

Restrict access to all 116 CUI documents exposed in GSA’s Google Drive to only GSA users with a lawful government purpose for accessing them.
Identify and restrict access to other CUI documents not found through OIG’s audit.
Notify individuals affected by the exposed information in accordance with GSA policy.
Implement additional controls, such as an approval process for sharing CUI documents, a standard naming convention for CUI documents and new agency training materials.
Improve management of the data loss prevention tool through annual search term reviews and use of CUI guidance terms.
Assess and implement new data loss prevention tool features, such as optical character recognition and methods to identify CUI documents larger than 15 megabytes.
Develop a process to document and maintain operational decisions for the data loss prevention tool.

Shive said GSA IT agrees with all of the recommendations and is “working on a plan to address them.”

He added that GSA IT took “significant corrective action to strengthen the protection of sensitive information across GSA’s Google Workspace” while OIG was conducting its audit.

Those actions included updating internal procedures, restricting access to documents shared domain-wide “as appropriate,” and evaluating additional controls and tools to flag CUI exposure. The agency also adopted the optical character recognition feature that OIG recommended be implemented, according to Shive’s letter.

The report released Tuesday is not the first time OIG has found that GSA did not adequately protect sensitive information stored on Google technology.

In August 2014, the office reported that GSA did not protect information about child care centers, courthouses, water sources, building automation systems, security systems and fire alarm systems in its Google cloud computing environment. OIG issued additional reports between 2015 and 2017 that raised concerns about GSA’s ability to protect sensitive information within the Google environment.

In April 2025, the office found GSA’s Google Drive contained documents with sensitive information that users did not need to know, such as CUI, safety environmental management surveys and vendor financial information.

]]>

DHS personnel leak exposes contact details and sensitive job information

David DiMolfetta — Wed, 28 Oct 2026 22:07:00 -0400

Searchable records identifying more than 41,000 current and former Department of Homeland Security employees and contractors were published Wednesday, exposing contact information and details about sensitive assignments across the department, according to the organizations behind the release.

The transparency nonprofit Distributed Denial of Secrets — known as DDoSecrets — said it received the data from a hacktivist group calling itself the Department of Peace. The group claimed to have obtained the records through an identity service used by DHS. Famed Swiss hacker and journalist known as “maia arson crimew” also had involvement. She said in an X post that she was not involved in procuring the data and “worked on this story as a journalist conducting source work, research and data work.”

The information includes names, phone numbers, email addresses, job titles and internal group memberships, with records covering Immigration and Customs Enforcement, Customs and Border Protection, the Cybersecurity and Infrastructure Security Agency and other parts of DHS. Some entries describe roles involving surveillance, computer forensics and undercover work.

Nextgov/FCW corroborated portions of the data, including one official’s work phone number that the reporter for this story had independently obtained before the leak. Checks of several other listed numbers showed they were associated with AT&T, which provides communications services to DHS. LinkedIn profiles for several people named in the data also matched the job titles and positions listed in the records.

Some of the records also appear to be historical. Nextgov/FCW identified names of employees in CISA who have since left their roles at the cyberdefense agency housed in DHS.

DHS said it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.” The department said it was working to protect employees and would provide more information when available.

The release, dubbed “Icepick,” offers a view into how personnel and responsibilities are organized across DHS. Its publishers described that visibility as a tool for public accountability. The exposure of employees’ assignments and professional connections can also help malicious actors identify sensitive targets and craft convincing impersonation attempts.

The Department of Peace said the breach was a response to DHS Secretary Markwayne Mullin’s pledge to intensify immigration enforcement.

“On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that,” a group spokesperson told the outlet. The group previously claimed a DHS hack involving contractor records in March.

DDoSecrets co-founder Emma Best said the latest release could support journalism, public records requests and congressional oversight.

The hackers said they collected the data from an Okta single sign-on service used by DHS. Such services let employees access multiple workplace applications through one login. Okta said it was aware of the reporting but had found no evidence of a compromise of its own systems.

“Okta is secure, and we have no evidence our data or systems were compromised,” a company spokesperson said.

The disclosure follows other recent incidents involving federal personnel information. A breach claimed by criminal hacker group ShinyHunters exposed sensitive FBI employee records, including information about intelligence and surveillance roles. Separately, a Defense Manpower Data Center breach affecting roughly 3 million people involved months of unauthorized access to a file-sharing system.

]]>

FCC commissioner hopes Cyber Trust Mark products reach shoppers within a year

David DiMolfetta — Wed, 28 Oct 2026 13:45:00 -0400

FCC Commissioner Olivia Trusty said Wednesday she hopes consumers will begin seeing products bearing the U.S. Cyber Trust Mark within the next year, offering a new outlook for the device-security labeling program as officials work to finalize requirements for its rollout.

Speaking at a Consumer Technology Association event, Trusty said the Federal Communications Commission expects to seek public comment on technical requirements and testing procedures in the coming months. The agency on Tuesday opened a separate proceeding covering label design, certification renewal and checks on products after they enter the market.

FCC Chairman Brendan Carr assigned Trusty to oversee implementation of the voluntary program, which is intended to help shoppers compare the cybersecurity protections of connected household products such as cameras, appliances and baby monitors.

The update is the first in several months to address the program’s status. First envisioned during the Biden administration, the mark is akin to the Energy Star label that helps shoppers identify energy-efficient products.

The timeline for the rollout has seen significant delays. In January 2025, then-White House cyber official Anne Neuberger said officials expected labeled products on shelves that year. But the initiative has also undergone major changes in the second Trump administration. The FCC selected ioXt Alliance as lead administrator in April, after UL Solutions withdrew following an FCC national security review under Carr of its alleged ties to China.

The label is designed to make security easier to assess before buying a device. A shopper can readily compare a camera’s price and picture quality, Trusty said, but may struggle to determine how well it is protected or how long its manufacturer will provide security updates.

A parent should not have to “become a cybersecurity expert before selecting a baby monitor,” she added.

Products qualifying for the mark would carry a label accompanied by a QR code directing shoppers to security information, including the manufacturer’s support commitment and instructions for securely configuring the device.

The label can’t guarantee a product will never face a cybersecurity threat, Trusty noted.

Several steps still stand between the program and labeled products reaching store shelves. The FCC must finish its technical requirements and testing procedures, then move ahead with accreditation for the organizations that will test and certify devices, Renee Roland of the agency’s Public Safety and Homeland Security Bureau said on a panel following Trusty’s speech.

Manufacturers can begin preparing now, said Peter Thermos of Palindrome Technologies, a cybersecurity testing company participating in the program. That includes identifying weaknesses in their products and establishing how they will deliver security updates to customers.

Earning the label would bring continuing responsibilities to address vulnerabilities and support those devices, Thermos said, adding "that’s where the responsibility starts."

Grace Burkard, who leads ioXt’s work as administrator, said technical recommendations have recently been published, but the product registry and consumer education effort remain works in progress. Additional working groups are expected in the coming months.

Officials also want shoppers to understand the label’s limits. Certification would not eliminate the need to configure a device securely, Roland said, and the FCC is seeking feedback on how to handle complaints and check that products continue meeting requirements after they go on sale.

]]>

China’s ‘Volt Typhoon’ quietly built another hacking network following US crackdown, new findings say

David DiMolfetta — Wed, 28 Oct 2026 12:00:00 -0400

In January 2024, a quartet of U.S. cyber and intelligence officials issued a stark public warning about Chinese hackers embedding themselves into critical infrastructure around the country. Volt Typhoon, as the group is known, was targeting systems like power grids and transportation networks, positioning itself to sabotage them should the U.S. become involved in a conflict with Beijing over Taiwan, officials assessed.

The FBI at the time had just struck at a network of compromised routers used by the hackers to conceal their intrusions. The operation, conducted in December 2023 and announced the following month, disabled the main arm of the staging ground, dubbed KV Botnet, subsequent research found. It was a major disruption of the group’s infrastructure, accompanied by a public campaign to alert organizations to the threat.

But as U.S. investigators dismantled parts of KV and worked to notify victims, another Volt Typhoon operation was quietly taking shape, according to findings released Wednesday by Black Lotus Labs, the threat intelligence arm of Lumen.

That network, dubbed Silent Train, has supported a three-year campaign against government systems, telecommunications providers, defense contractors, satellite services, universities, technology firms and various critical infrastructure operators, according to the research.

Built around chains of compromised routers, corporate networking equipment and everyday internet-connected devices, Silent Train gave the hackers ways to reach targets while concealing where their activity originated. Volt Typhoon used it to target and, in some cases, compromise organizations across those sectors, according to Lumen.

Those organizations include Energy Department facilities around the U.S. that have been targeted over the last year, according to a person with knowledge of the matter. Multiple utility providers have also been dealing with Volt Typhoon-related issues over a similar timeframe, according to a former U.S. official. Both people were granted anonymity to discuss sensitive details of recent intrusions linked to the hackers.

The findings paint a picture of how much of Volt Typhoon’s activity remained outside public view, even as the U.S. worked to expose and disrupt it, and they underscore the Chinese hackers’ persistence in gaining footholds inside American systems.

Access to organizations that supply power, communications and other vital services could give Beijing opportunities to interfere with civilian life and military operations during a crisis, a dynamic that has long been a concern of current and former officials dealing with China-linked cyber threats.

U.S. officials had cautioned early on that dismantling KV would not end the campaign. In March 2024, then-NSA cybersecurity director Rob Joyce said investigators were still finding victims of the hacking group. By May, officials detailed multiple covert networks supporting the hackers.

Lumen’s findings provide a more detailed view of one such operation. Most targets were U.S. government entities, defense contractors and universities with defense relationships. IT companies and managed service providers — firms that operate their customers’ technology infrastructure — were also prominent targets.

The hackers heavily targeted entities in Hawaii, California and Texas, a concentration Lumen believes reflected an effort to position for disruption of U.S. defense and infrastructure networks connected to the Indo-Pacific.

“Many of the organizations targeted in these areas occupied positions of trust and connectivity upon which military, government, and civilian operations depend,” the report says.

Telecom providers were among the targets reached through enterprise IT management tools. Such platforms can offer an especially valuable entry point because they are built to oversee other systems and give administrators broad access.

“Threat actors typically need to traverse networks, identify administrators, locate key systems, and establish multiple footholds to gain visibility. Volt Typhoon bypasses this by targeting management platforms directly, which already have visibility, access, and administrative functions,” the report reads.

Lumen observed more than 27 classes of devices used in Silent Train, ranging from TP-Link routers and Netgear equipment to enterprise platforms like Fortinet appliances. Some compromised devices had no known security flaws, which Lumen said suggested the hackers may have exploited previously undiscovered vulnerabilities.

Silent Train also relied on brief, carefully managed connections rather than keeping the same access paths continuously active. After conducting operations, the hackers removed traces of their activity and dismantled connection paths, according to Lumen. The access windows lasted about four hours on average, with some active for only a few minutes.

The persistence of the campaign echoes a warning then-FBI Deputy Director Paul Abbate gave in August 2024 that U.S. efforts had fallen short of deterring the hackers.

Despite the government’s interventions, he said, “it just has not had the deterrent effect that we would want to see.”

Washington has also tried diplomatic pressure. Then-Secretary of State Antony Blinken and Nathaniel Fick, the State Department’s former top cyber diplomat, pressed Chinese officials to halt Volt Typhoon’s activities during an April 2024 visit to China, Fick told reporters the following month.

“Secretary Blinken was very clear that holding American critical infrastructure at risk — especially civilian critical infrastructure — is dangerous. It’s escalatory. It’s unacceptable,” Fick said at the time.

]]>

DHS secretary plans post-election security review

David DiMolfetta — Wed, 28 Oct 2026 10:19:00 -0400

Homeland Security Secretary Markwayne Mullin plans to review the nation’s election security posture after the midterms and consider changes aimed at bolstering public confidence in voting systems.

Mullin outlined the plans during an all-hands address at the Cybersecurity and Infrastructure Security Agency’s headquarters Tuesday, according to a CISA official with direct knowledge of the remarks. The official was granted anonymity because they were not authorized to discuss details of the speech.

The secretary told employees he intended to hold a “debrief” after the elections and weigh whether changes to systems were needed to improve trust in election outcomes among voters. He also said DHS was not seeking to “suppress” votes and said the department’s goal is ensuring ballots are secure and legally cast.

The scope of that review and the changes Mullin might pursue remain unclear. But his remarks come as the Trump administration has sought greater control over election procedures, including attempted restrictions on mail voting that would require voters to appear on new Postal Service lists before their ballots could be transmitted.

More recently, the Justice Department asked Washington state to withhold ballots from hundreds of people flagged as alleged noncitizens, following a similar effort in California. Audits and studies have consistently found noncitizen voting to be rare.

Election cybersecurity work can include protecting voter registration records, keeping voter check-in systems available and preventing attacks that knock polling-place information or results websites offline. Disrupting those services can cause confusion and delays for voters, though they do not directly affect how people cast their ballots.

Foreign influence campaigns can separately seek to discourage participation or undermine confidence in the outcome by spreading false claims about candidates or amplifying divisive political issues online. Current and former officials previously told Nextgov/FCW that cuts to certain federal programs have weakened relationships used to identify and counter foreign influence campaigns, even as artificial intelligence makes deceptive messages easier to produce and spread.

Sen. Mark Warner, D-Va., and Rep. Jim Himes, D-Conn. — the top Democrats on the Senate and House Intelligence panels — said last week that U.S. intelligence has described Russian disinformation and more targeted Chinese influence efforts. The lawmakers said they have seen no indications of a foreign operation to manipulate voting machinery or alter ballots.

Mullin’s address was first reported by Politico. His remarks come as CISA tries to boost election security support following staffing and program cuts that state officials say have disrupted their access to federal expertise.

The agency’s September election plan assigns its 10 regional directors an election adviser role and describes a free platform for sharing threat information among election officials, state intelligence hubs and federal partners. Mullin pledged at the time that the plan would be “implemented in full.”

Some state officials have warned that renewed assistance arrived too late for parts of their midterm preparations. One Arizona cybersecurity official said last month that their state had been without a CISA cybersecurity adviser since March 2025.

The debate over CISA’s election work stretches back to 2020, when the agency affirmed the security of that year’s election and rejected President Donald Trump’s false claims that it had been stolen. Trump and his allies have since accused CISA of enabling government censorship through its work to counter election-related disinformation.

Those grievances have helped shape much of the administration’s efforts to narrow the agency’s role during Trump’s second term. In the last year, officials have also undertaken acute efforts to scrutinize the security of voting infrastructure.

Although voting machines and related systems contain known security vulnerabilities, officials and cybersecurity experts have found no evidence that these flaws have been widely exploited in a way that would alter election outcomes.

]]>

FEC takes down electronic filing platform after attempted hack

David DiMolfetta — Wed, 28 Oct 2026 10:06:00 -0400

The Federal Election Commission has pulled down multiple filing systems amid reports indicating that the agency was targeted in a cyberattack.

The hacking attempt, first reported by Reuters, put the government’s primary campaign finance regulatory agency in the crosshairs. The FEC does not administer U.S. elections, and cyber incidents related to the commission would not affect how votes are cast in next week’s midterm elections.

A notification email obtained by Nextgov/FCW indicated that several systems remained offline, including various filing search features, campaign finance report validation tools, and other feeds and channels. The notice adds another update will be provided Wednesday morning.

On Tuesday night, an FEC spokesperson referred Nextgov/FCW to a commission status update page, adding that electronic filing systems are offline and that staff are “actively working to restore service.”

An update issued around 8:20 p.m. ET Tuesday night says an issue has been identified and a fix is being implemented.

The incident is timely, as it comes days before midterm elections will be held in the U.S. and as groups pour record levels of money into campaign efforts. The disruption hinders organizations from submitting the FEC’s required 24-hour and 48-hour disclosure reports, which detail political spending on individual races.

A disruption to campaign finance reporting can limit timely public visibility into election spending, said Gabrielle Hempel, a security operations strategist at cybersecurity firm Exabeam.

“What is the backup process, how are filings received and disclosed while the system is down? How quickly can the agency restore service without sacrificing the integrity of the data? Disruptions like these can have a massive impact on public trust without ever actually touching a ballot,” Hempel said.

]]>

White House takes Texas water cybersecurity model to rural hospitals

David DiMolfetta — Tue, 27 Oct 2026 17:10:00 -0400

The White House and South Carolina officials launched a six-month cybersecurity pilot Monday to help rural hospitals defend against hackers and keep treating patients during attacks, extending an approach first tested with water utilities in Texas.

The initiative, Project Lifeline 250, will connect participating hospitals with technology companies offering assistance at no cost. National Cyber Director Sean Cairncross and South Carolina Gov. Henry McMaster announced the effort at Newberry Health Hospital.

The program will focus on strengthening hospital networks, providing backup technology to maintain critical services after an attack and identifying and replacing high-risk or outdated devices. It brings together the Office of the National Cyber Director, South Carolina’s Critical Infrastructure Cybersecurity program, the State Law Enforcement Division and industry partners, including Cisco, Cyera, Microsoft, Trellix and Zscaler.

“Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical back up devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” Cairncross said.

The launch follows Project Watershed 250, a six-month pilot announced Aug. 31 in San Antonio, Texas. That effort pairs Texas water and wastewater providers with government and private-sector specialists to find security weaknesses and help fix them using cybersecurity and artificial intelligence tools.

Both projects seek to bring technical assistance to organizations that provide essential services but often lack the money and staff to adequately secure their systems. Officials did not specify when the six-month period would begin or how assistance would be maintained and financed if the program expands.

Cairncross had previously previewed plans to expand beyond the water sector at September’s Billington Cybersecurity Summit, saying the administration wanted to test specific solutions before applying them more broadly.

Hospital cyberattacks can interfere with the systems clinicians use to retrieve medical records, review test results and coordinate care. Rural providers typically have fewer financial resources than larger health systems to protect those functions.

Other incidents present even greater risks. Critical patients were diverted from the University of New Mexico Health System on Monday following a cyberattack that severely disrupted operations.

And in South Carolina, the state’s AnMed health system experienced weeks of disruption after a July cyberattack, including limited access to medical records. Its emergency and urgent care locations remained open, but normal operations did not resume until mid-September.

The major 2024 hack of UnitedHealth’s Change Healthcare subsidiary delayed prescriptions and disrupted insurance payments across the country, leaving rural clinics and hospitals struggling to cover expenses. It impacted roughly 193 million people, according to an analysis from the Department of Health and Human Services posted last year.

]]>

NIST issues roadmap for transition to post-quantum encryption standards

Grace Dille — Tue, 27 Oct 2026 14:45:00 -0400

The National Institute of Standards and Technology issued a report on Tuesday outlining how federal agencies and industry partners should transition to post-quantum cryptography standards, giving organizations a clearer roadmap and timeline for their PQC transition.

The report, titled Transition to Post-Quantum Cryptography Standards, identifies quantum-vulnerable algorithms and the post-quantum algorithm standards designed to replace them. NIST released PQC standards designed to withstand the attack of an eventual fault-tolerant quantum computer in August 2024.

“The report describes different use cases and says why one migration might take longer than another,” Dustin Moody, a NIST mathematician who heads the PQC standardization project, said in a press release. “We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing.”

The report acknowledges that, while quantum computers are still in development, the transition to PQC is urgent due to the “harvest now, decrypt later” threat, where adversaries collect sensitive data now with the intention of decrypting it once a cryptographically relevant quantum computer emerges.

National Security Memorandum 10 set the year 2035 as the target for completing the migration to PQC across federal systems. However, an executive order signed by President Donald Trump in June of this year accelerated this timeline.

Under the order, agencies are required to transition all high-value assets and high-impact systems to PQC for key establishment by 2030 and digital signatures by 2031.

NIST’s report supports the implementation of the June executive order and subsequent guidance from the Office of Management and Budget, which gives agencies until 2035 to complete their PQC migration.

Moody said that some actions may take priority over others, such as migrating to the PQC key establishment for particularly sensitive data. The report notes that organizations can also take a hybrid approach, in which they combine conventional encryption with PQC, which NIST said is “akin to using two padlocks on a door instead of one.”

“We lay out how certain encryption algorithms people are using today will get phased out,” Moody said. “It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk. Factors like this can help an organization plan.”

NIST said the report complements the migration to PQC guidelines project at the agency’s National Cybersecurity Center of Excellence.

“The new report can help you understand the standards and requirements of the migration,” Moody said, “while the NCCoE project can show you the practical tools and blueprints to get the job done.”

According to an October report from the Government Accountability Office, federal agencies have not adequately prepared for the transition to PQC through actions like fully identifying vulnerable systems or testing quantum-resistant algorithms.

]]>

CISA gives federal agencies until Thursday to address exploited PHP flaws

David DiMolfetta — Tue, 27 Oct 2026 13:34:00 -0400

Federal civilian agencies have until Thursday to address two critical PHP vulnerabilities that CISA has now warned are being exploited by hackers, escalating the government’s response to flaws in software used to operate websites worldwide.

The Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalog Monday, setting an Oct. 29 remediation deadline. The designation marks a change from CISA’s initial warning last week, when the agency said it had not observed exploitation. The catalog entries do not identify victims or describe the evidence behind the decision, leaving the scale of successful attacks unclear.

Known collectively as PHP2Shell, the vulnerabilities can allow hackers to run commands on a web server without an account or password, potentially enabling them to steal data or alter a website.

PHP handles tasks such as processing forms and retrieving information for websites built with WordPress, Drupal and other platforms. Because the defects are in PHP itself, a website can be exposed even if its own code and plugins are up to date.

The federal action follows several days of attempted hacks, alongside conflicting assessments of whether those attempts worked. Cloudflare reported millions of attempts last week.

Two security companies have since corrected earlier findings about the vulnerabilities. Sophos said its initial report of successful exploitation instead reflected scanning and failed attempts. Palo Alto Networks’ Unit 42 said Sunday that it could not confirm PHP2Shell was the entry point in an attack against a European government agency, retracting an earlier assessment.

The extent of federal exposure also remains uncertain. A Nextgov/FCW review last week found roughly 900 Shodan search results associated with federal, state and local government websites that showed signs of PHP use, though many of those PHP builds may have already been updated or were up-to-date prior to the vulnerabilities becoming public.

Repairs are progressing globally. Censys’ PHP2Shell tracker listed more than 10 million services as patched since Oct. 21. PHP’s developers released fixes last week.

CISA has urged organizations to locate PHP across their systems, including where it is embedded in other software, and prioritize internet-facing installations. Systems that can’t be promptly updated should be taken offline, according to its alert.

]]>

CISA plans service review, sharper focus on critical infrastructure threats

David DiMolfetta — Mon, 26 Oct 2026 11:49:00 -0400

The Cybersecurity and Infrastructure Security Agency will review its services and concentrate resources on infrastructure whose disruption would cause the greatest harm, under a strategy released Monday that calls for a more targeted approach to defending essential systems.

The CISA 2030 strategy directs the agency to use intelligence about hacking threats and the potential consequences of intrusions to decide where assistance and investment should go. It also emphasizes removing hackers from networks before they can disrupt operations.

“We will deprioritize threat-agnostic, all-hazards approaches and embrace risk-informed, consequence-based analysis,” the document reads.

The agency would focus more closely on infrastructure whose loss would most affect public safety, the economy and national security. The strategy does not identify which services would receive fewer resources or which components would take priority.

CISA will begin reviewing its core services and capabilities within 60 days to determine how they support the strategy’s objectives. That deadline applies to starting the review, not completing it. Within 180 days, the agency will deliver an approach for implementing the strategy and measuring results. A progress update is due within 365 days.

The plan comes as CISA works to rebuild after workforce reductions in President Donald Trump’s second term have impacted roughly a third of its staff. Acting Director Nick Andersen said in September that about 250 prospective employees had tentative offers and were awaiting clearance, with hiring focused on operational teams and regional personnel. Over the last several weeks, CISA has regularly posted LinkedIn updates highlighting batches of new hires.

The document also argues that CISA’s shifting responsibilities and “unclear” priorities have weakened its focus. The agency does not name specific programs, though the criticism follows the administration’s push to curtail much of the agency’s election security and disinformation work, which Trump officials have characterized as censorship and mission overreach.

The dispute dates to Trump’s firing of then-CISA Director Chris Krebs after he affirmed the results of the 2020 election, contradicting the president’s unfounded claims that it was stolen. Trump officials have since cited censorship allegations to justify shrinking CISA, while former officials have warned that the reductions weaken its broader ability to protect infrastructure from hackers.

Andersen calls for an “aggressive, anticipatory stance” to remove adversaries from defense-critical infrastructure before they can use that access against the United States. The strategy describes defensive work with partners but does not establish new legal authorities.

CISA plans to coordinate more closely with intelligence agencies and infrastructure operators, improve threat alerts and help the White House develop a National Risk Register to identify and quantify infrastructure risks.

The plan also calls for protecting operational technology — the equipment and software that control physical processes at water plants, factories and other facilities. Other priorities include software-security guidance and addressing risks from artificial intelligence — described in the document under Trump-era terms as “super intelligence” — and quantum computing. CISA also plans to expand emergency communications using newer cellular networks and commercial satellites.

“We must ensure that when adversaries gain a foothold, we are prepared to detect them quickly, evict them decisively, and keep critical operations running without interruption,” Andersen writes in the strategy document.

]]>

CISA vulnerability response chief departing agency after nearly six years

David DiMolfetta — Fri, 23 Oct 2026 11:53:00 -0400

Lindsey Cerkovnik, a senior Cybersecurity and Infrastructure Security Agency official whose office helps oversee a key global system for tracking software vulnerabilities, is leaving government service this week after nearly six years at the agency.

Cerkovnik, CISA’s branch chief for vulnerability response and coordination, announced her departure in a LinkedIn post. She said she would begin a new role in mid-November.

In a message to Nextgov/FCW, she declined to comment on her next position for the time being. It was not immediately clear who would take over her responsibilities at the cyber agency.

The exit is significant because it comes amid global discussions over how to sustain a bedrock vulnerability-tracking program Cerkovnik’s office helps oversee. Last year’s near-expiration of the federal contract supporting this framework, known as the Common Vulnerabilities and Exposures Program, highlighted how heavily a resource used by governments and businesses worldwide depended on continued U.S. support.

CISA extended the contract, averting a possible interruption in data flows, but the episode spurred calls for firmer congressional backing⁠ as AI-assisted research increases the volume of flaws organizations must assess and address.

CVE assigns standardized identifiers to software flaws so researchers, vendors and governments can track the same problems. It’s used by virtually all cyber practitioners, ranging from software developers in the private sector to analysts inside national intelligence agencies.

At an August panel during the Black Hat cybersecurity conference moderated by Nextgov/FCW, Cerkovnik said the CVE program could keep up as researchers discover more software flaws. But the harder task, she said, would be helping organizations distinguish weaknesses that pose a serious threat from those that are less urgent to fix.

“Not all vulnerabilities matter at the same level,” she said. She also supported giving CVE a formal basis in federal law but cautioned against rigid rules that could hinder its response to emerging cyber threats.

Cerkovnik joined CISA in May 2021 to lead vulnerability management for industrial control systems, the technology used to operate equipment in factories, utilities and other critical infrastructure. She became branch chief in May 2023 after serving as acting chief of the agency’s vulnerability response and disclosure section, according to her LinkedIn profile.

Before CISA, she spent more than four years at Idaho National Laboratory, working on control systems cybersecurity and cyber investigations.

Her work has involved programs that help agencies and businesses identify security weaknesses, share information about them and decide which need urgent repairs. In her post, she highlighted the agency’s response to Log4Shell, the launch of a coordinated vulnerability disclosure platform and work on the Known Exploited Vulnerabilities catalog.

That catalog identifies flaws that hackers have already exploited, helping organizations prioritize fixes.

Cerkovnik’s departure also comes as artificial intelligence-assisted vulnerability research puts new pressure on efforts to clamp down on digital security flaws before hackers can exploit them. This week, CISA joined the NSA and FBI in urging organizations to fix critical flaws in PHP, widely used software that helps run websites worldwide.

]]>