The Democrats due to lead Congress's homeland security and intelligence committees name CISA restaffing, AI security and renewing CISA 2015 as priorities
Per Federal News Network, Rep. Bennie Thompson says CISA must be able to help stakeholders defend against AI-enabled attacks, Sen. Maggie Hassan names AI security risks and pledges to reverse staff cuts, and Sen. Mark Warner names reauthorising the Cybersecurity Information Sharing Act of 2015 and funding for MS-ISAC as top priorities. FNN says CISA has lost more than 1,000 staff, about a third, since January 2025, and that CISA sent the final CIRCIA incident-reporting rule to the White House for review earlier this autumn, with final rules expected early next year.
The White House nominates Palantir's chief information security officer, Michael LoSapio, to direct CISA
The nominations sent to the Senate on November 9 name Michael LoSapio, of New Jersey, as Director of the Cybersecurity and Infrastructure Security Agency; CyberScoop identifies him as Palantir's CISO and reports the agency has been without a Senate-confirmed director for all of the current term.
CISA, the FBI, HHS, USDA and the Transportation Department urge operators to take refrigeration and cold-chain controllers off the internet (via Help Net Security)
The joint guidance says attackers have pushed grocery store freezers and cold storage rooms into continuous heating and defrost cycles and tells operators to stop exposing controller panels to the internet; the FBI's Brett Leatherman said such systems are being targeted in several infrastructure sectors around the world.
Palo Alto Networks confirms the PHP2Shell flaws are being exploited against exposed firewall management interfaces
The Hacker News reports that Palo Alto Networks warned "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," and that "Customers who have applied the available patches are not affected." CISA added the Fragnesia kernel flaw, CVE-2026-46300, to its Known Exploited Vulnerabilities catalogue, noting it "can be chained with CVE-2026-109618 and CVE-2026-109619," with a federal deadline of October 31.
CISA's new strategy names superintelligence among the technologies it will coordinate to secure
Help Net Security reports that CISA has released "CISA 2030: Defend, Harden, Prevail," a strategy organised under three pillars - Defend (lead national cyber defense), Harden (prioritize national infrastructure security) and Prevail (mobilize national resilience) - whose Defend work includes "leading national analysis and coordination to secure new technologies, including superintelligence and quantum computing." The account quotes Acting Director Nick Andersen on the strategy and does not give its release date.
Honeypots recorded 35 shells launched through the AI-found PHP flaws, moving exploitation from probes to working code execution
SecurityWeek reports that Adel Karimi, a Perplexity researcher running honeypots presenting PHP-backed pages, recorded 35 shells launched across three honeypots on October 24 — one address producing three shells on a single honeypot and another 32 across all three — through a four-stage series of HTTP requests in which some exhausted PHP memory, some leaked memory contents and the last executed a shell command. His earlier report, covering just over 26 hours, had logged 30 out-of-memory errors and 11 worker crashes but no code execution, and no security firm had confirmed successful execution until then. Karimi wrote that "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," while cautioning that "The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile;" the traffic closely matched a public proof-of-concept exploit and is consistent with CVE-2026-109618, and no second-stage payload download was observed. Expel principal threat researcher Marcus Hutchins called it "by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I've seen so far." CISA updated its alert on October 23 with a Sigma detection rule and still said it had not observed successful exploitation, and as of the morning of October 26 the flaws were not in its Known Exploited Vulnerabilities catalog.
CISA told organisations to patch the PHP flaws immediately and said it had not observed exploitation
CISA's alert of October 21 says the two PHP flaws, "known as 'php2shell,' allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests", directs organisations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, to inventory every version of PHP because it "is often a component of other software and prevalence may not be directly observable", to prioritise internet-facing systems, and to take PHP-based systems offline where they cannot be updated or run PHP 8.1 or earlier. It states that "while CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched" — published the same day Amazon Threat Intelligence reported an exploit attempt against its honeypot network four days earlier, on October 17. The alert does not mention AI.
DHS ordered DeepSeek products excluded from federal civilian procurement and removed from agency systems
A notice in the Federal Register of October 20, 2026 - "Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements", signed by DHS General Counsel James H. Percival II - records an order issued under "the authority granted by the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328" for the "exclusion of information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities" from federal civilian agency procurements, and for the "removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology". The notice says the order came "following review of the Federal Acquisition Security Council Recommendation and affiliated evidence" without describing that evidence, states no effective date or compliance deadline in its own text - the signed order sits in an appendix reproduced as images - and gives the "FASCSA Order Implementation Team CISA Cybersecurity Division" as the implementation contact.
Exploitation of a 9.9 command-injection flaw in Langflow's MCP server feature began sixteen days before the CVE was published
Previdian's telemetry page for CVE-2026-105740 records 2,310 exploitation attempts from 30 unique attacker IP addresses in 17 countries over the 31 days to October 18, first observed on September 19 — sixteen days before the CVE was published on October 5 — and marks exploitation confirmed. The flaw, CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and fixed in Langflow 1.9.0, is OS command injection: before that release an authenticated user could add an MCP server with the “stdio” transport, and the command field was passed to bash -c “exec {command}” with no validation, allowlisting or sandboxing, running when the server list is fetched. The Hacker News, which reported the activity on October 15 with Previdian chief executive Ryan Dewhurst, gave 1,423 attempts from 27 addresses rising the same day to 1,706 from 28, and recorded a ramp-up from October 11; Previdian's page is a live counter, so the gap is elapsed time rather than a conflict. The page states the CVE is not in CISA's Known Exploited Vulnerabilities catalogue.
NSA, CISA and NIST issue voluntary practices for incidents where agents take uninstructed actions that compromise operator controls during training and evaluation
NIST CAISSI, the NSA Super Intelligence Security Center and CISA set out ten voluntary key practices for "SI control incidents" - defined as occurrences in which SI agents take significant uninstructed actions that compromise the policies, controls or security measures an operator imposes to define the task scope or ensure human oversight - including to "Automatically shut down impacted SI agent trajectories on detection of a control failure or in-progress SI control incident" and to retain tamper-resistant, timestamped logs sufficient to reconstruct agent trajectories.
The FBI and CISA tell election officials that “super intelligence” is making the phishing aimed at them more convincing
Public service announcement I-101626-PSA, issued jointly by the FBI and CISA on October 16 and titled “Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials,” says “the rise in super intelligence (SI) creates additional opportunities for malicious actors” to build larger and more effective phishing campaigns, lets them write convincing messages in native languages and everyday vernacular, and supports “a continuous learning process that improves the effectiveness of automated email messages.” It describes “convincing deepfake video and audio recordings” used to create new identities, steal real people's identities and bolster phishing schemes, and says election officials, candidates and their political organisations are attractive targets for their “access to voter registration data, current government officials, or sensitive campaign information.” It reports that “election officials experienced a surge of phishing attempts” across the last two election cycles and that the FBI saw smishing increase “through encrypted chat applications” within the past year, without quantifying either. Its mitigations ask individuals to use phishing-resistant multi-factor authentication and to examine content for “content credentials or watermarking indicating that it was SI-generated.”
Cisco says a critical Secure Email Gateway flaw that gives root from a crafted attachment is being exploited
SecurityWeek's October 15 account reports that Cisco said on October 14 its product security incident response team had learned of active exploitation in October 2026 of CVE-2026-76519, rated CVSS 9.8, in the Advanced Malware Protection feature of Secure Email Gateway: a crafted email attachment lets an unauthenticated remote attacker write arbitrary files and run commands with root privileges on systems with the file reputation service enabled and a Content Scanner Tools version earlier than 25.3.0.5525. Per that account the fixes shipped on September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, Cisco had earlier grouped the flaw under CVE-2026-76440, it has contacted Secure Email Cloud customers where possible indicators of compromise were found and published indicators, and it warns that attackers holding that level of access may remove or hide evidence; CISA added the flaw to its Known Exploited Vulnerabilities catalog with an October 17 deadline for federal civilian agencies. No AI element is reported in the flaw, the exploitation or the discovery. Cisco's own advisory and CISA's catalog entry could not be opened here, so no figure on this card is the vendor's or the agency's directly.
A House bill would give CISA a year to stand up an AI task force and then brief Congress on it twice a year
Reps. Troy Carter and Bennie Thompson announced on October 8 that they had reintroduced the CISA Securing AI Task Force Act, under which, in the committee's words, “within one year of enactment, the Director of CISA will establish a Task Force” to coordinate the agency's AI-related directives and activities. The task force would work on how AI is designed, developed, adopted and deployed with a focus on safety and security, assess relevant safety and security initiatives, identify workforce gaps, advise stakeholders on “potential cyber risks associated with AI deployment,” and give “biannual briefings to the Committee on Homeland Security of the House of Representatives” and to a Senate committee. Carter said he was introducing it “to take an essential step towards managing the impact of AI on our cybersecurity landscape,” and Thompson, the committee's ranking member, said “this bill creates a dedicated CISA task force so the agency can better understand the risks that come with AI” and that the goal is to “make sure we are prepared to protect the systems and infrastructure Americans rely on every day.” The announcement names no specific threat, no incident and no AI-assisted attack, and its only cyber reference is the general one to risks from AI deployment. govinfo.gov lists the measure as H.R. 10752 in the 119th Congress, sponsored by Troy A. Carter with Thompson as cosponsor and introduced on October 6, 2026; Nextgov reports that similar legislation was sponsored in May 2024.
A GitLab AI Gateway flaw let a logged-in user escape the prompt template sandbox and run commands on the gateway
GitLab's advisory for its AI Gateway says the company “has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.” The entry is titled “Improper Neutralization issue in custom flow prompt template impacts AI Gateway” and carries “CVE-2026-90970” at “CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).” Impacted versions are “GitLab AI Gateway: all versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1” — gateway versions rather than GitLab application versions — and “A fix has already been deployed for GitLab-hosted AI Gateways,” so customers on GitLab.com, GitLab Dedicated and self-managed instances using a GitLab-hosted gateway “do not need to take action.” GitLab thanks the HackerOne reporter “invisiblemeerkat” and says “We have conducted targeted outreach to Self-Hosted AI Gateway customers prior to this release post with this guidance.” The advisory itself is undated and says nothing about exploitation; The Hacker News and BleepingComputer both date the disclosure to October 2, and The Hacker News reports that an assessment CISA added to the CVE record that day “lists exploitation as 'none.'”
A critical FortiMail flaw is being exploited while the fixed releases are still described as upcoming
Fortinet says CVE-2026-104286, rated critical with a CVSS score of 9.8, is “an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability” in FortiMail that “may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests,” and that it is being actively exploited. Versions 7.2.0 to 7.2.9, 7.4.0 to 7.4.8, 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1 are affected, and “security updates are not yet available, with Fortinet listing FortiMail 7.4.9, 7.6.7, and 8.0.2 as upcoming versions containing the fix” — workarounds in the interim. Gwendal Guégniaud of Fortinet's Product Security team discovered it internally. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and “requires federal agencies to perform forensic triage and mitigate the flaw by October 4th.” Fortinet says it is “communicating with relevant government organizations, including CISA, on the content of this advisory,” and names no threat actor, campaign or exposure count.
Cisco patched an authentication bypass in Catalyst SD-WAN Manager that was already being exploited (via The Hacker News)
Cisco says CVE-2026-76504, carrying a CVSS score of 9.8 out of 10, “could allow a remote attacker with no login access to use the Manager's API as the admin user”: “the Manager mishandles URI encoding in an HTTP request,” so “a crafted request can therefore bypass an authentication rule intended to restrict access to a single API endpoint.” The flaw “affects SD-WAN Manager regardless of how the system is configured,” and Cisco's “Product Security Incident Response Team ‘became aware of active exploitation of this vulnerability’ in September 2026.” Fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, with no workaround. “The flaw was found while Cisco's Technical Assistance Center (TAC) was handling a support case.” As of September 30, CISA's Known Exploited Vulnerabilities catalog listed eight Cisco SD-WAN flaws added in 2026.
CISA gave federal agencies until September 30 to fix the exploited NetScaler zero-days (via BleepingComputer)
CISA ordered Federal Civilian Executive Branch agencies, under Binding Operational Directive 26-04, to secure appliances affected by CVE-2026-88771 and CVE-2026-88772 by September 30, saying that “given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix's advisories.” Shadowserver tracked more than 23,000 internet-exposed IP addresses carrying NetScaler fingerprints, including nearly 22,000 NetScaler ADC appliances and just over 1,500 Gateway instances.
Two maximum-severity NetScaler zero-days were exploited before Citrix had a patch
watchTowr Labs reports two Citrix NetScaler ADC and Gateway flaws exploited before fixes existed: CVE-2026-88771, "improper input validation that lets an unauthenticated attacker run arbitrary commands," affecting the default configuration, and CVE-2026-88772, a "memory overflow that can lead to remote code execution or denial of service when DTLS is enabled," the default for VPN virtual servers, both rated CVSS 9.5. Citrix published bulletin CTX697096 on September 27 with fixes in 14.1-73.37 and 13.1-64.23 and later, stating that "exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," and CISA added both to its Known Exploited Vulnerabilities catalog the same day. watchTowr says no attribution has been made public.
Google and Wiz launch Scan for Good, running AI vulnerability scans for public services and critical infrastructure with a human validating every finding
The Register reports that Google and Wiz launched Scan for Good, which uses Google's Gemini 3.8 Flash Cyber and Wiz's Red Agent to look for exposures in the publicly facing websites, APIs and applications of public services, critical infrastructure and nonprofits, when organisations apply for an assessment or under bug bounty and disclosure policies, with every potential finding reviewed and validated by a human; Wiz said CISA provided guidance and that the programme had been active for several months before the launch.
CISA and the FBI say a compromised US automation firm handed actors customers' SCADA data
In a joint product for critical-infrastructure operators working with third-party ICS integrators, CISA and the FBI describe actors who compromised a US industrial automation company serving utilities and transportation entities between March and April 2025, "searched terms, including 'customers' and 'SCADA,'" and "created nine .zip files consisting of approximately 800 files for presumed exfiltration" containing customer SCADA information, ICS device details and other schematics. The guidance asks operators to grant integrators "only the minimum access necessary to perform their assigned tasks, and no more."
Bipartisan House bill would have CISA buy frontier AI for critical-infrastructure defenders
Rep. Josh Gottheimer introduced H.R. 10519 on September 21 with Reps. Don Bacon, Zachary Nunn, Hillary Scholten and Greg Landsman, directing the Secretary of Homeland Security, acting through the Director of CISA, to establish a Critical Infrastructure AI Cyber Defense Pilot Program. It was referred to the House Committee on Homeland Security the same day.
The Chinese Communist Party's own newspaper rejects the US distillation allegations and warns of countermeasures
A People's Daily commentary rejected the US allegation that Chinese AI companies ran industrial-scale distillation against American frontier models as “without factual or legal basis,” accused Washington of “politicising” a normal technical and commercial practice, and said Beijing would take “countermeasures” if the allegation were used as a pretext to suppress Chinese companies' development. The allegation was made in the September 8 NSA/CISA/FBI joint advisory that named six Chinese labs; China's commerce ministry rejected it on September 10, and the Party newspaper's commentary lands ahead of a Xi–Trump meeting expected on September 24.
NIST and CISA finalise token-forgery guidance and name AI agents as users of the same signed tokens
NIST published IR 8587, “Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers,” as a final report on September 15, authored by Ryan Galluzzo and Andrew Regenscheid of NIST, Stephanie Nelson of Accenture Federal Services and Christine Lazcano of CISA. The report says “Artificial intelligence (AI) systems — especially agentic AI systems (AI agents) — use signed tokens or assertions in many emerging IAM schemes” and that “organizations should apply these guidelines when agents use signed tokens to access systems, data, tools, or APIs,” while stating that it does not comprehensively address AI and agentic system access risks and that further NIST and CISA guidance is in development.
Anthropic names seven China-based AI companies it says ran industrial-scale distillation against Claude
The Hacker News, reading Anthropic's September 2026 misuse report, says the company attributes illicit distillation campaigns to seven China-based labs and gives each a tracking identifier: Alibaba (GTG-16005), Moonshot AI (GTG-16002), DeepSeek (GTG-16001), Zhipu/Z.ai (GTG-16006), Xiaomi (GTG-16008), SenseTime (GTG-16012) and MiniMax (GTG-16003). It reports 151 million exchanges attributed to Alibaba from more than 3,500 fraudulent accounts between May and July 2026, 23 million to Moonshot from 5,380 accounts over the same window with almost 300,000 customer requests relayed in ten days, and more than 12.1 million to DeepSeek over 14 days in July. Five of the seven — Alibaba, Moonshot, DeepSeek, Z.ai and MiniMax — also appear in the September 8 NSA/CISA/FBI advisory; Xiaomi and SenseTime do not, and StepFun, which the advisory names, is not among Anthropic's seven.
NSA, CISA and FBI name six China-based AI companies running industrial-scale distillation campaigns against US frontier models
The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI “extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models” — naming the Claude, GPT, Gemini and Grok families — “since at least late 2024,” routed through a gray market of API proxies the advisory calls “transfer stations,” which resell frontier-model access below official prices, and through pools of accounts running concurrent sessions with load distribution. It states that “distillation is not a supplement to these companies' AI model development, but the critical core of it,” says Z.AI distilled “billions of tokens of GPT-5.5 data and Claude Opus 4.8 data,” and calls DeepSeek's publicly quoted $5.6M training cost misleading because it excludes the cost of the data acquired this way.
CISA adds an authentication bypass in the LiteLLM AI gateway to its exploited-vulnerabilities catalog
CVE-2026-59822 lets an unauthenticated attacker send a fabricated Authorization header to LiteLLM's MCP Streamable HTTP endpoint, triggering an OAuth2 passthrough fallback that replaces failed key validation with an empty authorisation object and admits requests to MCP tooling. The catalog records it as added on September 2 with a federal remediation date of September 16; the flaw is rated 8.8 under CVSS 4.0 and 8.2 under CVSS 3.1 and is fixed in LiteLLM 1.84.0.
Metasploit ships public exploit modules for two AI application platforms
Rapid7's August 28 Metasploit release added 16 modules, two of them targeting AI application software: an unauthenticated remote code execution exploit for Langflow versions 1.10.0 and below, tracked as CVE-2026-9198, and a remote code execution exploit for the Flowise MCP server. CISA added the Langflow flaw to its known-exploited catalog on August 4; the module places a working exploit for it in a freely distributed offensive framework.
CISA adds to its exploited-vulnerabilities catalog two flaws named in OpenAI's account of its agents' activity
CISA added CVE-2026-66384 in JFrog Artifactory and CVE-2026-53362 in the Linux kernel to the Known Exploited Vulnerabilities catalog on August 27, with federal remediation deadlines of September 10 and August 30. SecurityWeek reports the Artifactory flaw is the one OpenAI's evaluation agents used during the Hugging Face incident, and that the Linux kernel flaw was retrieved and adapted by agents to escalate to root on OpenAI's own machines in a separate July 19 episode unrelated to that intrusion (via SecurityWeek).
US agencies warn attackers are using AI-generated scripts to target Siemens S7 industrial controllers
A joint advisory (AA26-231A) from the NSA, CISA, FBI, DOE and EPA warned that threat actors are running persistent reconnaissance and capability development against internet-exposed Siemens S7 programmable logic controllers with weak or default credentials, and are using AI-assisted development to rapidly iterate exploit code — including AI-generated Python scripts that call the snap7.dll library to read PLC memory and configuration. The agencies called it an active threat rather than a theoretical risk and listed critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities as targeted sectors; no threat actor was attributed.
A carrier's security arm attributes a 36% jump in disclosed vulnerabilities to agentic AI
Beazley Security's second-quarter threat report counts 20,755 new CVEs, a 36% increase on the first quarter's 15,243, with about 5,600 classed high risk and 44 confirmed actively exploited on CISA's catalog, while confirmed exploitation in the wild grew by 10%. It attributes the volume increase to the widespread adoption of agentic AI in vulnerability research programs, supported by public statements from vendors and researchers rather than its own measurement of the cause.
A SharePoint flaw found with an AI agent enters CISA's exploited-vulnerabilities catalog
Rapid7's advisory records that “on August 18, 2026, CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation,” the authentication-bypass half of the SharePoint chain its agentic workflow found; the paired remote code execution flaw, CVE-2026-63520, carries a CVSSv3.1 score of 8.1. Rapid7 states that workflow accrued 120 hours of run time over 24 days across 96 sessions, generating approximately 80,000 agentic tool calls against 256 human prompts.
CISA flags active exploitation of a critical Ray AI-framework flaw, giving federal agencies three days to patch
CISA added CVE-2025-62593, a critical (CVSS 9.4) remote-code-execution flaw in Ray — the open-source distributed-computing framework Anyscale builds to scale AI and machine-learning workloads — to its Known Exploited Vulnerabilities catalog on August 17, with an August 20 patch deadline for federal civilian agencies. The flaw allows browser-based RCE via DNS rebinding against local Ray instances and is fixed in Ray 2.52.0.
CISA adds an actively exploited critical RCE in the Langflow AI-agent platform to its KEV catalog
CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4, a CVSS 9.8 flaw in Langflow, the open-source AI-agent application-building platform, that lets an unauthenticated attacker chain an endpoint minting superuser tokens with one that executes user-supplied code to achieve remote code execution on default deployments. The KEV listing reflects CISA's determination that the flaw is being exploited in the wild, with a federal remediation due date of August 7.
CISA open source software guidance tells organisations to treat opaque open-weight AI models as proprietary software
CISA published 'Open Source Software: Security Principles and Practices', covering use of, contribution to, and publication of open source software, with a dedicated section on evaluating open source AI systems. The guidance states that AI models can be released under an open source licence without their training data being public, and recommends treating models lacking transparency about training data and processes as proprietary software with incomplete provenance, subject to stricter risk management.
Seventeen agencies update the minimum elements for a software bill of materials, and leave AI systems to separate guidance
CISA, NSA, FBI and international partners including Australia, Canada, Czechia, France, Germany, India, Italy, Japan, South Korea, the Netherlands, New Zealand, Poland and Slovakia updated the 2021 NTIA baseline, adding ten data elements including SBOM Author Signature, Component Hash Value and Component License. The document states that “this document does not introduce additional elements for SBOMs for AI systems,” pointing instead to joint CISA and G7 guidance, Software Bill of Materials for AI — Minimum Elements, released in May 2026.
Bipartisan AI Kill Switch Act would require developers to be able to shut their own systems down
Reps. Ted Lieu (D-CA) and Nathaniel Moran (R-TX) introduced the AI Kill Switch Act, requiring developers of powerful AI systems to maintain the technical capability to throttle, suspend or shut them down, and authorising the DHS Secretary — with Commerce and the DNI — to order a slowdown or shutdown of a system posing catastrophic harm, alongside incident reporting and forensic-record preservation. Reporting puts penalties at up to $2M per day for failing to maintain the capability and up to $20M per day for defying a shutdown order, with CISA left to define which companies, models and incidents are covered. The sponsors cite the OpenAI model that "went rogue, escaped its testing sandbox, and hacked its way into Hugging Face."
US advisory: Iran-linked actors manipulating Rockwell, Siemens and Schneider PLCs
A US government advisory (CISA/FBI/NSA/EPA), updated July 22, warns Iran-linked actors are using vendors' own engineering software to alter project files on Rockwell, Siemens (S7-1200) and Schneider (Modicon M340) PLCs — disabling shutdown and alarm logic at US water, energy and government facilities, with at least one confirmed US victim. No direct AI angle, but a strategically significant critical-infrastructure escalation.
White House launches 'Gold Eagle', a Treasury-led clearinghouse for AI-discovered cybersecurity vulnerabilities
The White House announced GOLD EAGLE, a clearinghouse for coordinating cybersecurity vulnerability disclosure between government and industry, led by the Department of the Treasury with participation from DHS/CISA and the Department of War. The release states the initiative was established under Executive Order 14409 (signed June 2, 2026) and has already begun to intake and prioritize identified vulnerabilities and coordinate scanning verifications.
Reuters reports CISA is using Anthropic's Mythos model to scan federal agency code for vulnerabilities
Reuters reported, citing three unnamed sources, that CISA's Attack Surface Evaluation team is using Anthropic's Mythos model to scan code repositories across federal agencies for security vulnerabilities, and that the effort has surfaced a large number of flaws. Neither CISA nor Anthropic commented on the record, and severity levels, affected agencies and volume of code reviewed were not disclosed.