CySecurity News - Latest Information Security and Hacking Incidents

Cryptographically Relevant Quantum Computer Cryptography Cyber Security cybersecurity policies Enterprise security IBM quantum computer

Post-Quantum Cryptography Readiness Becomes a Strategic Cybersecurity Priority for Enterprises

Though practical quantum computers may still be years away, organizations are already preparing for the security risks they could create. Post-quantum cryptography has shifted from research into real-world planning as experts warn current encryption could eventually become vulnerable. Rather than waiting for that moment, many businesses are reviewing existing systems now.

Early preparation is increasingly viewed as essential because delaying changes could make future transitions far more difficult. Fresh policies are adding urgency by setting clear expectations for organizations responsible for protecting critical infrastructure and sensitive data. Quantum readiness is no longer seen as only an IT issue but a business-wide priority involving leadership, governance, funding, and long-term planning.

Instead of simply replacing outdated encryption, organizations are expected to build flexible strategies that can adapt to future cryptographic standards. A major concern is the “harvest now, decrypt later” threat. Attackers may steal encrypted information today and store it until quantum computers become powerful enough to decrypt it.

Intellectual property, healthcare records, financial information, source code, and government communications with long-term value could all become exposed in the future, even if current encryption remains secure against today’s computers. The challenge is no longer just preparing for future technology but protecting data that must remain confidential for years. Organizations handling highly sensitive or regulated information may need to begin migration sooner because the consequences of delayed action could be far greater.

Cybersecurity leaders recommend assigning clear ownership of post-quantum initiatives instead of leaving responsibility with individual application teams. Cross-functional groups involving security, IT, engineering, legal, compliance, procurement, and business leadership are better positioned to manage the transition since encryption supports nearly every part of modern digital operations.

A critical first step is identifying where cryptography exists throughout the organization. Many companies lack a complete view of which systems rely on specific algorithms, certificates, keys, authentication methods, APIs, cloud environments, and third-party services. Without that visibility, assessing risks or deciding migration priorities becomes extremely difficult. Security experts also stress that this inventory should remain continuously updated rather than existing as a static spreadsheet.

Ongoing visibility helps organizations identify systems requiring stronger protection, understand dependencies, provide accurate regulatory reporting, and give executives a realistic view of progress. Once cryptographic assets are fully mapped, organizations can prioritize migration based on business impact. Systems protecting customer information, healthcare data, financial services, critical infrastructure, digital identities, and software integrity generally require attention before less critical environments, allowing organizations to spread the transition over several years.

Preparing for post-quantum security also requires dedicated investment. Funding must support discovery tools, testing environments, migration programs, automation, and governance. Organizations will also need specialists with expertise in cryptography, enterprise architecture, public key infrastructure, compliance, and cybersecurity to guide the transition effectively. Long-term success depends on achieving crypto-agility—the ability to update cryptographic algorithms without rebuilding entire systems.

Rather than treating post-quantum cryptography as a one-time project, many organizations are designing adaptable security architectures capable of evolving alongside future standards. As artificial intelligence, autonomous technologies, and increasingly complex digital ecosystems continue to expand, flexible cryptographic infrastructure will become even more important.

Although no one knows exactly when quantum computers capable of breaking today’s encryption will become reality, many cybersecurity experts believe organizations should begin preparing now. Companies that establish governance, maintain visibility into cryptographic assets, and gradually modernize their infrastructure will be better positioned to adapt as quantum computing—and the security landscape—continues to evolve.

GPT-5.6 Sol Debuts With Enhanced Cyber Protections, Limited to Trusted Partners



 

OpenAI Security

AI Security Model Cyber Defense AI Cyber Security Defensive AI Frontier AI Security GPT-5.5 Cyber GPT-5.6 OpenAI GPT-5.6 Sol OpenAI Security

GPT-5.6 Sol Debuts With Enhanced Cyber Protections, Limited to Trusted Partners

An open preview of OpenAI's next-generation GPT-5.6 model family has been introduced under tight control, marking an important milestone in the advancement of frontier artificial intelligence with an equal emphasis on cybersecurity and responsible deployment. The release is anchored by GPT-5.6 Sol, the company's most advanced and security-hardened model to date.

It introduces a three-tier architecture comprising Sol, Terra, and Luna, each of which is specifically designed to meet distinct performance, cost, and deployment requirements in software engineering, scientific research, professional knowledge work, computer use, and cybersecurity. OpenAI has restricted access to its API and Codex platforms to a select group of trusted partners following a formal request from the Trump administration rather than releasing the technology to the general public immediately.

As a result, a cautious strategy emphasizes rigorous security evaluation, controlled real-world testing, and resilience against misuse before the product is available in broad markets.

GPT-5.6 Introduces a New AI Model Architecture

Moreover, OpenAI is transforming its product architecture, replacing sequential branding with permanent capability tiers in addition to its flagship launch. A long-term restructuring of OpenAI's model portfolio is also part of the GPT-5.6 release, replacing sequential branding with permanent capability tiers that differentiate performance, efficiency, and deployment.

Sol is the flagship model for advanced reasoning and technical tasks within this framework, Terra delivers performance comparable to GPT-5.5 at approximately half the operational cost for enterprise-scale deployments, while Luna is designed to achieve low latency and low operating cost for high-volume inference applications. Instead of GPT-5.5, which emphasized reasoning and coding improvements, GPT-5.6 emphasizes defensive cybersecurity, controlled deployment, and capability-specific safeguards, reflecting the general trend toward the advancement of security-aware frontier AI.

The company states that the phased deployment reflects ongoing engagement with federal authorities in an effort to align future frontier AI releases with the objectives outlined in the recent Executive Order governing the assessment of advanced artificial intelligence systems for national security purposes.

Preparedness Framework Strengthens Cybersecurity Safeguards

Security remains central to the GPT-5.6 rollout. In its Preparedness Framework, OpenAI has categorized Sol, Terra, and Luna as High Capability models for both cybersecurity, biology, and chemical domains. However, none of these models currently meet the threshold for AI self-improvement as a High Capability model.

To reduce the increased dual-use risks associated with increasingly capable foundation models, the company has adopted capability-specific safeguards rather than a uniform protection layer in order to mitigate this risk. By combining policy-level restrictions with automated classifiers, cybersecurity- and biology-related prompts are continuously analyzed in real time through the security architecture.

When potentially high-risk interactions are detected, response generation is temporarily halted until a secondary reasoning model reviews the conversational context to determine whether or not to allow or restrict responses. A risk assessment can also be conducted by OpenAI at an account level to help differentiate legitimate security research and vulnerability analysis from potentially malicious behavior.

GPT-5.6 Sol Demonstrates Strong Defensive Security Performance

The OpenAI benchmark results demonstrate that GPT-5.6 Sol provides competitive performance in defensive cybersecurity tasks while operating with significantly higher computational efficiency as compared to GPT-5.6 Sol. Sol was able to achieve results comparable to those of leading frontier systems such as Mythos Preview when evaluated on ExploitBench with one-third more tokens required for output.

In internal testing of large Chromium and Firefox codebases, the model demonstrated the capability of identifying software flaws, isolating vulnerabilities, and providing patching advice as well as basic exploitation primitives. In addition, OpenAI pointed out that the system did not independently develop complete multistage exploit chains, reinforcing its goal of supporting defensive security research rather than facilitating offensive cyber operations.

Red-Teaming and Safety Testing Ahead of Deployment

The OpenAI preview version included more than 700,000 A100-equivalent GPU hours of automated red-teaming for further strengthening resilience against misuse. Rather than focusing solely on isolated prompt failures, the testing program targeted systemic weaknesses as well as universal jailbreak techniques capable of bypassing model safeguards across a variety of scenarios, thereby enhancing resilience against misuse.

In the coming week, OpenAI plans to make the models available to a wider range of API and Codex partners. Additionally, OpenAI warns against making government-mediated pre-clearance a permanent requirement for frontier AI deployments. As a result of prolonged restrictions, advanced defensive capabilities may not be available as needed by the wider cybersecurity community to combat rapidly evolving threats if they are prolonged.

Pricing, Capability Tiers and Enterprise Availability

Additionally, OpenAI has revised its naming strategy with generation numbers identifying the model family, and Sol, Terra, and Luna remaining persistent capability layers. A tiered pricing structure based on token consumption has been established by the company, with GPT-5.6 Sol charging $5 for a million input tokens and $30 for a million output tokens, Terra charging $2.50 per input and $15 per output, and Luna charging $1 per input and $6 per output, in accordance with the performance profiles and deployment scenarios of each model.

As part of OpenAI's ongoing commitment to the enterprise, GPT-5.6 Sol will be released on Cerebras in July, delivering inference speeds of up to 750 tokens per second for enterprises with high-throughput AI requirements.

Government Oversight Shapes GPT-5.6 Rollout

GPT-5.6's limited release has also been the focus of an ongoing debate concerning national security oversight of frontier AI systems as a result of the limited release. According to OpenAI, the decision was made to limit the initial release following the Trump administration's request for a staggered rollout as government agencies evaluated the impact of the model's advanced capabilities.

Sam Altman, the Chief Executive Officer of OpenAI, has subsequently advised employees that access to the preview will be approved individually as part of the coordinated rollout process. The request was made in consultation with the Office of the National Cyber Director, the Office of Science and Technology Policy, and Howard Lutnick, Secretary of Commerce.

It was openAI's belief that government-mediated access should continue to be an exceptional measure rather than a long-term deployment model, even as it cooperated with the temporary review process, arguing extended restrictions may deter developers, enterprises, and cybersecurity practitioners from implementing critical AI capabilities.

New Reasoning Modes Expand Defensive AI Capabilities

Along with deployment and governance, OpenAI has also enhanced the defensive security capabilities of GPT-5.6. According to OpenAI, GPT-5.6 is designed to make prohibited offensive activities more difficult, uncertain, and detectable while preserving legitimate applications such as code review, vulnerability research, patch development, and defensive security testing.

The Max Reasoning Effort mode introduced in GPT-5.6 supports this approach by allowing Sol to allocate considerable computational resources to complex problems before providing responses. With Ultra reasoning, the execution of long-term tasks which require sustained planning and multi-step analysis is enhanced beyond conventional single-agent execution by orchestrating multiple parallel subagents capable of collaborating collaboratively.

Scientific Benchmarks and OpenAI's Cybersecurity Roadmap

GPT-5.6 is the latest model family from OpenAI that demonstrates the company's commitment to AI-based defensive cybersecurity. Additionally, the company recently introduced GPT-5.5-Cyber as part of its Daybreak initiative, a specialized model for automated vulnerability discovery, patch generation, and software remediation.

The OpenAI model achieved state-of-the-art performance across CyberGym (85.6%), ExploitGym (39%), and SEC Bench Pro (69.8%), a significant improvement over GPT-5.5 baselines. Additionally, GPT-5.6 Sol has demonstrated improved performance on GeneBench v1 and improved reasoning efficiency, indicating that the latest releases are an integral part of a broader strategy: advancing frontier AI capabilities while also investing equally in tools and safeguards necessary for enhancing cyber defenses.

Five Eyes Warns New AI Models Pose Urgent Cyber Risk



 

Threat Intelligence

AI Threat Business Security Cyber Security Five Eyes Threat Intelligence

Five Eyes Warns New AI Models Pose Urgent Cyber Risk

The Five Eyes intelligence alliance has issued a stark warning that the latest generation of artificial intelligence could reshape the cyber threat landscape much faster than most organizations expect. In a joint advisory, intelligence and cybersecurity leaders from the United States, the United Kingdom, Canada, Australia and New Zealand said frontier AI models are advancing so quickly that long-standing assumptions about cyber risk may become outdated in only a matter of months.

The message is clear: AI is no longer just a productivity tool or a research breakthrough. It is also a force multiplier for attackers who want to move faster, exploit weaknesses sooner and launch more sophisticated campaigns. According to the advisory, AI can lower the barriers for malicious actors by making phishing, malware development and vulnerability discovery easier and more efficient.

That means attackers with limited technical skill may soon be able to carry out actions that once required experienced operators, while more advanced threat groups could automate parts of their workflow at greater scale. The intelligence chiefs said the risk is not theoretical, because the speed of AI development is already changing how quickly vulnerabilities can be found and weaponized. As a result, organizations that wait for mature standards may find themselves exposed before they realize the threat has changed.

The alliance also emphasized that cyber risk should be treated as a business risk, not just an IT issue. Its guidance urges leaders to understand risk, strengthen foundational security controls and give cyber teams enough authority and resources to respond effectively. The warning stresses that breaches are inevitable, so preparedness matters as much as prevention. In practice, that means testing incident response plans, training staff and making sure the organization can contain and recover from an attack before it turns into a wider operational or financial crisis.

Five practical steps were highlighted as urgent priorities: reduce unnecessary exposure, accelerate patching, address legacy systems, strengthen identity and access controls and prepare for incidents in advance. The advice is especially relevant because outdated systems and slow patch cycles remain common weaknesses across both public and private sectors. By limiting attack surfaces and tightening access, organizations can reduce the chances that AI-assisted attackers will find an easy opening. The core message is that resilience must be built before a crisis starts, not after.

For businesses, the report is a reminder that AI’s cyber impact is arriving faster than policy and governance often do. The Five Eyes warning does not argue that AI should be avoided; instead, it says AI should be used deliberately to strengthen defense while leaders move faster on security basics. In other words, the organizations most likely to cope with AI-driven threats will be those that treat cybersecurity as continuous readiness, not a one-time compliance exercise.

Agentic AI Has Become an Identity Crisis for Enterprise Security Teams



 

technology

agentic AI API Cloud Computing DevOps saas technology

Agentic AI Has Become an Identity Crisis for Enterprise Security Teams

Every major technological change has followed a familiar pattern: organizations embrace innovation first, while security teams are left adapting controls after deployment. Cloud computing, Software-as-a-Service (SaaS), and DevOps all reshaped enterprise security in this way. Agentic AI is now driving the next transformation, but with a more complex challenge. Unlike conventional applications, AI agents actively authenticate, interact with APIs, query databases, generate code, and execute workflows across production environments, often using credentials and permissions that organizations have yet to fully catalogue.

This changes the conversation around AI security. Rather than focusing solely on what an AI model can generate, security leaders must determine who an AI agent represents, what systems it can access, who is accountable for its actions, and whether its privileges can be modified or revoked as business requirements evolve.

Traditional identity and access management programs were designed around employees whose access follows established roles and review processes. The rapid expansion of machine identities, including service accounts, API keys, certificates, and workload identities, already challenged that approach. Autonomous AI agents introduce another level of complexity because they can interpret objectives, make decisions, and perform actions independently while operating at machine speed. They can also be deployed by developers, embedded into SaaS platforms, delegated permissions by users, and continue running long after their original purpose has ended.

Static access controls are increasingly inadequate for these systems. An AI assistant summarizing customer support tickets requires far fewer privileges than one capable of issuing refunds, modifying customer records, or deploying production infrastructure. Instead of relying on permanent permissions, organizations should adopt contextual, task-specific, time-limited, and continuously evaluated access policies that adjust according to an agent's responsibilities.

The rapid growth of agentic AI also introduces three identity risks that security teams cannot ignore. Many enterprises already lack visibility into AI agents operating across cloud services, developer environments, and business applications, making ownership and accountability difficult to establish. At the same time, broad permissions granted during testing frequently evolve into long-term identity debt, leaving agents with unnecessary administrative access. Attackers are also exploiting prompt injection techniques, manipulating trusted agents through untrusted content to perform unintended actions when effective privilege boundaries are absent.

Addressing these risks requires identity-centric governance rather than a separate AI security strategy. Every AI agent should possess a unique identity, a clearly assigned owner, a defined business purpose, and a controlled lifecycle supported by strong credential management and continuous monitoring. Automated discovery, policy enforcement, and access reviews will become essential as organizations deploy growing numbers of autonomous systems.

As enterprises integrate agentic AI into everyday operations, the security question is no longer limited to what AI can produce. The greater concern is what autonomous agents are authorized to do, and whether those identities remain governed throughout their entire lifecycle. Organizations that strengthen identity governance today will be better positioned to embrace AI-driven innovation without expanding their attack surface.

FCRF Launches India’s Largest Cybercrime Hackathon for 2026



 

Hackathon

AI threats Cyber Crime Digital Security FCRF Hackathon

FCRF Launches India’s Largest Cybercrime Hackathon for 2026

The Future Crime Research Foundation (FCRF) has announced what is being positioned as India’s largest cybercrime hackathon, a move that reflects the growing urgency around digital threats in the country. With cyber fraud, phishing, ransomware, and AI-driven deception becoming more sophisticated, the event aims to create a space where innovators can build practical solutions for real-world investigation and defense. Unlike ordinary coding contests, this hackathon is expected to focus on cybercrime response, digital forensics, and applied security ideas that can help law enforcement and security professionals.

FCRF, an IIT Kanpur-incubated non-profit known for its work in cyber safety, training, and fraud risk management, has built a reputation as a serious player in India’s cybersecurity ecosystem. Its broader mission is to make India more resilient against evolving digital risks through research, awareness, and capacity building. The hackathon fits neatly into that mission by inviting participants to think beyond theory and build tools that can support investigations, evidence analysis, and cyber defense operations.

The event is also notable for the kind of collaboration it encourages. By bringing together students, researchers, ethical hackers, developers, and cyber professionals, the hackathon creates a multidisciplinary environment where ideas can move quickly from concept to prototype. That matters because today’s cybercrime problems are no longer limited to one domain; they involve fake identities, financial fraud, social engineering, malware, and emerging AI threats. A challenge of this kind can help discover solutions that are both technically strong and operationally useful.

For participants, the opportunity goes beyond competition. Hackathons like this can serve as launchpads for careers in cybersecurity, digital forensics, threat intelligence, and policy research. They also offer exposure to problem statements that mirror the pressure and complexity of real cyber investigations. In a country where digital adoption is expanding rapidly, events that combine innovation with public safety can play an important role in strengthening the national security ecosystem.

As FCRF continues to expand its influence through initiatives such as the FutureCrime Summit, this hackathon adds another layer to its growing impact. It signals a shift in how India is approaching cybercrime: not only by reacting to incidents, but by building talent and tools before attacks happen. That makes the event important not just as a competition, but as a serious step toward a more prepared and cyber-aware India.

China's New AI Model Challenges U.S. Cybersecurity Leaders



 

zhipu ai

AI Policy Artificial Intelligence China Cyber Security USA vulnerability zhipu ai

China's New AI Model Challenges U.S. Cybersecurity Leaders

China's latest open-weight artificial intelligence model is drawing attention within the cybersecurity community after independent evaluations indicated that it can rival some of the vulnerability detection capabilities of leading U.S. frontier AI systems. The findings are fueling renewed debate over whether restricting access to advanced American AI models is enough to slow the spread of powerful cyber capabilities.

Chinese AI company Zhipu AI, also known as Z.ai, released its GLM-5.2 model on June 13 under a permissive open-weight license. Unlike proprietary AI systems that are only accessible through controlled cloud services, open-weight models allow researchers and developers to download the model weights and run them on their own hardware. This approach enables offline deployment, customization through fine-tuning, and unrestricted experimentation without requiring ongoing approval from the model developer.

The release stands in contrast to Anthropic's Claude Mythos, one of several advanced AI systems whose availability has been limited under U.S. export controls because of concerns that highly capable models could be misused for offensive cyber operations. While GLM-5.2 still falls behind leading models from Anthropic and OpenAI across many general-purpose reasoning benchmarks, recent testing suggests it performs remarkably well in one highly specialized area: identifying software vulnerabilities.

Independent benchmarking conducted by Semgrep found that GLM-5.2 achieved an F1 score of 39% when detecting Insecure Direct Object Reference (IDOR) vulnerabilities. IDOR flaws arise when applications expose internal object identifiers without properly verifying whether a user is authorized to access the requested resource, making them a common source of unauthorized data access and privilege abuse. Under the same evaluation conditions, Claude Code recorded scores ranging from 32% to 37%, placing GLM-5.2 slightly ahead in this specific cybersecurity task.

The benchmark also underlined a notable economic advantage. Researchers estimated that GLM-5.2 identified vulnerabilities at an average cost of approximately $0.17 per finding, roughly one-sixth of the cost associated with comparable Claude-based workflows. Lower operating costs could make advanced AI-assisted vulnerability research accessible to a much broader range of organizations, independent researchers, and software security teams.

Additional benchmarking conducted by Graphistry reached similar conclusions, reinforcing the view that an openly downloadable Chinese model can compete with frontier U.S. AI systems in narrowly focused cybersecurity applications. The independent evaluations are particularly noteworthy because they relied on standardized testing methodologies designed to reduce benchmark contamination and minimize vendor-specific bias.

The findings arrive amid growing concern in Washington over the national security implications of frontier artificial intelligence. The Trump administration has increasingly treated advanced AI models such as Mythos and Fable as strategic technologies because of their ability to automate complex cybersecurity tasks, including discovering previously unknown software vulnerabilities that could potentially be weaponized in cyber operations.

Those concerns have shaped U.S. export control policies that restrict access to some advanced AI systems for foreign organizations, including researchers based in China. The underlying assumption behind these controls is that limiting access to the most capable American models would delay competing nations from acquiring comparable cyber capabilities. GLM-5.2's performance is prompting renewed questions about whether restricting model access alone can achieve that objective when capable alternatives are being developed elsewhere.

The discussion is further informed by Anthropic's Project Glasswing, which previously demonstrated the cybersecurity potential of frontier AI by identifying more than 10,000 critical software vulnerabilities during its initial research phase. The project illustrated how advanced language models can assist security researchers in reviewing large codebases, prioritizing weaknesses, and accelerating vulnerability discovery. If open-weight models begin approaching similar levels of performance, comparable capabilities may no longer remain exclusive to a small number of tightly controlled AI providers.

The latest development also comes shortly after OpenAI introduced GPT-5.6 with limited availability because of concerns surrounding misuse. Together, these decisions reflect a broader effort by U.S. AI developers to place increasingly capable models behind controlled access mechanisms while balancing innovation with national security considerations.

Cybersecurity researchers note that advances in open-weight models create opportunities as well as risks. Defensive teams could use these systems to automate code reviews, strengthen secure software development practices, and accelerate vulnerability remediation. At the same time, threat actors may attempt to exploit the same capabilities to identify weaknesses in software before organizations have an opportunity to patch them. Because GLM-5.2 can be downloaded and operated locally, these capabilities are available globally regardless of whether users have access to commercial U.S. AI services.

The emergence of GLM-5.2 does not necessarily indicate that Chinese AI has surpassed American frontier models across every benchmark. However, its strong performance in specialized cybersecurity evaluations suggests that the technological gap is narrowing in selected high-value domains. The development is likely to intensify debate over whether hardware restrictions and access controls alone are sufficient to preserve leadership in AI-driven cybersecurity, or whether future policy must place greater emphasis on strengthening defensive capabilities, accelerating software patching, and preparing for a world where advanced vulnerability discovery tools become increasingly accessible worldwide.

Iran-Linked Cyberattacks Against Israel Triple as Critical Infrastructure Faces Rising Threats



 

Isreal

Critical Infrastructure critical infrastructure attack Cyber Attacks cyber intrusion Iran Cyber Attacks Isreal

Iran-Linked Cyberattacks Against Israel Triple as Critical Infrastructure Faces Rising Threats

Surging numbers of cyber intrusions tied to Iran have been logged by Israeli officials, revealing persistent digital hostilities despite lulls in physical warfare. The National Cyber Directorate notes attacks on critical systems now occur at almost three times the frequency seen twelve months ago - this escalation suggests online defenses are just as vital as traditional security setups. While battlefield activity slows, unseen operations thrive behind screens.

Back in June 2026, Israel saw nearly 4,800 hostile cyber events, according to Yossi Karadi, head of the country's National Cyber Directorate. That number comes from remarks he shared with the German publication Die Welt. Compared to just 1,600 incidents logged one year earlier - during June 2025 - the rise is sharp.

At that time, Israeli forces were carrying out military actions targeting Iran. Even when fighting slows on the ground, digital clashes do not pause. Though truces might calm frontlines, hacking efforts persist without rest. Karadi pointed out that numerous hacker collectives operate with high-level skills. Despite strong national safeguards, these actors demand ongoing attention. Round-the-clock watch remains necessary, he emphasized.

One Israeli official noted that the assaults hit many types of groups, not just state bodies. Beyond governmental units, vital utility providers found themselves under pressure. Public administrative hubs also faced repeated digital intrusions. Smaller commercial ventures weren’t spared either - many reported breaches. Accounting practices appeared on the list of compromised entities recently. Legal consultancies showed up frequently in incident reports too.

So far, Israeli officials say key systems have stayed safe even as attack attempts increase. Confidence in defense strength comes through clearly in Karadi’s remarks - yet he points out dangers still linger. Vigilance must hold steady, because risks remain real and constant. Even when some breaches on vital systems were stopped, firms with poor digital safeguards faced harsher outcomes.

Some businesses, noted Karadi, fell harder because they were simpler targets - leading to total erasure of their networks after hackers got in. The names of those hit stayed undisclosed. Technical specifics about how it happened? Left out too.

Across global tensions, digital attacks now routinely accompany physical warfare. Rather than staying separate, hacking efforts blend into modern conflict strategies. Government-linked hackers shift toward striking infrastructure, officials, and corporate networks - often at the same time as troop movements.

These actions aim less at immediate damage, more at stealing secrets or wiping records clean. Public trust erodes when utilities or institutions face repeated intrusions. Hidden agendas drive many breaches, masking long-term influence goals behind technical exploits. Even though Iran denies launching cyber operations against other nations, it often highlights attacks aimed at its domestic institutions.

Assigning blame for digital intrusions among states is rarely straightforward - officials commonly reject accusations, leaving experts to piece together evidence using forensic data and collected insights. Despite shifts in traditional combat, cyber operations show no slowdown - recent data from Israel’s National Cyber Directorate confirms their steady rise.

With global friction still simmering, state-backed hacking efforts keep mounting. Institutions across sectors find themselves under growing strain to adapt defenses accordingly. Sophistication matters more than size when confronting these digital intrusions. Readiness now hinges on responsiveness, not just preparation.

KDDI Data Breach May Have Exposed Email Credentials of Up to 14.22 Million ISP Users in Japan



 

KDDI hack

Data Breach email security ISP email breach Japan cyberattack KDDI data breach KDDI hack

KDDI Data Breach May Have Exposed Email Credentials of Up to 14.22 Million ISP Users in Japan

Japanese telecommunications giant KDDI Corporation has disclosed a cybersecurity incident that may have compromised the email credentials of millions of users. According to the company, attackers gained unauthorized access to an email system that supports services for five internet service providers (ISPs) in Japan.

KDDI detected the security breach on June 17 and said it took immediate action to block the attackers while deploying additional security measures to contain the incident.

The company's investigation found that the intrusion occurred after threat actors exploited a vulnerability in third-party software used within KDDI's email infrastructure.

"Although technical defensive measures have already been implemented for the system, there remains a possibility that customers' email addresses and passwords were obtained by unauthorized third parties as a result of the incident," KDDI warns.

Up to 14.22 Million Accounts Potentially Affected

KDDI, one of Japan's largest internet service providers, employs around 45,000 people and generates annual revenue of approximately $32.4 billion. Established in 2000 through the merger of IDO, DDI, and KDD, the company serves millions of customers across the country.

The breach impacted email services operated by the following ISPs:

STNet, Inc.
JCOM Co., Ltd.
Chubu Telecommunications Co., Inc.
NIFTY Corporation
BIGLOBE Inc.

While the investigation remains ongoing, KDDI estimates that email addresses and passwords belonging to as many as 14.22 million current, former, and inactive customer accounts may have been exposed.

The company noted that a portion of the affected passwords had been stored in hashed and/or encrypted form, reducing the likelihood of immediate misuse if accessed by attackers. However, it did not disclose the encryption method used or clarify how many passwords, if any, were stored in plaintext.

Authorities Notified, Customers Advised to Reset Passwords

Since identifying the breach, KDDI has informed the affected ISP operators and reported the incident to Japan's Personal Information Protection Commission as well as the Ministry of Internal Affairs and Communications.

The telecom operator is working closely with the impacted ISPs to strengthen security measures and reduce potential risks stemming from the incident.

Customers whose accounts may have been affected are advised to reset their email passwords immediately. KDDI also recommends enabling two-factor authentication (2FA), where available, to provide an additional layer of account security.

US Opens the Door for Trusted Organizations to Use Anthropic's Mythos AI



 

US AI Regulation

AI Export Controls AI National Security Anthropic Mythos 5 Artificial Intelligence Governance Frontier AI Security OpenAI GPT-5.6 Privacy Secure AI Deployment US AI Regulation

US Opens the Door for Trusted Organizations to Use Anthropic's Mythos AI

With a significant shift in U.S. government policy toward frontier artificial intelligence deployment, limited access has been restored to Anthropic's advanced Mythos 5 model, signaling a more targeted regulatory strategy than a blanket ban.

Following a suspension of the model earlier this month due to national security concerns, U.S. authorities have now authorized its release to a carefully vetted group of organizations, including major Fortune 500 companies, which have been carefully vetted.

Washington has emphasized the importance of balancing artificial intelligence innovation with national security safeguards, as increasingly capable foundation models are subject to increased scrutiny over their potential misuse by foreign military and intelligence entities.

Additionally, the move is a useful illustration of a growing trend in which governments are increasingly influencing the deployment of cutting-edge AI systems and in which access to those systems is increasingly linked to trust, security compliance, and controlled distribution rather than unrestricted public access.

Regulatory discussions prompted by the U.S. government's export control order issued on June 12, which required Anthropic to suspend access to both Mythos 5 and its companion model, Fable 5, while officials assessed the possible national security implications of releasing frontier artificial intelligence capabilities, led to the latest authorization.

As the administration noted, it was concerned that highly capable generative AI models could be exploited by military or intelligence agencies linked to China, Russia, and other countries considered strategic risks. In light of this, Anthropic sought to strengthen compliance measures with the U.S. authorities, ultimately obtaining approval from the Secretary of Commerce Howard Lutnick to reactivate Mythos 5 to a limited network of vetted partners.

However, Fable 5 remains subject to export restrictions while regulatory assessments are being completed. There has also been a broader shift in policy, as OpenAI announced it had postponed the full public rollout of GPT-5.6 at the request of U.S. officials, limiting early access to a small number of pre-approved organizations whose identities were disclosed to the government in response to the change.

Together, these developments demonstrate the growing regulatory framework for the deployment of frontier AI models, in which access to these models is increasingly restricted, government oversight is continuous, and available models are available to a narrower audience rather than being made available widely to the public.

While the government has reversed the partial policy, its selective approval process continues to polarize discussion over the need for transparency and competitive fairness as frontier AI models are deployed. As a consequence of the lack of clearly defined eligibility criteria, federal agencies have accumulated considerable discretion, leaving companies outside the approved ecosystem with little insight into the decisions made regarding access.

As a legislative counsel for the Foundation for Individual Rights and Expression, John Coleman has questioned the opaque vetting framework, arguing that a lack of transparency in participant selection raises broader concerns about accountability and the consistency of regulatory authority application.

Achieving the same objective, Commerce Secretary Howard Lutnick confirmed that organizations on the approved list of trusted organizations, as well as their employees, including non-U.S. citizens, as well as Anthropic's own international workforce, will be exempt from requiring individual export licenses to access Mythos 5.

Licensing requirements, however, will remain in force for organizations outside of the government's trusted network. A number of the approved entities have been participating in Anthropic's Project Glasswing initiative, a collaborative effort between approximately 100 established technology companies and research institutions. It is also being discussed whether or not Fable 5 will be authorized in the future, although no implementation dates have been disclosed.

Increasing national security concerns increasingly influence commercial deployment strategies, which is reflected in the evolving regulatory framework which reflects a broader shift in how advanced artificial intelligence capabilities are governed. Although Fable 5 and Mythos 5 are based on the same underlying foundation model, the latter has been designed to be widely available with fewer deployment restrictions, making its continued suspension a noteworthy distinction in the government's risk assessment.

A number of regulatory frictions have also resulted from Anthropic's refusal to support the use of its AI models for domestic surveillance and fully autonomous weapons systems. This stance exacerbated frictions between Anthropic and Washington. Additionally, both Anthropic and OpenAI continue to pursue public market ambitions while adjusting to the new compliance requirements introduced in President Donald Trump's executive order.

By establishing a voluntary framework, the U.S. government will have the opportunity to review frontier artificial intelligence models up to 30 days before they are released to trusted partners under this voluntary framework. Analysts point out that while the latest authorization provides a practical mechanism for controlled deployment in the near-term, it does not resolve the question of how advanced AI systems are able to be deployed at scale.

A former Commerce Department official and analyst at the Center for Strategic and International Studies, Ms. Koren warned that prolonged uncertainty surrounding broad model deployment could eventually erode the competitive advantage of U.S. AI developers. This could create opportunities for geopolitical rivals such as China to narrow their technological gap.

Advance AI models are progressively being returned under tightly controlled access, signaling that frontier artificial intelligence has entered a new era where technical capability alone is no longer the determining factor of deployment.

As governments refine oversight mechanisms for high-impact AI systems, developers, enterprises, and security teams must adjust to ever-evolving compliance requirements. Those considering integrating next-generation artificial intelligence need to closely monitor regulatory developments, export controls, and trusted access frameworks, as policy decisions are becoming an increasingly important aspect of AI adoption.

Romania's Swift Response Stops Massive Cyberattack on Hospitals, Offers Global Lessons in Healthcare Security



 

Romania hospital cyberattack

BackMyData Data Breach Healthcare cybersecurity ransomware attack Romania hospital cyberattack

Romania's Swift Response Stops Massive Cyberattack on Hospitals, Offers Global Lessons in Healthcare Security

Romania's healthcare system faced one of its biggest cyber crises in February 2024 when a widespread ransomware attack targeted hospitals across the country, disrupting critical medical services and exposing the growing vulnerability of healthcare infrastructure to cybercriminals.

The attack began when hackers infiltrated the systems of Bucharest-based software company RSC, compromising its widely used hospital management platform, Hippocrates. As the malicious software rapidly spread to connected hospitals, officials at Romania's National Directorate for Cyber Security (DNSC) realized immediate action was necessary to prevent a nationwide catastrophe.

Faced with limited options, DNSC Director Dan Cimpean instructed more than 100 hospitals to disconnect from the internet immediately. The drastic measure successfully halted the spread of the ransomware but also left hospitals without internet access, email services, and connected medical systems.

Medical staff were forced to abandon digital records and return to manual processes, relying on handwritten documentation and paper-based workflows while cybersecurity experts investigated the breach and IT teams worked to restore operations.

The incident has since become an important case study for disaster response planners worldwide, demonstrating how healthcare systems can continue functioning during a major cyberattack.

Surgeon Oana Goidescu, who was working at Buzău Hospital when the attack unfolded, described the challenges medical staff faced.

"It was quite an unpleasant experience, because an IT record is not just a list of patients." She explained the extent of the disruption by adding: "For each patient, we request lab tests, radiology, medicines and supplies. All of that was gone."

The Hippocrates platform plays a central role in hospital operations, handling patient admissions, laboratory requests, pharmacy logistics, payroll, medical records, and diagnostic results. Once compromised, hospitals across Romania experienced widespread service failures.

The ransomware used in the attack, known as BackMyData, encrypted hospital files and demanded payment in Bitcoin to restore access.

The first warning signs appeared at Pitești Children's Hospital on the morning following the breach. By the next day, numerous hospitals reported that their Hippocrates systems had stopped functioning.

Cybersecurity specialists collaborated closely with the software provider to identify infected systems, isolate the malware, and begin recovery efforts.

Meanwhile, hospitals developed temporary offline systems to continue treating patients.

Vlad Paic from Carol Davila Hospital explained how his team adapted. When we saw the system would not be repaired quickly, we developed an offline method so we could register every patient. He added:"We asked the laboratory to give us results on paper. We used Excel and other offline tools to ensure care was not affected."

Romania's relatively recent transition to digital healthcare systems proved somewhat beneficial, as many staff members were still familiar with traditional paper-based procedures.

Investigators later confirmed that 26 hospitals had been directly infected with the BackMyData ransomware. Unaffected hospitals were gradually reconnected to the internet after additional cybersecurity protections were implemented.

Authorities also relied heavily on public communication throughout the crisis. Patients were advised to avoid hospitals unless absolutely necessary, helping reduce pressure on already strained facilities.

Despite these efforts, medical staff often faced frustration from worried patients.

Goidescu recalled: "We were asked, 'What if it were your mother?' They were right to be angry, but we tried to explain we were not at fault."

Romanian authorities also issued clear instructions that hospitals should neither negotiate with the attackers nor pay the ransom. The hackers had demanded €160,000 in Bitcoin, but the government refused payment and instead focused on restoring systems through secure backups.

Regular data backups proved invaluable, allowing most hospitals to recover their systems within five days. Although no deaths or serious patient harm were reported during the incident, healthcare workers spent weeks manually entering records created during the outage, while some information was permanently lost.

Investigators have not publicly identified those responsible for the attack. However, authorities previously dismantled a ransomware group linked to BackMyData in an international law enforcement operation that resulted in the arrest of four Russian nationals outside Russia.

Reflecting on the incident, Dan Cimpean warned that no country is immune from similar threats. "The more technology you have, the more digitised you are, the greater the risk."

The Romanian cyberattack reflects a broader global trend. In the United Kingdom, a cyberattack on an NHS blood-testing provider last year contributed to the first officially confirmed patient death linked to a cyber incident. In the United States, attacks on Change Healthcare and Ascension caused major disruptions, with Change Healthcare reportedly paying a $22 million ransom.

Cybersecurity experts say hospitals remain attractive targets because of their essential services.

Alina Bîzgă of cybersecurity company Bitdefender explained: "Hospitals handle critical services, and the criminals think that the more disruption that can be caused, the more likely they are to get paid a ransom."

The Romania incident highlights the urgent need for stronger cybersecurity measures, routine system backups, and well-prepared emergency response plans to safeguard healthcare services against increasingly sophisticated cyber threats.

Trump Threatens 100% Tariff on Countries That Adopt Digital Services Tax



 

U.S. Policy

Digital Tax Trade Deal Tech Firms Technology Trump Tariff U.S. Policy

Trump Threatens 100% Tariff on Countries That Adopt Digital Services Tax

U.S. President Donald Trump has threatened to impose a 100 percent tariff on goods from any country that levies a digital services tax on American companies, escalating tensions with trading partners already weighing tougher rules on big tech. In a social media post on Friday, Trump said the tariff would apply immediately and would override existing trade agreements, whether those deals were already in force or still awaiting implementation.

The move is aimed at countries, especially in Europe, that have discussed or adopted taxes on digital platforms and online services. Trump argued that these taxes unfairly target U.S. firms, many of which are among the world’s largest technology companies. Reuters reported that the warning came as several European governments continue to debate how best to tax digital businesses that generate revenue from local users without having a large physical presence.

Trump’s message raises the risk of a fresh trade confrontation between Washington and key allies. By linking digital tax policy to broad import penalties, the White House is signaling that it may use tariffs as leverage in disputes that extend beyond traditional goods trade and into the regulation of the digital economy. Reuters noted that the announcement also came shortly after the European Union moved to reduce tariffs on U.S. goods, adding another layer of strain to transatlantic negotiations.

The practical impact of the threat could be significant if implemented. A blanket 100 percent tariff would sharply raise the cost of exports to the United States and could hit sectors far beyond technology, depending on how broadly the measure is enforced. Reuters also noted that Trump said the tariff would supersede trade deals, a statement that adds uncertainty about how existing agreements might be affected if a country proceeds with a digital services tax.

The latest warning fits a broader pattern in Trump’s trade approach, which has relied on tariffs as a bargaining tool against countries he says are treating American companies unfairly. For businesses, the announcement is another reminder that tax policy, trade policy and digital regulation are increasingly linked. For governments, it creates a sharper incentive to weigh the political and economic costs of taxing U.S. tech giants against the risk of retaliation from the United States.

OpenAI Limits GPT-5.6 Release While U.S. Reviews AI Safety



 

AI governance AI Safety Data Governance GPT Open AI technology US

OpenAI Limits GPT-5.6 Release While U.S. Reviews AI Safety

OpenAI has postponed the extensive public rollout of its latest frontier artificial intelligence model, GPT-5.6, after the U.S. government requested an opportunity to examine the technology before it reaches a wider audience. Rather than making the model immediately available to all users, the company will begin with a restricted deployment involving a small number of carefully vetted partners whose identities have been disclosed to federal authorities.

The temporary decision surfaces an increasingly cautious approach toward highly capable AI systems as governments evaluate their potential impact on national security. Policymakers have become more concerned that advanced generative AI models, while offering substantial benefits across research, software development and cybersecurity, could also be exploited to support sophisticated cyberattacks, automate vulnerability discovery, generate convincing phishing campaigns or assist other malicious activities if deployed without adequate safeguards.

According to OpenAI, the limited rollout is intended to provide government officials with an opportunity to study the model's capabilities and assess possible security risks before broader public access is granted. The company said it has already briefed the U.S. government on GPT-5.6 and its expected capabilities and described the current arrangement as an interim measure while it works with Washington to establish a more structured framework for releasing future frontier AI models.

Chief Executive Officer Sam Altman publicly expressed support for rigorous safety evaluations but questioned whether government agencies should determine which organizations receive early access. In a post on X, Altman said extensive testing of advanced AI systems is appropriate, while arguing that customer selection should remain outside government control.

The latest development follows an executive order signed earlier this month by President Donald Trump establishing a voluntary process under which developers of designated "covered frontier models" may provide the U.S. government with access to their systems for up to 30 days before they are released to trusted external partners. The initiative is designed to give officials time to evaluate emerging security concerns and strengthen oversight of increasingly capable AI technologies before wider deployment.

OpenAI stated that restricting access during this initial period represents what it believes is the most practical route toward making GPT-5.6 more broadly available in the coming weeks while discussions continue with the Administration on implementing the cyber-focused executive order and developing a repeatable review process for future launches.

The company added that engineering teams will continue conducting extensive safety evaluations and work closely with early partners throughout the testing phase. At the same time, OpenAI cautioned that the current level of government access should remain a temporary measure rather than becoming a permanent requirement for future AI releases. It also declined to identify the organizations participating in the initial rollout.

OpenAI further warned that prolonged restrictions on access to frontier AI systems could slow innovation across multiple sectors. The company noted that developers, businesses, cybersecurity professionals and international collaborators all rely on access to advanced models to build defensive security tools, strengthen research, develop enterprise applications and accelerate responsible AI adoption.

Leading the new product family is GPT-5.6 Sol, which OpenAI describes as its most capable model to date. The release also includes Terra, positioned as a mid-range model, and Luna, a lower-cost alternative intended to make advanced AI capabilities available at a lower price point across a wider range of use cases.

The government's heightened scrutiny extends beyond OpenAI. Earlier this month, Anthropic was instructed by U.S. authorities to suspend access to its frontier AI models for foreign nationals because of national security concerns. The company continues to face an ongoing legal and regulatory dispute with the government over those restrictions, illustrating the growing debate surrounding oversight of advanced artificial intelligence systems.

The developments come as both OpenAI and Anthropic have confidentially submitted paperwork for U.S. initial public offerings. Separately, The New York Times reported that OpenAI is considering postponing its public market debut until next year.

The developing relationship between AI developers and governments illustrates how the deployment of frontier models is becoming closely linked with cybersecurity and national security policy. While companies continue to pursue increasingly powerful AI capabilities, regulators are placing greater emphasis on evaluating how these systems could influence cyber defense, critical infrastructure protection and the misuse of AI by malicious actors before they are released at scale.

Edgecution Malware Exploits Microsoft Edge Extension to Deploy Python Backdoor in Ransomware Attack



 

Microsoft Security Flaw

Backdoor Malware Cyber Attacks Cyber Security Ransomware Attacks Exploitation Malware Attack Microsoft security Microsoft Security Flaw

Edgecution Malware Exploits Microsoft Edge Extension to Deploy Python Backdoor in Ransomware Attack

One way hackers adapt is by twisting legitimate features into tools for harm. A recent example shows a malicious Microsoft Edge extension escaping the browser’s restricted environment to establish persistent access on infected systems.

Researchers named the campaign Edgecution, which abuses built-in browser functionality rather than software flaws. The payload deploys a Python-based backdoor capable of silently executing commands on compromised devices. Researchers at Zscaler believe the campaign is linked to an Initial Access Broker associated with the Payouts Kings ransomware operation.

Instead of exploiting vulnerabilities, the attackers rely on social engineering and legitimate browser capabilities to gain deeper access to victim systems. The attack begins with someone impersonating IT support on Microsoft Teams, directing employees to a fake Microsoft update page under the pretense of installing an email security update.

Victims see what appears to be an official Outlook update portal, but clicking its buttons instead downloads malware, copies malicious scripts to the clipboard, or requests Microsoft 365 and Outlook credentials. What looks like a routine update quickly turns into a compromise. The downloaded package contains intentionally malformed ZIP headers to evade security scanners.

Once executed, scripts repair the archive, extract hidden files, configure the system, and create scheduled tasks that silently launch Microsoft Edge in the background. Inside the package are two main components: a malicious Microsoft Edge extension disguised as an Edge Monitoring Agent and a Python-based backdoor. The extension communicates with attacker-controlled servers, receiving commands and sending back results.

Although browser extensions normally operate inside isolated sandboxes, this attack bypasses those restrictions. Attackers abuse Chrome’s Native Messaging protocol—a legitimate feature that allows browser extensions to communicate with trusted desktop applications. By leveraging this mechanism, the malicious extension launches the bundled Python backdoor as a native application, escaping the browser’s security boundaries.

Once active, the Python backdoor enables attackers to execute shell commands, run PowerShell and arbitrary Python code, write files, enumerate running processes, and collect system information. Helper scripts generate the Native Messaging manifest and batch files needed to connect the extension with the local application.

The malicious extension runs inside a headless Microsoft Edge session, remaining invisible to users while maintaining persistent access that is difficult to detect. Zscaler also identified unused commands within both malware components, indicating the framework is still under development and could gain additional capabilities in future versions.

According to researchers, Edgecution highlights the growing sophistication of ransomware campaigns. Rather than relying solely on traditional malware, attackers increasingly exploit trusted browser features and enterprise collaboration platforms to bypass security defenses.

To reduce the risk, organizations should closely monitor browser extensions, restrict Chrome Native Messaging where possible, review native messaging host configurations, and train employees to recognize social engineering attempts delivered through platforms such as Microsoft Teams. Zscaler has also published indicators of compromise, including malicious extension hashes and command-and-control servers, to help defenders identify affected systems.

EdTech Software Suppliers Become the New Target for Cyber Attackers



 

Third-Party Risk

Cloud Security Data Breach EdTech Cybersecurity FulcrumSec Learning Management System ShinyHunters Student Information System Supply Chain Attack Third-Party Risk

EdTech Software Suppliers Become the New Target for Cyber Attackers

Education is witnessing a notable shift in the cyber threat landscape in which attackers are bypassing individual schools in favor of software providers that support modern digital learning. Education technology (EdTech) vendors have emerged over the last several years as valuable supply chain targets, including learning management systems (LMS), student information platforms, and cloud-based academic services.

Through a single compromise, threat actors can gain access to thousands or hundreds of educational institutions across a wide range of industries. The recent attacks on the Canvas platform of Instructure, which disrupted online examinations, as well as the large-scale security breach of PowerSchool, which exposed sensitive student data, underscore how cybercriminals are evolving their tactics so that they can maximize operational disruption, data theft, and financial leverage by striking the technology ecosystem instead of the end users.

With an increased reliance on cloud-native educational infrastructure, financial motivated threat actors have also become increasingly exposed to attacks. Recent activity attributed to groups such as ShinyHunters and FulcrumSec indicates this shift toward more targeted and technically sophisticated attacks against the EdTech sector.

The ShinyHunters hacking collective has been reported to have compromised learning platforms serving educational institutions around the world, allegedly stealing millions of records containing names, email addresses, physical addresses, and other personally identifiable information (PII) from them.

Several security assessments have linked these compromises to vulnerabilities such as insufficiently protected API endpoints and exposed cloud databases, vulnerabilities that frequently appear when rapidly expanding EdTech providers prioritize scalability over mature security controls. Data exposed on dark web marketplaces has increased the risks of phishing, credential abuse, identity theft, and follow-on attacks, reinforcing concerns that the adoption of student information systems, learning management systems, and other cloud-based academic platforms outpaces the establishment of robust cybersecurity governance within the education technology supply chain.

In March of 2026, ShinyHunters allegedly compromised the widely used Infinite Campus Student Information System (SIS) and exfiltrated personally identifiable information from more than 137,000 school staff accounts through a Salesforce-related data theft incident. The campaign has continued to expand in scope throughout 2026.

Considering Infinite Campus' extensive footprint in the U.S. education sector, the breach has broader implications for the organization. Infinite Campus supports approximately 3,200 school districts and manages records for approximately 11 million students from 46 different states. As of June 16, 2026, ShinyHunters also identified Glendale Community College, Moody Bible Institute, Illinois Central College, and Houston City College as its latest victims.

In contrast to conducting isolated attacks against individual campuses, the increasing victim list illustrates a deliberate strategy to target centralized education platforms that can affect multiple institutions at once rather than focusing on isolated attacks.

There has been a parallel escalation in the ransomware ecosystem where FulcrumSec has claimed responsibility for a large-scale breach involving a Singapore-based international educational network, the Global Schools Foundation. Several critical systems across multiple countries were disrupted as a result of the attack, resulting in a substantial amount of sensitive information being stolen. Students and staff had limited access to essential academic and administrative services as a result of the attack.

In an unsuccessful ransom negotiation, the group threatened to publish the stolen information. There are 33,088 passport records in the stolen dataset, covering 66 nationalities, 221 million attendance records, 9.4 million internal messages, 143,494 employee salaries, over 616,000 emails attaching medical and identification documents, 112 source code repositories, 168 entries in AWS Secrets Manager, and evidence of a previous ransomware attack dating back to 2022.

FulcrumSec has previously been connected to cloud-focused intrusions involving platforms hosted on Amazon Web Services, MongoDB, and Google Cloud Platform (GCP), reflecting an attack that extends beyond personal data into operational infrastructure, application code, and cloud secrets. In addition to breaches affecting LexisNexis and Australian fintech company youX, which underscores a consistent focus on cloud-resident data and double extortion activities, these breaches demonstrate an increased focus on cloud-resident data.

Although large-scale ransomware campaigns continue to make headlines, not every breach in education stems from sophisticated intrusion techniques. By misconfiguring third-party cloud applications, sensitive information may be exposed just as effectively, without the attacker having to overcome security controls in any case.

One such incident was brought to the attention of the school by parents who discovered that a feature within a third-party absence management platform provided families with the opportunity to view free-text comments submitted by other parents regarding requests for student absences. While the vendor confirmed that the attached attachments were inaccessible, the exposed comment fields may contain sensitive information voluntarily provided by guardians, including medical appointments, illness details, and other private information about students.

In this instance, it demonstrated how seemingly minor application logic errors can adversely affect data confidentiality when privacy controls are not appropriately implemented. Upon discovery, both the educational institution and its software provider coordinated an incident response. After informing the vendor of the vulnerability, they were able to develop and deploy a software update that remedied the vulnerability prior to ensuring their own environment was updated.

Besides applying the fix, administrators were required to conduct a comprehensive forensic investigation to determine the duration of the exposure, determine which records were visible, identify users who accessed the vulnerable feature by analyzing system logs, and determine what categories of personal information may have been compromised as a result.

According to those findings, the incident met the requirements for mandatory regulatory reporting and formal notification was required for affected students, parents, and guardians. At the same time, the institution was required to maintain communication with the families who initially reported the issue while documenting the incident for compliance purposes.

Due to the vulnerability affecting a shared cloud platform, the vendor was required to notify each school which used the feature, distribute an updated version, and ensure these schools applied the update. This incident illustrates how vulnerabilities within centralized education platforms may rapidly evolve into ecosystem-wide risks. It is equally up to software providers to provide timely patches and transparent communication as it is up to educational institutions to protect student data.

Together, these incidents demonstrate that effective cybersecurity does not limit to the protection against external attackers in the education sector. The breach response process requires significant operational effort, which involves technical teams, compliance personnel, vendors, and institutional leadership, regardless of whether the root cause is ransomware, cloud misconfigurations, insecure APIs, or human error. Additionally, these incidents illustrate the importance of good vendor governance, secure software development, continuous risk assessments, and an incident response plan that has been extensively tested.

With instructional institutions increasingly relying on cloud-based platforms, organizations that invest in proactive security controls and supplier oversight will be better prepared to minimize operational disruptions, protect sensitive data, and comply with regulatory requirements.

As schools increasingly rely on interconnected cloud platforms to deliver educational services, the sector has experienced a fundamental shift in its cyber risk profile, making software providers and technology partners just as important as schools themselves to the protection of institutional information. Operational resilience has been demonstrated in recent incidents to depend on continuous vendor oversight, secure software development, timely vulnerability remediation, and coordinated incident response throughout the education technology ecosystem as a whole.

A continued pursuit of high-impact supply chain opportunities by threat actors will require strengthening third-party risk management and incorporating security into all phases of software development in order to protect educational continuity, safeguard sensitive data, and maintain trust across digital learning environments.

FCC Strengthens Cybersecurity Rules for Emergency Alert Systems and Undersea Cable Networks



 

Wireless Emergency Alerts

Cyber Security Emergency Alert System FCC cybersecurity Team Telecom undersea cable security Wireless Emergency Alerts

FCC Strengthens Cybersecurity Rules for Emergency Alert Systems and Undersea Cable Networks

The Federal Communications Commission (FCC) has approved a series of new regulations aimed at strengthening the cybersecurity of the United States' emergency communication systems while modernizing security requirements for the country's undersea cable infrastructure.

The newly adopted rules introduce stronger safeguards for the nation's two primary public warning platforms—the Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA)—to reduce the risk of cyberattacks and unauthorized access.

The EAS is widely used by federal, state and local authorities to broadcast emergency information, including severe weather warnings, AMBER Alerts and other public safety notifications through television and radio networks. Meanwhile, the WEA delivers similar alerts directly to mobile devices through text messages.

According to the FCC, a successful cyberattack on either platform by a foreign government, cybercriminal organization or malicious actor could spread misinformation, create public confusion or disrupt emergency response efforts during critical situations.

Any vulnerability in systems like the Emergency Alert System “can have serious consequences,” said FCC Commissioner Olivia Trusty in a statement after the vote.

“That is why it has been appropriate for the Commission to conduct a comprehensive review of the EAS framework by focusing on the security of the system itself,” Trusty continued. “As cybersecurity threats continue to evolve, EAS participants must take appropriate steps to safeguard the infrastructure that supports the delivery of life-saving alerts.”

As part of the new cybersecurity framework, organizations responsible for operating EAS and WEA systems will be required to adopt stronger cyber hygiene measures. These include implementing robust passwords, promptly installing vendor-issued security updates and patches, and deploying firewalls to restrict unauthorized access to critical systems.

The FCC has also introduced a new authentication identification system that will verify emergency alerts before they are transmitted, helping prevent duplicate, fake or unauthorized alerts from being distributed.

In a separate decision, the Commission also approved its first major overhaul of submarine cable regulations in several decades. The updated framework seeks to enhance cybersecurity oversight for undersea cable infrastructure while simplifying licensing procedures for trusted operators.

Under the revised rules, certain undersea cable providers will no longer be required to undergo the extensive national security licensing review conducted by "Team Telecom" before operating cables connected to U.S. territory.

Team Telecom is an interagency group led by the Department of Justice's Foreign Investment Review Section, along with other federal agencies that evaluate the national security implications of telecommunications infrastructure.

The updated policy allows submarine cable applicants to qualify for an exemption if they can self-certify that they meet high security standards designed to improve certainty, streamline reviews and shorten licensing timelines.

“Currently, all submarine cable applications get referred to Team Telecom…the changes adopted would exempt applications from applicants that have operated cables without incident, can certify to the highest national security standards, and agree to ongoing oversight and monitoring,” the FCC said in a release.

The new regulations also expand the FCC's oversight of key operational components within submarine cable systems. Companies responsible for submarine line terminal equipment, which connects undersea cables to U.S.-based terrestrial facilities, will now be required to obtain licenses.

Additionally, the Commission has introduced updated security measures to address risks associated with essential equipment, third-party vendors and vulnerabilities across the broader submarine cable supply chain, further strengthening the resilience of critical communications infrastructure.

Anthropic Restores Limited Access to Claude Mythos 5 AI Model After US Government Approval



 

Cyber Security

AI technology AI tools Anthropic Anthropic AI Anthropic Ban Claude Claude AI Cyber Security

Anthropic Restores Limited Access to Claude Mythos 5 AI Model After US Government Approval

Earlier limits on Anthropic’s top-tier AI tools have been eased by U.S. officials, reopening limited availability of the Claude Mythos 5 system to certain approved American institutions. Though only recently barred due to fears about potential misuse threatening national safety, the model is now accessible again under tight conditions. Government oversight in high-level AI deployment continues expanding, especially when such systems involve strong digital defense functions.

While concerns remain, selective reinstatement suggests a shift toward managed access rather than blanket bans. Now cleared by U.S. authorities, Mythos 5 can be used again by groups managing essential infrastructure operations. Over a hundred entities - some among the largest corporations - are set to reconnect under new guidelines. Though access returns in phases, Anthropic emphasizes steady progress restoring function, even as talks continue with federal agencies on widening reach later.

One goal remains: bringing back full public availability of the Fable 5 system after further review. One restriction began with an export directive dated June 12, forcing Anthropic to shut off entry points to Mythos 5 along with Fable 5. Not long after, OpenAI revealed a delay in launching GPT-5.6 widely - this pause came by direction from U.S. officials. Rather than open access freely, they handed early permissions only to select collaborators, names already passed to federal agencies.

Oversight like this signals a quiet but steady push from regulators to track how powerful artificial intelligence moves into real-world use. Officials worry powerful AI systems might fall into the hands of rival nations - like those in Beijing or Moscow - despite existing barriers. Because these tools can detect system flaws faster than humans, they may speed up digital attacks when protections fail. While designed for defense, their functions could shift toward offense once access is gained through weak points.

Even infrastructure meant to resist intrusion becomes a target under such conditions. Surprisingly, Anthropic admitted that authorities questioned whether flaws in its security could allow bypassing controls meant to stop abuse of the Fable 5 system when spotting code weaknesses. Although officials noted improvements in handling those dangers, details about the specific defenses enabling partial revival of Mythos 5 remain undisclosed by public agencies.

Though some defend the selection method, lawyers and tech executives have raised doubts. Questions emerge over who gets picked - free expression supporters point out unclear criteria behind group approvals. Without clear rules on checks, suspicion grows. Safety tests gain backing even as control worries surface; Sam Altman backs strong evaluations yet hesitates at state influence shaping access paths. Decisions made behind closed doors unsettle those watching closely.

Now, trusted groups working with Mythros 5 won’t need export permits - this applies also to their staff outside the U.S. - as long as they’re named on the official roster. Still, firms left off the list must follow current licensing rules. A number of listed entities belong to Anthropic’s Project Glasswing, it is said, a collaboration hosting around one hundred tech outfits and study centers.

Now comes news after Donald Trump issued an executive directive creating a non-mandatory process: creators of cutting-edge artificial intelligence may offer their systems to federal authorities for scrutiny during a thirty-day window prior to wider release. Some say this step offers temporary protection until more complete regulatory structures emerge through policy work.

Yet concerns rise elsewhere - extended delays in launching powerful AI tools might hinder progress, weakening American firms just as international competitors push forward with their own intelligent technologies.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Post-Quantum Cryptography Readiness Becomes a Strategic Cybersecurity Priority for Enterprises

GPT-5.6 Sol Debuts With Enhanced Cyber Protections, Limited to Trusted Partners

Five Eyes Warns New AI Models Pose Urgent Cyber Risk

Agentic AI Has Become an Identity Crisis for Enterprise Security Teams

FCRF Launches India’s Largest Cybercrime Hackathon for 2026

China's New AI Model Challenges U.S. Cybersecurity Leaders

Iran-Linked Cyberattacks Against Israel Triple as Critical Infrastructure Faces Rising Threats

KDDI Data Breach May Have Exposed Email Credentials of Up to 14.22 Million ISP Users in Japan

Up to 14.22 Million Accounts Potentially Affected

Authorities Notified, Customers Advised to Reset Passwords

US Opens the Door for Trusted Organizations to Use Anthropic's Mythos AI

Romania's Swift Response Stops Massive Cyberattack on Hospitals, Offers Global Lessons in Healthcare Security

Trump Threatens 100% Tariff on Countries That Adopt Digital Services Tax

OpenAI Limits GPT-5.6 Release While U.S. Reviews AI Safety

Edgecution Malware Exploits Microsoft Edge Extension to Deploy Python Backdoor in Ransomware Attack

EdTech Software Suppliers Become the New Target for Cyber Attackers

FCC Strengthens Cybersecurity Rules for Emergency Alert Systems and Undersea Cable Networks

Anthropic Restores Limited Access to Claude Mythos 5 AI Model After US Government Approval

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Menu Item

Up to 14.22 Million Accounts Potentially Affected

Authorities Notified, Customers Advised to Reset Passwords