Microsoft's MSRC invokes the Digital Crimes Unit against the Nightmare Eclipse zero-day drops, and the disclosure community is not having it. UK National Security Bill confirms CMA reform that protects roughly 300 researchers.

Peter G. Neumann, who moderated the ACM RISKS Forum for 41 years and helped found the discipline of secure-systems research, died May 17 at 93. CISA opens a public KEV nomination form. Cloudflare publishes its Project Glasswing post-mortem.

OpenAI launches Daybreak with 20+ vendor partners, putting a second restricted-access defensive AI consortium next to Anthropic's Glasswing. AISI says autonomous AI cyber capability is now doubling every 4.7 months.

CAISI signs pre-deployment testing deals with Google, Microsoft, and xAI. CISA gives feds three days to patch Ivanti EPMM zero-day. NVD reclassifies 29,000 backlogged CVEs as Not Scheduled.

AISI's GPT-5.5 evaluation confirms frontier-model offensive cyber capability is a trend, not a Mythos one-off. NIST formally drops enrichment for 29,000 backlogged CVEs. UK still has no statutory defence.

CISA's KEV catalog absorbs 13 new CVEs in five days, the heaviest week since Emergency Directives retired in January. UK AISI publishes the first government evaluation of a frontier model's offensive cyber capabilities.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.