policy

CAISI signs pre-deployment testing deals with Google, Microsoft, and xAI. CISA gives feds three days to patch Ivanti EPMM zero-day. NVD reclassifies 29,000 backlogged CVEs as Not Scheduled.

AISI's GPT-5.5 evaluation confirms frontier-model offensive cyber capability is a trend, not a Mythos one-off. NIST formally drops enrichment for 29,000 backlogged CVEs. UK still has no statutory defence.

CISA's KEV catalog absorbs 13 new CVEs in five days, the heaviest week since Emergency Directives retired in January. UK AISI publishes the first government evaluation of a frontier model's offensive cyber capabilities.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.

OWASP Agentic AI Top 10 redefines the disclosure landscape. Plus: OpenAI launches safety bug bounty, Langflow exploited in 20 hours, and GSA drops the first federal AI acquisition clause.

CVE program funding secured but transparency questions remain. Plus: lookup.disclose.io launches in beta, EU CRA countdown hits 6 months, and Rapid7 reports exploited vulns surged 105%.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research. This week: White House Cyber Strategy, CVE program funding secured, UK Computer Misuse Act reform, EU CRA vulnerability guidance, and DHS shutdown delays CIRCIA.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research. This week: RUSI explores cyber deputisation and letters of marque, UK launches Cyber Essentials push, curl kills its bug bounty over AI slop, and the MITRE CVE contract enters its final two weeks.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research. This week: Australia mandates VDPs for all smart devices, MITRE CVE contract enters final countdown, and a researcher who found children's data exposed gets threatened with prosecution.