Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.

Commissioner Olivia Trusty of the Federal Communications Commission has kept global spectrum policy at top of mind, and her travel schedule shows it.

Class action practitioners should prepare for a likely surge in artificial intelligence-enabled pro se objections by implementing several practical strategies to navigate this shift, says Britany Wessan at Almeida Law Group.

The Federal Trade Commission got an Illinois federal judge to hit pause on its right-to-repair antitrust lawsuit against John Deere, citing ongoing settlement talks less than two months after the company struck a $99 million deal with farmers promising to facilitate independent equipment repairs.

Executive Summary - The California Consumer Privacy Act’s (CCPA) cybersecurity audit regulations, finalized September 23, 2025, became effective January 1, 2026, establishing the first state privacy law of general applicability mandating independent cybersecurity audits. Unlike sector-specific requirements such as New York Department of Financial Services (NYDFS) Part 500 (financial services) or Health Insurance Portability and Accountability Act (HIPAA) (health care), these regulations apply... By: Troutman Pepper Locke

On May 1, 2026, Colorado lawmakers introduced a bill that would repeal and replace the state’s 2024 artificial intelligence (AI) statute weeks before its June 30, 2026, effective date. Governor Jared Polis signed it into law on May 14.... By: Jackson Lewis P.C.

The release of Shai-Hulud source code spells trouble for software developers as researchers worry the self-replicating worm could scale.

From the MGM and Caesars fiasco and MOVEit's patch nightmare to epic business blunders and the jaded reality of living in a post-breach world, Dark Reading looks back at the mistakes, miscalculations, systemic failures, and cringeworthy moments that still have us shaking our heads.

Elon Musk's xAI is asking a California federal court to force a group of women suing over Grok-generated deepfake images of them in sexual situations, saying they haven't shown that proceeding under pseudonyms is necessary to protect their privacy.

Colorado repeals and replaces the Colorado AI Act, Georgia enacts a chatbot law, and California and New York advance numerous bills. Below is the eighteenth update on the status of proposed state privacy and AI legislation in 2026. With the state legislative activity slowing, we have combined our weekly privacy and AI posts.... By: Troutman Pepper Locke

Grafana confirmed a GitHub token breach that exposed source code, but said no customer data or systems were affected. Grafana Labs confirmed a security incident after the extortion group Coinbase Cartel listed it on a leak site and claimed data theft on May 15. The breach was triggered by a compromised token that gave attackers […]

The Oklahoma attorney general is suing Roblox, saying the massive online gaming platform has failed to take steps to protect its minor users from sexual predation and exploitation from child predators.

L’Ontario devient la toute dernière province à mettre à jour sa législation en matière de protection de la vie privée et d’accès à l’information dans le secteur public. Le projet de loi 97, Loi de 2026 sur le plan pour protéger l'Ontario (mesures budgétaires) (le « projet de loi 97 »), qui a reçu la sanction royale le 24 avril 2026, vient entre autres modifier la Loi sur l’accès à l’information et la protection de la vie privée (la « LAIPVP ») et la Loi sur l’accès à l’information municipale et... By: Blake, Cassels & Graydon LLP

On May 8, the U.S. Court of Appeals for the 3rd Circuit affirmed the district court’s dismissal of a consumer’s complaint alleging that a debt collector violated the FCRA by furnishing inaccurate information to a consumer reporting agency (CRA) that his credit card debt was active and in collections, and that the CRA violated FCRA by reporting this information.... By: Orrick, Herrington & Sutcliffe LLP

Illinois initiated a 45-day public comment period regarding proposed regulations implementing the Use of AI in Employment Act (HB 3773, the “AI Act”), which took effect January 1, 2026. The AI Act amends the Illinois Human Rights Act (the “IHRA”) by imposing certain notice, non-discrimination, and record-keeping requirements on Illinois employers who use artificial intelligence (“AI”) when making employment decisions. Illinois employees can enforce the AI Act and potentially recover damages... By: Blank Rome LLP

Le 4 mai 2026, le Commissariat à la protection de la vie privée du Canada (le « Commissariat ») a publié deux projets de documents d’orientation sur le « contrôle de l’âge », visant à offrir aux enfants une expérience en ligne plus sécuritaire et mieux adaptée, tout en atténuant les éventuelles répercussions négatives sur la protection de la vie privée. Le Commissariat avait déjà fait part de ses positions préliminaires sur les technologies de contrôle de l’âge dans le cadre d’une consultation... By: Blake, Cassels & Graydon LLP

In today’s digital landscape, managing enterprise data has become increasingly complex. If you are responsible for compliance, risk management, or litigation readiness, you may find yourself overwhelmed by the sheer volume of unstructured data across collaboration tools, emails, and social media platforms. Just as an experienced attorney could guide you through complicated legal procedures, a robust governance system provides structured oversight for your organization’s information assets.... By: Hanzo

Security experts have long warned that insecure automatic tank gauge (ATG) systems exposed on the Internet can be tampered with by threat actors.

Ontario is the latest province to make updates to its public-sector privacy and freedom of information legislation. Ontario’s Bill 97, Plan to Protect Ontario Act (Budget Measures), 2026 (Bill 97) received royal assent on April 24, 2026. Bill 97, among other things, introduces amendments to Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). In this bulletin, we highlight some of the changes that... By: Blake, Cassels & Graydon LLP

On May 12, 2026, the Colorado legislature passed SB 26-189, which repeals and replaces its landmark Artificial Intelligence Act. Colorado is doing away with the concept of “algorithmic discrimination” and moving instead to a notice- and disclosure-based regime focused on automated decision-making. This time, it does so without a carve-out for deployers who are small businesses.... By: Alston & Bird

Another recent victim of ShinyHunters is Instructure, the supplier of the Canvas learning management system, which disrupted the login portals of 330 colleges and universities during the critical college exam schedule.... By: Robinson+Cole Data Privacy + Security Insider

California regulators have announced a major privacy settlement with General Motors (GM) over allegations that the company unlawfully sold the location and driving data of hundreds of thousands of Californians to two data brokers: Verisk Analytics and LexisNexis Risk Solutions. The settlement, subject to court approval, requires GM to pay $12.75 million in civil penalties and imposes significant restrictions on how the company may use, retain, and share consumer driving data.... By: Robinson+Cole Data Privacy + Security Insider

On April 29, 2026, the UK Information Commissioner’s Office (ICO) published guidance on the use of storage and access technologies. The guidance follows consultations in 2025 and accounts for changes to storage and access technology requirements introduced by the Data (Use and Access) Act 2025.... By: A&O Shearman

On May 4, 2026, the Office of the Privacy Commissioner of Canada (OPC) released two draft guidance documents on “age assurance,” aimed at supporting safer and more age-appropriate online experiences for children while mitigating potential adverse privacy impacts. The Commissioner had previously shared preliminary positions on age assurance technologies as part of an exploratory consultation, which has informed the new draft guidance documents.... By: Blake, Cassels & Graydon LLP

President Donald Trump on Monday told a Florida federal court he is dropping his $10 billion suit against the Internal Revenue Service over the leaking of his tax information.

On April 22, the U.S. District Court for the District of Arizona granted in part and denied in part a defendant’s motion to dismiss a complaint alleging violations of the Telephone Consumer Protection Act (TCPA) as well as state consumer fraud and common law claims.... By: Orrick, Herrington & Sutcliffe LLP

The UK Government’s legislative agenda, set out in the King’s Speech on 13 May 2026, places cybersecurity and digital resilience firmly at the centre of national policy. Against a backdrop of increasing geopolitical instability and rapidly evolving technological risks, the proposed measures continue the shift towards a more interventionist and systemic approach to safeguarding the UK’s critical infrastructure and services.... By: DLA Piper

For multinational companies and biotech companies engaging in “in-licensing” transactions with Chinese partners, the transfer of biological samples and clinical trial data is more than just a technical necessity, it is the deal’s most regulated bottleneck. It is important to understand China’s oversight on Human Genetic Resources and Personal Information, which creates significant compliance burdens that directly impact clinical and commercial timelines for foreign licensees.... By: Morgan Lewis

Connecticut has joined the growing number of states regulating the use of artificial intelligence (AI) in the workplace after passing legislation that Governor Ned Lamont is expected to sign into law. Among several other provisions, including regulations addressing AI interactions with minors, the Connecticut Artificial Intelligence Responsibility and Transparency Act (SB 5) creates new requirements for employers that use automated tools in employment-related decisions, including for recruiting,... By: K&L Gates LLP

Here are curated AG and federal regulatory news stories highlighting key areas in which state and federal regulators’ decisions are having an impact across the US: • California Steers GM Into $12.75 Million Privacy Settlement - • AG Buzz: California Taps Chopra to Head New Agency, Ohio Names Interim AG, and South Dakota Race Takes Shape - • Texas Flags CVS Supplier Diversity Program for Potential DEI Liability - • Mariner Finance Pays $11.1 Million in Tennessee AG Settlement - • Oklahoma Says... By: Cozen O'Connor

On April 16, the U.S. District Court for the District of South Carolina dismissed with prejudice a consumer’s FCRA claims against three consumer reporting agencies (CRAs), holding that the consumer failed to plausibly allege an inaccuracy in his credit report that was “objectively and readily verifiable.”... By: Orrick, Herrington & Sutcliffe LLP

7-Eleven confirmed a breach after ShinyHunters claimed theft of over 600,000 Salesforce records and franchisee data. 7-Eleven has confirmed a data breach after the ShinyHunters hacking group claimed it stole more than 600,000 Salesforce records containing personal and corporate information. “Over 600k Salesforce records containing PII and other internal corporate data have been compromised.” The […]

Colorado Supreme Court Justice Maria Berkenkotter and Colorado Court of Appeals Judge Lino Lipinsky de Orlov discuss how artificial intelligence has already fundamentally altered the legal system and offer tips for courts navigating deepfakes, hallucinations and a gap in access to AI tools.

The bill passed the state’s unicameral legislature by a unanimous vote of 49-0-0 on April 10. On April 14, the governor signed it into law. The law takes effect on July 17, but certain requirements for agricultural data contracts will not begin until January 1, 2027.... By: ArentFox Schiff

A hotel check-in system exposed over 1 million passports, IDs, and selfies online due to a misconfigured cloud storage bucket. A security lapse in the Reqrea’s Tabiq hotel check-in system exposed over 1 million passports, driver’s licenses, and selfie verification photos online. The issue came from a misconfigured Amazon cloud storage bucket that was left […]

Several healthcare data breaches impacting hundreds of thousands and even millions were added to the HHS tracker. The post Millions Impacted Across Several US Healthcare Data Breaches appeared first on SecurityWeek.

Four vulnerabilities in OpenClaw can be chained together to steal credentials, escape the sandbox, and plant persistent backdoors. The post ‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery appeared first on SecurityWeek.

The hackers claimed to have stolen more than 600,000 Salesforce records, including personal information and corporate data.  The post 7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand appeared first on SecurityWeek.

The UK Government’s legislative agenda, set out in the King’s Speech on 13 May 2026, places cybersecurity and digital resilience firmly at the centre of national policy. Against a backdrop of increasing geopolitical instability and rapidly evolving technological risks, the proposed measures continue the shift towards a more interventionist and systemic approach to safeguarding the... Continue Reading

The researcher dropped the MiniPlasma exploit that uses the original proof-of-concept (PoC) code targeting the bug. The post Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE appeared first on SecurityWeek.

On 7 May 2026, negotiators from the Council of the European Union, the European Parliament, and the European Commission reached a provisional agreement on the terms of the Digital Omnibus on AI, marking the first set of amendments to the EU AI Act since its adoption in June 2024. The final package of amendments reflects... Continue Reading…

At least one threat actor has adopted the recently released malware source code in attacks against NPM developers. The post First Shai-Hulud Worm Clones Emerge appeared first on SecurityWeek.

MiniPlasma: a Windows SYSTEM privilege escalation believed patched in 2020 (CVE-2020-17103) is still fully working on every patched Windows 11. Once again, security researcher Chaotic Eclipse has released a proof-of-concept exploit for a new Windows privilege escalation zero-day called MiniPlasma, which can grant attackers SYSTEM privileges on fully patched systems. The flaw affects “cldflt.sys,” the […]

Grafana appears to have been targeted by Coinbase Cartel, a cybercrime group linked to ShinyHunters, Scattered Spider, and Lapsus$. The post Grafana Confirms Breach After Hackers Claim They Stole Data appeared first on SecurityWeek.

A critical NGINX flaw (CVE-2026-42945) is actively exploited, allowing crashes or possible code execution via malicious HTTP requests. A critical vulnerability in NGINX Plus and NGINX Open, tracked as CVE-2026-42945 (CVSS v4 score of 9.2), is already being actively exploited shortly after disclosure. “We’re seeing active exploitation of CVE-2026-42945 in F5 NGINX, a heap buffer […]

The flaw leads to denial-of-service on default configurations and to remote code execution if ASLR is disabled. The post Exploitation of Critical NGINX Vulnerability Begins appeared first on SecurityWeek.

Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite It's a hot topic, the old "pay or don't pay" for hackers not to leak your data. Since recording this a few days ago, we've had Grafana go with the "no pay" approach, and I've seen a raft

Participants demonstrated exploits for Windows, Linux, VMware, Nvidia, and AI products. The post Hackers Earn $1.3 Million at Pwn2Own Berlin 2026  appeared first on SecurityWeek.

South Korea's local elections next month will be a test bed for how effective regulations might be to stymie the flow of deepfakes.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter JDownloader site hacked to replace installers with Python RAT malware     New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps   Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment   Operation […]