Policy & Regulation
Norway fines Microsoft's Xandr €8.6 million over Grindr data pipe
The ad-tech unit kept relaying sensitive user data for months after Grindr itself was penalised. The regulator says that is on the receiver, not just the sender.
UK regulator gets privacy fixes from ten AI firms, then opens a probe into agents
The Information Commissioner's Office secured changes from Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI, and is now asking what happens when the software starts acting on its own.
Australia's Privacy Watchdog Investigates the Chinese App Maker Inside Kmart's $89 Smart Glasses
The Office of the Australian Information Commissioner has opened a formal investigation into Shenzhen Qingcheng, the company behind the HeyCyan app, after the firm failed to respond to preliminary inquiries about how it handles personal data captured by the glasses.
CISA's Updated Software Ingredient List Rules Change What Knowing Your Code Actually Means
The US government just raised the bar on software transparency. The harder problem is that no single inventory was ever enough to answer the question that matters most: what can your software actually do?
Apple will tighten Full Disk Access after AI agents started reading everything
Apple says it will redesign the macOS permission that hands an approved app the keys to a user's files, mail and browsing history, after finding that AI assistants are quietly using it to hoover up personal data.
Australia Orders Federal Agencies to Audit Old Tech After AI Agent Exploited Medicare Systems
A government-wide stocktake of ageing technology is now mandatory for all 194 Australian federal entities, after an AI-assisted attack exposed how outdated systems make government networks easier to breach.
Australia Calls Out Steam, Roblox, Fortnite and Minecraft Over Child Safety Failures
A new government report finds the four biggest gaming platforms leave children exposed to predators and harmful content, with Steam singled out for the weakest protections of all.
The EU's New Cyber Security Law Gives Manufacturers 24 Hours to Report Flaws. Almost No One Is Ready.
The Cyber Resilience Act, which took effect in September, requires companies to report actively exploited vulnerabilities within one day. Security experts say the clock will break every manual process most vendors currently rely on.
FBI and CISA warn critical infrastructure operators to rein in third-party ICS integrators
A new joint fact sheet asks water, power and manufacturing operators to lock down the outside engineers who quietly run their control systems.
CISA Wants You to Leave a Trap Out for Hackers
America's cyber-defence agency has published detailed guidance on using decoys, fake password files, and tripwire accounts to catch attackers who have already slipped inside a network.
CISA Is Scrapping Its Weekly Vulnerability Bulletin
The agency is retiring its regular digest of known security flaws in favour of a new directive that tells federal agencies to patch based on real-world danger, not scores on a chart.
CISA Orders Federal Agencies to Patch Two Linux Kernel Flaws
The KEV catalog additions are the first Linux kernel entries to test Binding Operational Directive 26-04's risk-based patching regime.
The EU's New 24-Hour Bug Reporting Rule Starts September 11. Most Vendors Aren't Ready.
A new European law forces software makers to disclose actively exploited flaws within a day. The hard part isn't the paperwork, it's knowing what you shipped.
Windows 11 to Tell Apps If You're a Child or Adult, Without Sharing Your Birthday
Microsoft's new age-awareness APIs return age bands rather than exact dates, and pair with a verify-once system tied to your Microsoft account.
Eight in Ten UK Gambling Sites May Be Breaking Privacy Law, Study Finds
New research suggests most licensed British bookmakers and online casinos collect personal data from visitors before those visitors have agreed to it, putting them at odds with GDPR rules.