Latest news
Anthropic's Claude Mythos model autonomously discovered thousands of zero-day vulnerabilities within weeks, including a 27-year-old OpenBSD flaw. The 2026 penetration testing report notes that the speed at which enterprises fix critical vulnerabilities varies by up to 25 times, with the slowest group taking 249 days, and the perception gap between C-suite executives and frontline staff regarding SLA compliance reaching as high as 42 percentage points. The report recommends shifting to a programmatic offensive security model, adopting virtual patching, real-time risk registries, and AI-driven defenses to counter machine-speed threats.
Several tech companies, including Anthropic, AWS, IBM, and Microsoft, have announced a joint initiative to discover, disclose, and fix security vulnerabilities in open source software. The alliance, named Akrites, will establish shared security incident response teams and coordinated vulnerability disclosure processes. Led by the Linux Foundation, founding members have committed resources such as funding, engineers, and cybersecurity experts. This move is primarily driven by the emergence of frontier AI models, which have greatly accelerated vulnerability discovery capabilities, while the existing open source ecosystem struggles to respond quickly.
The U.S. Federal Communications Commission (FCC) on Thursday approved a set of basic cybersecurity rules for companies that issue emergency alerts. The order, adopted unanimously by three commissioners, mandates that Emergency Alerting System (EAS) operators—such as radio stations, broadcast TV networks, and cable systems—use strong passwords, deploy network firewalls, and promptly apply security patches. The FCC stated the requirements aim to protect EAS from hijacking and preserve public trust. The move follows past incidents, including a 2013 zombie-apocalypse hoax and a 2022 critical vulnerability warning. The FCC also plans further security rules for EAS and Wireless Emergency Alerts (WEA) systems.
At the New York Summit on June 17, AWS released AWS Continuum (security risk identification and remediation) and AWS Context (enterprise data search layer), and upgraded tools such as Kiro, AWS DevOps Agent, AWS Transform, Amazon Bedrock AgentCore, and Amazon Quick Suite to address the growing security and data integration needs of AI agents in enterprise operations.
In March, the Trump administration announced the launch of a pilot program to help states fund cybersecurity defense for critical infrastructure. However, three months later, at least 26 states and the District of Columbia have not participated in the program, with some states unaware of it altogether. The White House has disclosed few details about the program, raising questions about its commitments.
After losing federal funding, MS-ISAC's membership dropped from 18,574 to 5,618, a loss of about 70%. Although the organization has tried to retain members through discounts and subsidies, emphasizing that data quality remains unaffected, experts warn that vulnerabilities in local critical infrastructure may increase, while federal-level support is also shrinking.
The cyber insurance market is undergoing profound changes: insurers, in response to profitability pressures, are strengthening security controls and claims reviews for insured enterprises; the protection gap for small and medium-sized enterprises is enormous; geopolitical conflicts and the development of AI technology further exacerbate the uncertainty of risks.
Open source AI tools born from DARPA's AI Cyber Challenge are revolutionizing vulnerability discovery at lower cost, but adoption in critical infrastructure still faces barriers.
Some U.S. critical infrastructure operators have lost confidence in the federal government's support capabilities. Led by giants such as JPMorgan Chase, Mastercard, and AT&T, the Critical Infrastructure Alliance (ACI) was established in February to promote cross-industry cybersecurity risk collaboration. Alliance Chairman Ben Flatgard stated that the private sector must proactively take on risk management responsibilities. Experts believe this move helps fill the gap left by government coordination, but the lack of federal intelligence support and antitrust exemptions remains a challenge.
Iran has long been viewed as a persistent cyber threat to the United States, but since the escalation of the conflict between the two countries in February of this year, its tactics have significantly improved. Security research institutions point out that Iranian-backed hacker groups—including state-sponsored actors, pro-Iranian hacktivists, and economically motivated hackers—have evolved in both motivation and capability, with attacks becoming more destructive and demonstrating stronger evasion of detection. Recent cases include malware targeting Israeli water facilities, a wiper attack on medical device manufacturer Stryker, and ongoing intrusion attempts against US critical infrastructure.