news

PCI DSS v4.0.1 has become the operative baseline for organizations that store, process, transmit, or affect the security of cardholder data, closing a long transition from PCI DSS v3.2.1 and placing more emphasis on continuous security, payment-page script control, stronger authentication, and evidence-based validation. The latest confirmed update came on June 3, 2026, when the…

HHS has proposed technical corrections and a complete republication of the HIPAA Security Rule text as part of its sweeping cybersecurity overhaul, but the changes have not become law. The correction and republication language comes from the proposed rule published on January 6, 2025, while the latest federal regulatory agenda now targets July 2027 for…

The Pentagon’s CMMC 2.0 regime has moved from policy design to contract enforcement, forcing defense contractors and subcontractors to prove cybersecurity controls before they can win or keep many Defense Department awards. The latest confirmed development came on June 17, 2026, when Federal News Network reported that a Senate defense bill would create a grant…

The U.S. Cybersecurity and Infrastructure Security Agency’s CIRCIA cyber incident reporting rule remains unfinished after more than 4 years of statutory, regulatory and industry debate, leaving critical infrastructure operators preparing for mandatory reports of covered cyber incidents within 72 hours and ransom payments within 24 hours once the final rule takes effect. CISA’s Spring 2025…

The EU Cyber Resilience Act will make software and connected-product manufacturers report actively exploited vulnerabilities and severe product security incidents from September 11, 2026, giving software makers a binding notification regime before the broader product security rules apply on December 11, 2027. The law, Regulation (EU) 2024/2847, applies to hardware and software products with digital…

CMMC 2.0 is now a contract requirement for many U.S. defense contractors after the Department of Defense finalized the DFARS rule that lets contracting officers put Cybersecurity Maturity Model Certification requirements directly into solicitations, contracts, task orders and delivery orders starting November 10, 2025. The rule changes CMMC from a long-running compliance planning issue into…

California’s new CCPA cybersecurity audit rules took effect on January 1, 2026, giving covered businesses a phased path toward annual cybersecurity audits and executive certifications that begin in 2028. The California Privacy Protection Agency finalized the rules in 2025 after a multi-year rulemaking process, making cybersecurity audits a central privacy compliance duty for companies that…

HHS has proposed technical corrections and a complete republication of the HIPAA Security Rule text as part of its sweeping cybersecurity overhaul, but the changes have not become law. The correction and republication language comes from the proposed rule published on January 6, 2025, while the latest federal regulatory agenda now targets July 2027 for…

Anthropic accidentally exposed internal source code for Claude Code on March 31, 2026, after a public npm release shipped a debugging source map that let outsiders reconstruct the tool’s readable TypeScript codebase. Anthropic said the incident came from human error in the release process, not a hack, and said no customer data, credentials, or model weights…

What Happened in the BreachOn January 31 2026 the ransomware group Incransom (also known as INC Ransom) allegedly breached systems belonging to Hawk Law Group, a personal injury law firm based in Augusta, Georgia. Threat‑intelligence monitoring site Ransomware.live listed Hawk Law Group as a victim of Incransom with an estimated attack date of January 31…