IT news

EFF to Fourth Circuit: Electronic Device Searches at the Border Require a Warrant

EFF, along with the national ACLU, the ACLU affiliates in Maryland, North Carolina, South Carolina, and Virginia, and the National Association of Criminal Defense Lawyers (NACDL) filed an amicus brief in the U.S. Court of Appeals for the Fourth Circuit urging the court to require a warrant for border searches of electronic devices under the Fourth Amendment, an argument EFF has been making in the courts and Congress for nearly a decade. The Fourth Circuit heard oral arguments on May 8. The Knigh

EFF Stands in Solidarity With RightsCon and the Global Digital Rights Community

When governments shut down spaces for dialogue, dissent, and collective organizing, the damage extends far beyond a single event. The abrupt cancellation of RightsCon 2026—the world’s largest annual global digital rights conference—is not just a logistical disruption for thousands of researchers, journalists, technologists, and activists—it is part of a growing global pattern of shrinking civic space and increasing hostility toward free expression and independent civil society. Just days before

Unearthing a Colombian Politician’s Connections to Neo-Nazi Active Club Group

This investigation is a collaboration between Bellingcat and Colombian media outlet Cerosetenta. You can read Cerosetenta’s piece in Spanish here. A video posted on Feb. 26 shows several men painting over graffiti in Restrepo, a neighbourhood in Bogota, Colombia, and replacing them with images of their own: a logo used by Colombian political candidate and […] The post Unearthing a Colombian Politician’s Connections to Neo-Nazi Active Club Group appeared first on bellingcat.

BfDI invites you to a high-level debate in Brussels

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Executive Summary Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both a sop

FTC and Illinois Take Action to Stop Deceptive Conduct by Company that Created Thousands of Business Listings of Fake Local Home Repair Businesses

Premium Home Service also used fake online reviews to boost ratings and siphon customers from true local businesses The U.S. Department of Justice, on behalf of the Federal Trade Commission, and the state of Illinois sued Chicago-based company Premium Home Service (PHS) and its owner for fraudulently creating thousands of fake online business listings for home repair companies to deceive consumers into thinking they were choosing reputable local companies for home repairs. View Press Release

FTC Chairman Ferguson Advises Companies to Comply with the Take It Down Act

Federal Trade Commission Chairman Andrew N. Ferguson sent letters today to more than a dozen prominent technology companies reminding businesses of their obligation to comply fully with the Take It Down Act (TIDA) no later than May 19. Signed into law last year by President Donald J.View Press Release

Inside CrowdStrike Automated Leads: A Transformative Approach to Threat Detections

Chancellor Merz congratulates the Prime Minister of Hungary, Péter Magyar

Dear Prime Minister, I warmly congratulate you on taking office. Germany and Hungary are closely linked to each other in many ways and are partners in the European Union and NATO. I look forward to working with you to intensify and further expand these connections for the benefit of our two countries. I would be very pleased to be able to welcome you personally to Berlin soon. I wish you success and success in the tasks ahead of you

Congress Narrowed the GUARD Act, But Serious Problems Remain

Following criticism, lawmakers have narrowed the GUARD Act, a bill aimed at restricting minors’ access to certain AI systems. The earlier version could have applied broadly to nearly every AI-powered chatbot or search tool. The amended bill focuses more narrowly on so-called “AI companions”—conversational systems designed to simulate emotional or interpersonal interactions with users. That change does address some of the broadest concerns raised about the original proposal, though some questions

Free Signal Guide

EFF friend Guy Kawasaki* has written a book: Everybody Has Something to Hide: Why and How to Use Signal to Preserve Your Privacy, Security, and Well-Being. This guide is now available in Spanish and English as an ebook in the EPUB format that you can download here. Take a look and consider sharing it with anyone who you know who uses (or should use) Signal. And don't forget: EFF has two short guides on using Signal on our Surveillance Self-Defense site. An intro How to Use Signal guide, and a gu

FTC Chairman Ferguson Issues Noncompete Warning Letter to Mortgage Connect

Federal Trade Commission Chairman Andrew N.View Press Release

CVE-2025-68670: discovering an RCE vulnerability in xrdp

During a security assessment of Kaspersky USB Redirector, we discovered CVE-2025-68670: a pre-auth RCE in the xrdp server component. Project maintainers promptly patched the vulnerability.

Canvas Breach Disrupts Schools & Colleges Nationwide

An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service's login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.

Building for the future

This afternoon, we sent the following email to our global team. One of our core values at Cloudflare is transparency, and we believe it's important that you hear this directly from us because it’s a major moment at Cloudflare.

Version 1.0: Ivanti EPMM: Systems attacked via new vulnerability

Guidance for AI in medical devices published

How Cloudflare responded to the “Copy Fail” Linux vulnerability

When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.

FTC to Co-Host Workshop on Financial Services with Institute for Consumer Financial Choice on May 14-15

Workshop will focus on marketplace developments in five years since the creation of Taskforce on Federal Consumer Financial Law The Federal Trade Commission will co-host a workshop on May 14-15, 2026, with George Mason University Law School’s Institute for Consumer Financial Choice (ICFC) focusing on developments in the financial services marketplace in the five years since the creation of the Consumer Financial Protection Bureau’s Taskforce on Federal Consumer Financial Law. View Press Release

FTC Finalizes Consent Order in Valvoline-Greenbriar Deal

The Federal Trade Commission finalized a consent order resolving antitrust concerns related to a deal between Valvoline Inc. and private equity firm Greenbriar Equity Fund V., L.P. (Greenbriar). View Press Release

81 years of the end of the Second World War – Minister of State Weimer: “Dealing with the past remains central”

May 8th marks the end of the Second World War in Europe with the surrender of the German Wehrmacht. This marked the end of a war of annihilation that began in Germany and cost millions of lives and brought immense suffering to Europe and the world. "May 8th is a day of liberation - from the National Socialist reign of terror, from war and violence. At the same time, it is a day of warning. Dealing with our past is and remains a central A

Exploits and vulnerabilities in Q1 2026

This report provides statistical data on published vulnerabilities and exploits we researched during Q1 2026. It also includes summary data on the use of C2 frameworks in APT attacks.

Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Unit 42 details CVE-2026-0300, a buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal. Read now for details. The post Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution appeared first on Unit 42.

Donuts and Beagles: Fake Claude site spreads backdoor

A malicious imitation of Anthropic’s Claude site leads to DLL sideloading – and a backdoor Categories: Threat Research Tags: Claude, Beagle, Backdoor, malvertising, AI, DONUT, DLL sideloading, Sophos X-Ops

Milestone 1.0.0 Release of APK Downloader `apkeep` Powers Research on Android Apps

Last week, we released apkeep version 1.0.0, the latest edition of our command-line Android package downloading software. Rather than indicating major changes for the project, this milestone instead signifies arriving at a relatively stable and mature place after gradual iteration on the project over the course of over four years. What’s New in 1.0.0 We do have a few fresh features we’ve packed into this latest release, though—all focused on the Google Play Store: You can now download a dex meta

When DNSSEC goes wrong: how we responded to the .de TLD outage

On May 5, 2026, DENIC published broken DNSSEC signatures for the .de TLD, making millions of domains unreachable. Here's what 1.1.1.1 saw, how serve stale cushioned the impact, and how we restored resolution.

👎 California's Terrible, No Good, Very Bad Social Media Ban | EFFector 38.9

We'd all like the internet to be a better place—for kids and adults alike. But in the name of online safety, governments around the world are racing to impose a dangerous new system of control. Are age gates the silver bullet to the internet's problems they're being promoted as? Or are we being sold a bill of goods? We're answering this question and more in our latest EFFector newsletter. JOIN OUR NEWSLETTER For over 35 years, EFFector has been your guide to understanding the intersection of tec

The SECURE Data Act is Not a Serious Piece of Privacy Legislation

The federal SECURE Data Act is not a serious consumer privacy bill, and its provisions—if enacted—would be a retreat from already insufficient state protections. Republicans on the House Energy and Commerce Committee released a draft of the bill late last month without bipartisan support. The bill is weaker than congressional proposals in prior years, as well as most of the 21 state consumer privacy laws already on the books. The bill could wipe out hundreds of state privacy protections. Most tr

Data protection supervision 2025: advise, control, create legal clarity

BfDI presents its 34th activity report

Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years

Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our analysis. The post Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years appeared first on Unit 42.