Policy
Citrix NetScaler Is on the Exploited Catalog Again
CISA added CVE-2026-88779 on October 4. The catalog due date is October 7, the day of this briefing. The September NetScaler rows are a different pair of bugs.
Section
Policy
EU AI Act dates, SEC clocks, export licenses, and bugs CISA says are already in use.
Policy
The SEC Proposed a Path for Crypto Custody
On October 1 the Commission proposed custody rules for crypto assets held by advisers and regulated funds. The posts are the alert. Comments run from the Federal Register.
Policy
CISA Listed Three Bugs Attackers Are Already Using
WordPress on September 25, Apple on September 29, Cisco SD-WAN Manager on September 30. The posts are the alerts. The catalog holds the due dates.
Policy
The EU AI Act Did Not Slip. The High-Risk Part Did.
Article 50 transparency has been in force since August 2. Stand-alone high-risk duties move to December 2, 2027. A US buyer still has to ask which date the vendor is selling.
Policy
The Software Ingredients List Now Covers the Suite
CISA’s July 29 revision of the SBOM minimum elements applies to SaaS and AI software, not only to code you compile. The new fields are the ones to ask for.
Policy
The SEC Clock Starts When You Decide It Matters
Public companies disclose a material cyber incident on Form 8-K within four business days of the materiality call. The annual report still has to describe who watches the risk.
Policy
Chip Licenses Keep Moving. The Mid-Tier Still Waits.
BIS opened a case-by-case window for H200-class chips. Korea tightened AI-chip exports on Sept. 1.
Policy
When Compliance Is the Product
Data residency, audit trails, and model clauses are no longer legal footnotes. They are packaging.
Policy
Chip Export Controls and the Suppliers Caught in Between
Policy is written in Washington. The P&L lands on toolmakers, packagers, and the mid-tier vendors nobody briefed.