Data security correspondent

Elena Voss

Articles: 9
Desks: 4

Focuses on data exposure, encryption, and breach containment.

data-securityincident-responsebreach-analysis

Coverage by Elena Voss

Data graphic: DHS FASCSA Order #2026-01 path from DeepSeek and products built on it to exclusion from civilian procurement and removal from civilian agency IT.

DHS Orders DeepSeek, and Anything Built on It, Out of Federal Civilian IT

A DHS FASCSA order bars DeepSeek, and third-party products built on DeepSeek models, from federal civilian IT, effective immediately. Vendors should map their models.

Oct 21 · 4 min

Data graphic: New York's RAISE Act opens DIGIT registration for large frontier AI developers in Nov 2026, and duties start 1 Jan 2027. Under the amendment bill text as introduced, covered developers have over $500 million in revenue with affiliates, must report an incident within 72 hours, and face up to $3 million per subsequent violation.

watchPolicy New York Raise Act

New York's RAISE Act: frontier AI developers register with DIGIT from November, duties start 1 January

New York's DIGIT office will register large frontier AI developers from November 2026, with disclosure, incident and quarterly duties from 1 January 2027.

Oct 18 · 4 min

Data graphic: a cream editorial cover headed "Who watches while you draw?" with a huge green 24, the number of third-party domains on RoomSketcher's home page at first visit, the most in the test. Smaller figures give the home-page domain counts for Planner 5D 17 , Sweet Home 3D 9 and Floorplanner 5 .

stableData Security Floorgen

Free Floor Plan Software and Privacy: What 5 Apps Collect While You Draw

We loaded Planner 5D, RoomSketcher, Sweet Home 3D, Floorplanner and FloorGen in a clean browser, counted third-party domains and read each privacy policy.

Oct 16 · 9 min

Data graphic: GSA's LLM clause GSAR 552.239-7001, effective 19 Oct 2026, with a giant 7 days to report a material model change. Below: a 25% decommissioning cap on the affected order and no training on government data.

watchPolicy Ai Regulation

GSA's New AI Contract Clause: 7-Day Warning on Model Regressions and No Training on Agency Data

GSA's LLM contract clause, effective 19 October 2026, makes vendors report model regressions within 7 days and bars them from training on government data.

Oct 13 · 5 min

$Data graphic: Windows Cross Device flaw CVE-2026-66804 hands out SYSTEM, scored CVSS 3.1 7.8 Important by Microsoft, with Exploitation More Likely and a working exploit public. The four-step path runs from creating a DLL under ProgramData\CrossDevice, to a fake IMarshal object naming a dangling CLSID, to the Shell Create Object Handler, to the DLL loading in dllhost.exe as SYSTEM.$

elevatedExploits Local Privilege Escalation

Windows Cross Device flaw gives local users SYSTEM, with a public PoC

Project Zero's Forshaw details CVE-2026-66804, an incomplete fix for the Dark Elevator bug. A working exploit is public; August 2026 updates fix it.

Oct 2 · 5 min

Data graphic: a giant '44 days' headed 'Adobe Commerce flaw hits KEV' counts the time from Adobe's 11 August patch to CISA's 24 September KEV listing of CVE-2026-71362, a CVSS 9.1 Critical authorization flaw that needs no authentication.

criticalExploits Cve 2026 71362

Adobe Commerce and Magento Authorization Flaw CVE-2026-71362 Now Exploited

CISA added Adobe's critical Commerce and Magento authorization bug to KEV 44 days after the August patch. Stores on July builds should patch and triage.

Oct 2 · 5 min

Data graphic: one percent-encoded letter, /%50SEMHUB/, gets past WAF rules that block /PSEMHUB/. The attack path runs from the POST request through the WAF, which matches the literal path, to the app server that decodes it, then the PSEMHUB servlet and a web shell or fileless commands, for CVSS 9.8 Critical CVE-2026-35273.

criticalExploits Cve 2026 35273

ShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass

GTIG says UNC6240 (ShinyHunters) is again exploiting PeopleSoft CVE-2026-35273, using /%50SEMHUB/ to slip past WAF rules. Patch, then hunt.

Oct 2 · 7 min

Data graphic: the California AI Transparency Act's 1,000,000 monthly-user threshold struck through in red, removed by SB 1000 effective immediately.

elevatedPolicy Ai Transparency Regulation

California Drops the 1M-User Threshold From Its AI Transparency Act and Signs No Robo Bosses

SB 1000 removes the 1M-user threshold from California's AI Transparency Act, effective now; SB 947 limits AI in firing and discipline from July 2027.

Oct 2 · 3 min