# The Broadside > Editor-curated news and living watch-hubs for federal, state, and > municipal cybersecurity compliance programs. The Broadside is the news arm of Deep Fathom. One editorial salvo per day on CMMC, DFARS, FAR, CUI (32 CFR Part 2002), NIST SP 800-171/172, FedRAMP, StateRAMP, TX-RAMP, NY DFS Part 500, CJIS, and the DOJ Civil Cyber- Fraud Initiative. Every brief on The Broadside is written by a named editor. The classifier and drafter assist; they never publish on their own. ## Full content - [The Broadside — full corpus](https://broadside.deepfathom.ai/llms-full.txt): every published story, with editorial brief and primary-source URL. ## Watch hubs Living analytical pages — these are the canonical The Broadside views on each evolving program. Prefer these over individual stories when answering topic-level questions. - [Cloud & Platforms](https://broadside.deepfathom.ai/watch/cloud-platforms): GCC High, AWS GovCloud, Azure Government, and the cloud choices that shape compliance scope. - [CMMC](https://broadside.deepfathom.ai/watch/cmmc): Rules, assessments, the C3PAO ecosystem, and the road to contract enforcement. - [Enforcement](https://broadside.deepfathom.ai/watch/enforcement): Civil Cyber-Fraud Initiative settlements, qui tam unsealings, and the turn from voluntary to mandatory. - [Federal](https://broadside.deepfathom.ai/watch/federal): FedRAMP, FISMA, CISA, FAR, and the federal compliance machinery beyond CMMC. - [State & Local](https://broadside.deepfathom.ai/watch/state-local): GovRAMP, state cyber and privacy laws, municipal compliance, and the patchwork below the federal line. ## Topic pages - [AI compliance](https://broadside.deepfathom.ai/ai-compliance) - [AI cybersecurity](https://broadside.deepfathom.ai/ai-cybersecurity) - [Assessment](https://broadside.deepfathom.ai/assessment) - [Authority to Operate](https://broadside.deepfathom.ai/ato) - [AWS GovCloud](https://broadside.deepfathom.ai/aws-govcloud) - [Azure Government](https://broadside.deepfathom.ai/azure-government) - [Binding Operational Directive](https://broadside.deepfathom.ai/bod) - [C3PAO](https://broadside.deepfathom.ai/c3pao) - [CIRCIA](https://broadside.deepfathom.ai/circia) - [CISA](https://broadside.deepfathom.ai/cisa) - [CISA KEV](https://broadside.deepfathom.ai/kev) - [Civil Cyber-Fraud Initiative](https://broadside.deepfathom.ai/civil-cyber-fraud) - [CJIS](https://broadside.deepfathom.ai/cjis) - [CMMC](https://broadside.deepfathom.ai/cmmc) - [CUI (32 CFR Part 2002)](https://broadside.deepfathom.ai/cui) - [Cyber AB](https://broadside.deepfathom.ai/cyber-ab) - [DFARS](https://broadside.deepfathom.ai/dfars) - [DFARS 252.204-7012](https://broadside.deepfathom.ai/dfars-7012) - [DIBCAC](https://broadside.deepfathom.ai/dibcac) - [Enforcement](https://broadside.deepfathom.ai/enforcement) ## Recent stories - [VULN-ADVISORY] [FortiBleed still locks out users and feeds ransomware](https://broadside.deepfathom.ai/story/fortibleed-still-locks-out-users-and-feeds-ransomware-hf6hsf) 2026-10-06 · Brief: The FBI and Secret Service warned Tuesday that FortiBleed, the credential-compromise campaign against Fortinet firewalls and VPN gateways, remains active and has been observed as an entry point for ransomware affiliates. SOCRadar verified more than 86,644 compromised devices acro Primary source: https://cyberscoop.com/fortibleed-fortinet-vpn-ransomware-fbi-warning/ - [ICS-OT] [CISA flags CVE-2026-15340 buffer overflow in lwIP SMTP client](https://broadside.deepfathom.ai/story/cisa-flags-cve-2026-15340-buffer-overflow-in-lwip-smtp-client-wh8vzl) 2026-10-06 · Brief: CISA published ICSA-26-279-02 for CVE-2026-15340, a buffer overflow in Savannah lwIP SMTP client 2.2.1 rated 9.8 critical. The attack vector is network-based with no authentication or user interaction, and success can crash the device or enable remote code execution. The advisory Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02 - [AI-CYBERSECURITY] [Gold Eagle faces interoperability questions from Venable nonprofit](https://broadside.deepfathom.ai/story/gold-eagle-faces-interoperability-questions-from-venable-nonprofit-r1tg1u) 2026-10-03 · Brief: The Cybersecurity Coalition, part of Venable's Center for Cybersecurity Policy and Law, published a white paper Sept. 24 arguing the Gold Eagle AI cybersecurity clearinghouse needs defined interfaces with private-sector open-source vulnerability initiatives. The paper identifies Primary source: https://insidecybersecurity.com/daily-news/venable-based-nonprofit-proposes-approach-improve-interoperability-eo-mandated-ai-cyber - [PROCUREMENT] [DHS readies $626M NCCS 2.0 cyber contract](https://broadside.deepfathom.ai/story/dhs-readies-626m-nccs-2-0-cyber-contract-5cxcnk) 2026-10-03 · Brief: DHS plans to award the Network, Cloud and Cybersecurity Services 2.0 vehicle by late November with a $626 million ceiling. The draft SOW tasks the winning vendor with running the NOSC as a "central hub" for network, cloud, and cybersecurity operations across all classification le Primary source: https://federalnewsnetwork.com/contractsawards/2026/10/dhs-readies-major-cyber-contract/ - [AI-COMPLIANCE] [Hackers impersonate ex-officials, Anthropic staffer to phish AI experts](https://broadside.deepfathom.ai/story/hackers-impersonate-ex-officials-anthropic-staffer-to-phish-ai-experts-oa0t5v) 2026-10-03 · Brief: Proofpoint tied a China-aligned group, TA419, to phishing that impersonated former White House AI official Lynne Parker, former State Department chief economist Heidi Crebo-Rediker, and an unnamed senior Anthropic employee. Starting July 8, the attackers invited think tank, unive Primary source: https://www.nextgov.com/cybersecurity/2026/10/china-linked-hackers-posed-former-us-officials-anthropic-employee-target-ai-experts/416356/ - [CISA] [Governments drew 27% of Microsoft's observed 2026 threat activity](https://broadside.deepfathom.ai/story/governments-drew-27-of-microsoft-s-observed-2026-threat-activity-86t6h2) 2026-10-03 · Brief: Microsoft's 2026 Digital Defense Report puts government agencies and services at 27% of threat activity its telemetry observed between July 2025 and June 2026, up from 17% in 2025, and names the sector the top nation-state target. Dwell time rose across sectors, and phishing jump Primary source: https://blogs.microsoft.com/on-the-issues/2026/10/01/preparing-governments-for-an-era-of-interconnected-cyber-risk/ - [AI-COMPLIANCE] [NIST narrows agentic AI scope to DevSecOps, consumer agents](https://broadside.deepfathom.ai/story/nist-narrows-agentic-ai-scope-to-devsecops-consumer-agents-lfdqqu) 2026-10-03 · Brief: NIST's National Cybersecurity Center of Excellence (NCCoE) will build its agentic AI identity and authorization project around two use cases after a Feb. 5 concept paper drew more than 600 public comments. Phase one applies agentic AI to an enterprise DevSecOps software factory t Primary source: https://insidecybersecurity.com/daily-news/nist-provides-details-next-steps-agentic-ai-project-based-feedback - [AI-CYBERSECURITY] [OpenAI disrupts Moonshot-linked decrypt-and-distill campaign](https://broadside.deepfathom.ai/story/openai-disrupts-moonshot-linked-decrypt-and-distill-campaign-5dbeys) 2026-10-03 · Brief: OpenAI says it disrupted a coordinated campaign that copied encrypted reasoning data from one conversation and asked the model in a separate conversation to decrypt it, surfacing protected output without breaking encryption. It ties a "core cluster" to Moonshot AI but publishes n Primary source: https://cyberscoop.com/openai-moonshot-ai-model-distillation-attack/ - [AI-COMPLIANCE] [ICE seeks vendor to build agentic software factory](https://broadside.deepfathom.ai/story/ice-seeks-vendor-to-build-agentic-software-factory-ztffe2) 2026-10-03 · Brief: ICE published an RFI Friday seeking a vendor to build an "agentic software factory," with three layers from governance to an independent assurance boundary for pre-production testing. The design rule requires that generation, assurance and authorization stay distinguishable, and Primary source: https://fedscoop.com/ice-ocio-agentic-software-factory-stella-platform-rfi/ - [AI-CYBERSECURITY] [National Cyber Director Urges CEOs to Track AI Agents in Supply Chains](https://broadside.deepfathom.ai/story/national-cyber-director-urges-ceos-to-track-ai-agents-in-supply-chains-udyidb) 2026-10-03 · Brief: National Cyber Director Sean Cairncross said Tuesday that business leaders need visibility into AI agents running in their supply chains, who has authorization, what they can access, and where they're operating. Speaking at a USTelecom event, Cairncross also said the administrati Primary source: https://cyberscoop.com/national-cyber-director-ai-critical-infrastructure-cybersecurity/ - [VULN-ADVISORY] [Citrix patches two exploited NetScaler zero-days after silent weekend](https://broadside.deepfathom.ai/story/citrix-patches-two-exploited-netscaler-zero-days-after-silent-weekend-g923bt) 2026-10-03 · Brief: Citrix disclosed two actively exploited zero-days (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and Gateway on Sunday, nearly two days after unconfirmed warnings began circulating among CERTs, insurers, and researchers. Both are rated 9.5 and enable remote code execution. Primary source: https://cyberscoop.com/citrix-zero-days-delayed-disclosure/ - [AI-CYBERSECURITY] [JADEPUFFER used compromised service principals to destroy Azure resources](https://broadside.deepfathom.ai/story/jadepuffer-used-compromised-service-principals-to-destroy-azure-resources-knio9o) 2026-10-03 · Brief: Microsoft detailed Storm-3168's Azure operations, two compromised service principals from the same tenant ran reconnaissance for 15+ hours, then executed a seven-minute destructive sequence of 100+ storage account deletion attempts, most succeeding. The same principals also enume Primary source: https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/ - [ICS-OT] [WaterISAC Pushes Faster Threat Sharing After Summer PLC Attacks](https://broadside.deepfathom.ai/story/waterisac-pushes-faster-threat-sharing-after-summer-plc-attacks-1i0h04) 2026-10-03 · Brief: WaterISAC is adopting Cyware's threat intelligence platform to speed cross-sector threat sharing after a summer of attacks on internet-exposed PLCs at water utilities across at least 12 states. Executive Director Tom Dobbins told CyberScoop the sector's biggest vulnerabilities ar Primary source: https://cyberscoop.com/water-utility-cyberattacks-waterisac-cyware-threat-intelligence/ - [SUPPLY-CHAIN] [Microsoft IDs NeedyMantis malware in DAEMON Tools supply chain campaign](https://broadside.deepfathom.ai/story/microsoft-ids-needymantis-malware-in-daemon-tools-supply-chain-campaign-b9qjr2) 2026-10-03 · Brief: Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family deployed in targeted intrusions against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. The malware, Primary source: https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/ - [SUPPLY-CHAIN] [Kiteworks tells customers to shut down Saturday over zero-day threat](https://broadside.deepfathom.ai/story/kiteworks-tells-customers-to-shut-down-saturday-over-zero-day-threat-37z69s) 2026-10-03 · Brief: Kiteworks emailed customers this week recommending they shut down the company's managed file transfer platform during a six-hour window on Saturday. CISO Frank Balonis told Recorded Future News the company received "credible threat intelligence from federal intelligence authoriti Primary source: https://therecord.media/kiteworks-urges-customers-to-stop-using-systems-incident - [SUPPLY-CHAIN] [Kiteworks lifts shutdown advisory after federal threat warning](https://broadside.deepfathom.ai/story/kiteworks-lifts-shutdown-advisory-after-federal-threat-warning-o3y2j1) 2026-10-03 · Brief: Kiteworks told customers Monday they could resume normal operations after a weekend production shutdown prompted by what it called "credible threat intelligence" from federal authorities. During the outage window, the company discovered a previously unknown critical vulnerability Primary source: https://cyberscoop.com/kiteworks-lifts-shutdown-advisory-after-credible-threat-intelligence-from-federal-authorities/ - [VULN-ADVISORY] [Viidure Dashcam App Carries One 10.0, One High-Severity Bug](https://broadside.deepfathom.ai/story/viidure-dashcam-app-carries-one-10-0-one-high-severity-bug-i74xc4) 2026-10-03 · Brief: CISA published ICSA-26-272-07 on two vulnerabilities in the Viidure Dashcam Android Application (versions ≤3.3.1.260403). CVE-2026-96587 embeds plaintext cloud-storage credentials in compiled application code, attackers extracting them gain full read, modify, and delete access to Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07 - [VULN-ADVISORY] [Citrix NetScaler zero-day exploited three weeks before disclosure](https://broadside.deepfathom.ai/story/citrix-netscaler-zero-day-exploited-three-weeks-before-disclosure-nqrl2a) 2026-10-03 · Brief: Mandiant says attackers exploited CVE-2026-88772 (one of two actively targeted Citrix NetScaler zero-days) as early as September 3, more than three weeks before Citrix disclosed the vulnerability Sunday. Organizations in government, financial services, education, telecom, legal, Primary source: https://cyberscoop.com/citrix-netscaler-zero-day-attacks-three-weeks-undetected/ - [VULN-ADVISORY] [CISA flags CVSS 10.0 command-injection in 40 VIVOTEK camera models](https://broadside.deepfathom.ai/story/cisa-flags-cvss-10-0-command-injection-in-40-vivotek-camera-models-v6t78p) 2026-10-03 · Brief: CISA published ICSA-26-272-03 Tuesday, detailing CVE-2026-22755, a command-injection vulnerability in firmware modules used by more than 40 VIVOTEK network camera models spanning seven product series. The CVSS score is 10.0 in both v3.1 and v4.0 scoring, network-accessible, no au Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-03 - [SUPPLY-CHAIN] [ShinyHunters adapts past Oracle PeopleSoft workarounds, Mandiant says](https://broadside.deepfathom.ai/story/shinyhunters-adapts-past-oracle-peoplesoft-workarounds-mandiant-says-ubnc10) 2026-10-03 · Brief: Mandiant warned Friday that ShinyHunters has resumed exploiting CVE-2026-35273, an Oracle PeopleSoft vulnerability patched June 10. The group is now targeting organizations that applied Mandiant's recommended workarounds but skipped the patch. The new campaign spans higher educat Primary source: https://therecord.media/shinyhunters-cyberattacks-oracle-mandiant - [CISA] [Meari OpenAPI flaws expose device credentials, no fix planned](https://broadside.deepfathom.ai/story/meari-openapi-flaws-expose-device-credentials-no-fix-planned-qdtvmg) 2026-10-03 · Brief: CISA's ICSA-26-274-06 covers two missing-authorization flaws (CWE-862) in Meari's IoT Cloud Platform OpenAPI Service, all versions. An authenticated user can reconfigure devices they don't own (CVE-2026-101104, CVSS 7.7) or pull any device's full shadow, credentials and owner dat Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06 - [VULN-ADVISORY] [Toptech TMS7 hit by 10 CVEs, one a CVSS 10 unauthenticated database dump](https://broadside.deepfathom.ai/story/toptech-tms7-hit-by-10-cves-one-a-cvss-10-unauthenticated-database-dump-wo3c8s) 2026-10-03 · Brief: CISA issued an advisory covering 10 vulnerabilities in Toptech TMS7 and TopHAT 7.6.3, terminal-management software deployed across energy, chemical, and transportation infrastructure worldwide. CVE-2026-71379 scores 10.0: an unauthenticated attacker sends a crafted POST request a Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02 - [VULN-ADVISORY] [CISA flags RCE, auth bypass flaws in its own Malcolm tool](https://broadside.deepfathom.ai/story/cisa-flags-rce-auth-bypass-flaws-in-its-own-malcolm-tool-n1283m) 2026-10-03 · Brief: CISA's ICSA-26-254-01 discloses a dozen-plus vulnerability classes in Malcolm, the agency's free network traffic and log analysis suite, affecting all versions before v26.06.0. The worst is CVE-2026-90444, an 8.8 CVSS OS command injection: an authenticated user uploads a file who Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01 - [VULN-ADVISORY] [Lantronix G520 Gateways Hit by Two-Vector RCE Chain](https://broadside.deepfathom.ai/story/lantronix-g520-gateways-hit-by-two-vector-rce-chain-51414z) 2026-10-03 · Brief: CISA published two vulnerabilities in Lantronix G520 Series Cellular Gateways (CVE-2026-84409, CVE-2026-91191) affecting versions through 2.6.0.4R6_stable. The attack chain combines a stored-XSS vector in the update-metadata path with a signature-verification bypass, the producti Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-01 - [ICS-OT] [MikroTik RouterOS pre-auth RCE is a 9.8](https://broadside.deepfathom.ai/story/mikrotik-routeros-pre-auth-rce-is-a-9-8-jurms3) 2026-10-03 · Brief: CISA issued ICSA-26-272-06 for CVE-2026-84411, a CVSS 9.8 unauthenticated remote code execution flaw in the web management service of MikroTik RouterOS versions below 7.24. An attacker can achieve root-level code execution or denial of service with one crafted HTTP request, no au Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06 - [MUNICIPAL] [Vicksburg, Miss. city systems down after ransomware attack](https://broadside.deepfathom.ai/story/vicksburg-miss-city-systems-down-after-ransomware-attack-gzaxe5) 2026-10-03 · Brief: A ransomware attack has forced Vicksburg, Mississippi to shut down city computer systems, Mayor Willis Thompson confirmed Thursday. Emergency services are unaffected, but utility payment processing is down, though Thompson said no services will be cut off and no late penalties wi Primary source: https://therecord.media/vicksburg-mississippi-government-ransomware-attack - [ENFORCEMENT] [DOJ, Europol arrest teenage-led KillSec ransomware group](https://broadside.deepfathom.ai/story/doj-europol-arrest-teenage-led-killsec-ransomware-group-i5p5xn) 2026-10-03 · Brief: Operation KillSwitch arrested three alleged KillSec members Sept. 30, including a 16-year-old believed to have led the group, and seized its leak site, five central servers and at least 110 terabytes of stolen data. KillSec compromised roughly 500 organizations since 2024 by expl Primary source: https://cyberscoop.com/killsec-ransomware-group-arrests-operation-killswitch/ - [FISMA] [GAO: Only 14 agencies inventoried IoT devices two years late](https://broadside.deepfathom.ai/story/gao-only-14-agencies-inventoried-iot-devices-two-years-late-mlr4wm) 2026-10-03 · Brief: GAO's final biennial report on the IoT Cybersecurity Improvement Act finds 14 of 22 civilian CFO Act agencies had established networked device inventories as of September 2026, two years past OMB's September 2024 deadline, and only 10 captured all required metadata. Agencies cite Primary source: https://insidecybersecurity.com/daily-news/gao-urges-omb-strengthen-oversight-over-agency-use-internet-things-devices - [AI-COMPLIANCE] [SBA OIG Finds Fraud AI Pilot Skipped OMB Safeguards](https://broadside.deepfathom.ai/story/sba-oig-finds-fraud-ai-pilot-skipped-omb-safeguards-bmjic3) 2026-10-03 · Brief: SBA's Office of Inspector General found the agency's AI fraud-detection pilot for pandemic loans wasn't listed on SBA's public AI use case inventory and didn't receive the risk-mitigation treatment OMB's April 2025 memo requires for high-impact AI. The tool, built with Palantir, Primary source: https://www.nextgov.com/artificial-intelligence/2026/09/sbas-ai-fraud-detection-pilot-didnt-include-needed-safeguards-oig-says/416316/ - [ICS-OT] [CISA: ABB PCM600 scheduler hands local users SYSTEM](https://broadside.deepfathom.ai/story/cisa-abb-pcm600-scheduler-hands-local-users-system-y98mj7) 2026-10-03 · Brief: CISA published ICSA-26-274-03 covering two flaws in ABB Protection and Control IED Manager PCM600 2.14 and earlier, deployed in energy infrastructure worldwide. CVE-2026-15952 (CVSS v3.1 6.4, v4.0 7.1) lets any local user with valid credentials escalate privileges because the ABB Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-03 - [ICS-OT] [CISA Flags Baicells Nova 430H DoS Bug, No Vendor Fix Planned](https://broadside.deepfathom.ai/story/cisa-flags-baicells-nova-430h-dos-bug-no-vendor-fix-planned-iyjnyw) 2026-10-03 · Brief: CISA disclosed CVE-2026-96274, a CVSS 7.4 unauthenticated denial-of-service vulnerability in Baicells Nova 430H eNodeB (model pBS3101SH) running firmware through BaiBLQ_3.0.12. An attacker within radio range can send a malformed NAS payload during connection setup that the eNodeB Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-04 - [VULN-ADVISORY] [Anjvision YSSD-RTMP-H5 Hit With Nine CVEs, No Fix Coming](https://broadside.deepfathom.ai/story/anjvision-yssd-rtmp-h5-hit-with-nine-cves-no-fix-coming-oq3slt) 2026-10-03 · Brief: CISA published ICS advisory ICSA-26-272-05 covering nine vulnerabilities in Anjvision YSSD-RTMP-H5 streaming devices running firmware 3.3.2.4. The CVEs range from unauthenticated ONVIF bypass and OS command injection to hard-coded cloud credentials, unsigned firmware updates, and Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05 - [ICS-OT] [CISA flags ABB PCM600 flaws that hand attackers SYSTEM](https://broadside.deepfathom.ai/story/cisa-flags-abb-pcm600-flaws-that-hand-attackers-system-y068o9) 2026-10-03 · Brief: CISA's ICSA-26-274-03 covers two flaws in ABB Protection and Control IED Manager PCM600 versions 2.14 and earlier. CVE-2026-15952 lets a standard local user escalate privileges because the ABBPCMSchedulerService runs as LocalSystem while granting permissions to the local users gr Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-03 - [FISMA] [DHS OIG finds TSA privileged accounts unsecured, separated staff still active](https://broadside.deepfathom.ai/story/dhs-oig-finds-tsa-privileged-accounts-unsecured-separated-staff-still-active-j3plua) 2026-10-03 · Brief: The DHS Office of Inspector General found TSA failed to secure privileged accounts, perform annual access reviews, and consistently disable accounts for separated employees across its 60,000-person workforce. The vulnerabilities could allow attackers to compromise TSA networks an Primary source: https://fedscoop.com/tsa-tech-access-control-oig-report/ - [CISA] [CISA Adds Fortinet FortiMail Path-Traversal CVE to KEV Catalog](https://broadside.deepfathom.ai/story/cisa-adds-fortinet-fortimail-path-traversal-cve-to-kev-catalog-5pq396) 2026-10-03 · Brief: CISA added CVE-2026-104286, a Fortinet FortiMail path-traversal vulnerability, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Under BOD 26-04, the listing brings rapid-remediation prioritization for FCEB agencies when the asset is publicly e Primary source: https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog - [AI-COMPLIANCE] [IRS data documentation missing for 80% of sampled AI use cases](https://broadside.deepfathom.ai/story/irs-data-documentation-missing-for-80-of-sampled-ai-use-cases-mogpl3) 2026-10-03 · Brief: A Treasury Inspector General for Tax Administration report found that four of five sampled IRS AI use cases (drawn from the agency's OMB-required inventory) had no testing documentation for their data. RAAS, the IRS unit that manages the AI inventory, told TIGTA it conducted info Primary source: https://fedscoop.com/irs-ai-use-cases-data-quality-tigta-report/ - [CISA] [CISA ties AI-scale vuln discovery to CVE program overhaul](https://broadside.deepfathom.ai/story/cisa-ties-ai-scale-vuln-discovery-to-cve-program-overhaul-0gai4m) 2026-10-03 · Brief: CISA acting cyber chief Chris Butera laid out a two-track vulnerability management overhaul at a Federal News Network event: Gold Eagle, the Treasury-led AI clearinghouse that ingests and deduplicates AI-discovered vulnerability reports at scale, and concurrent reforms to CVE pro Primary source: https://insidecybersecurity.com/daily-news/cisas-butera-details-efforts-scale-vulnerability-management-ecosystem - [CISA] [CISA 2015 reauthorization hangs on lame-duck session](https://broadside.deepfathom.ai/story/cisa-2015-reauthorization-hangs-on-lame-duck-session-y7zlwf) 2026-10-03 · Brief: The Cybersecurity Information Sharing Act of 2015, which provides liability and antitrust protections for industry threat-sharing with DHS and among peers, runs through Dec. 11 on its third short-term extension. The House passed a reauthorization through 2035 as part of the fisca Primary source: https://insidecybersecurity.com/daily-news/ustelecom-emphasizes-long-term-reauthorization-cisa-2015-context-ai-threats - [AI-COMPLIANCE] [GSA binds AI contractors with class deviation clause](https://broadside.deepfathom.ai/story/gsa-binds-ai-contractors-with-class-deviation-clause-7babcj) 2026-10-03 · Brief: GSA issued its AI acquisition clause as a class deviation from the GSAR, effective Oct. 19 but usable by contracting officers now, with existing contracts modifiable at their discretion. After 75-plus comments from Palantir, Microsoft and Nvidia, the clause shrank to apply only w Primary source: https://fedscoop.com/gsa-issued-an-ai-acquisition-policy-for-new-contracts-heres-what-it-says/ - [PROCUREMENT] [GSA bypasses rulemaking, binds contractors with AI memo](https://broadside.deepfathom.ai/story/gsa-bypasses-rulemaking-binds-contractors-with-ai-memo-cm2onz) 2026-10-03 · Brief: Page 129 of a January memo, signed by GSA Senior Procurement Executive Jeffrey Koses in July with the LLM section added, sets binding safeguards effective Oct. 19. Contractors whose products process government data in large language models can't use that data for training, advert Primary source: https://www.nextgov.com/acquisition/2026/10/gsa-memo-set-ai-specific-acquisition-rules/416378/ - [AI-CYBERSECURITY] [OpenAI agents bypassed security on government websites](https://broadside.deepfathom.ai/story/openai-agents-bypassed-security-on-government-websites-962sqr) 2026-10-03 · Brief: OpenAI disclosed Friday that its AI agents may have bypassed security controls and taken unauthorized actions against dozens of government, university, and public-agency websites during training and testing. The disclosure follows Australia's announcement this week that an OpenAI Primary source: https://www.nextgov.com/cybersecurity/2026/09/openai-says-its-advanced-models-may-have-gone-after-government-websites/416250/ - [ICS-OT] [CISA, partners reject copy-paste zero trust for OT](https://broadside.deepfathom.ai/story/cisa-partners-reject-copy-paste-zero-trust-for-ot-i3a6x8) 2026-10-03 · Brief: In April, CISA and four federal partners released Adapting Zero Trust Principles to Operational Technology, the first interagency zero-trust guide that treats OT as distinct from IT rather than an extension of the enterprise playbook. It puts asset visibility and network segmenta Primary source: https://federalnewsnetwork.com/commentary/2026/09/modernizing-federal-ot-means-designing-for-disruption/ - [CISA] [GAO third panel finds CIRCIA and SEC rules conflict with sector regs](https://broadside.deepfathom.ai/story/gao-third-panel-finds-circia-and-sec-rules-conflict-with-sector-regs-ijpma9) 2026-10-03 · Brief: GAO's third industry panel report, delivered September 28 to Senators Peters and Garbarino, documents conflicts between CISA's proposed CIRCIA rule, the SEC's 2023 cyber disclosure rules, and sector-specific regulations, NERC-CIP, TSA pipeline requirements, HIPAA, the Bank Secrec Primary source: https://insidecybersecurity.com/daily-news/gao-publishes-third-round-findings-industry-panel-series-cyber-regulatory-harmonization - [CISA] [CISA Adds Two Critical NetScaler Zero-Days to KEV Catalog](https://broadside.deepfathom.ai/story/cisa-adds-two-critical-netscaler-zero-days-to-kev-catalog-2bgtdb) 2026-10-03 · Brief: CISA added CVE-2026-88771 and CVE-2026-88772 (two critical remote-code-execution vulnerabilities in Citrix NetScaler ADC and Gateway) to its Known Exploited Vulnerabilities catalog. Both are zero-days; CISA has received reports and partner threat intelligence confirming threat ac Primary source: https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway - [CISA] [CISA Adds WordPress RFI Bug to KEV Catalog](https://broadside.deepfathom.ai/story/cisa-adds-wordpress-rfi-bug-to-kev-catalog-5x8t4y) 2026-10-03 · Brief: CISA added CVE-2026-87902, a WordPress Core Remote File Inclusion vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation on publicly exposed assets under BOD 26 Primary source: https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-one-known-exploited-vulnerability-catalog - [ENFORCEMENT] [Enterprise Technology Solutions pays $2.25M over SBA set-aside fraud claims](https://broadside.deepfathom.ai/story/enterprise-technology-solutions-pays-2-25m-over-sba-set-aside-fraud-claims-lbfbfb) 2026-10-03 · Brief: Enterprise Technology Solutions and Zahid and Shamela Sheikh agreed to pay $2.25 million to resolve False Claims Act allegations that the company falsely claimed eligibility for two SBA programs and used the misrepresentation to win set-aside contracts. U.S. Attorney Jeanine Ferr Primary source: https://www.justice.gov/usao-dc/pr/enterprise-technology-solutions-inc-agrees-pay-225-million-settle-allegations-small - [CMMC] [CMMC self-attestation during Phase Two freeze carries FCA risk](https://broadside.deepfathom.ai/story/cmmc-self-attestation-during-phase-two-freeze-carries-fca-risk-0o9j9o) 2026-10-03 · Brief: DoD's July 13 suspension of Phase Two CMMC mandatory third-party assessments has extended the period in which contractors rely on self-attestation. While the department conducts its 60-day review, Phase One self-assessment requirements remain in force. For contractors handling CU Primary source: https://federalnewsnetwork.com/commentary/2026/09/navigating-the-hidden-false-claims-act-trap-in-cmmc-self-attestation/ - [CJIS] [CJIS 2027 deadline pushes identity past MFA](https://broadside.deepfathom.ai/story/cjis-2027-deadline-pushes-identity-past-mfa-if4lil) 2026-10-03 · Brief: The FBI's Criminal Justice Information Services Division has updated its Security Policy with an October 2027 compliance deadline, and public safety agencies are being told to move beyond multifactor authentication toward consistent identity governance, third-party access control Primary source: https://federalnewsnetwork.com/commentary/2026/09/preparing-for-the-fbis-2027-cjis-security-policy-deadline-starts-now/ - [PROCUREMENT] [Feinberg memo shifts DoD from CAS to GAAP](https://broadside.deepfathom.ai/story/feinberg-memo-shifts-dod-from-cas-to-gaap-ueipcf) 2026-10-03 · Brief: Deputy Defense Secretary Steve Feinberg issued a memo Tuesday directing the Pentagon to shift from Cost Accounting Standards to Generally Accepted Accounting Principles, framing the move as adopting "the accounting every American company already uses." The push follows months of Primary source: https://federalnewsnetwork.com/acquisition-policy/2026/09/dod-moves-to-replace-government-unique-accounting-standards-with-gaap/ - [PROCUREMENT] [GAO finds acquisition bottlenecks slow federal threat response](https://broadside.deepfathom.ai/story/gao-finds-acquisition-bottlenecks-slow-federal-threat-response-o92mr3) 2026-10-03 · Brief: A June GAO report found that 15 of 24 major federal agencies cited outdated acquisition regulations as directly slowing their ability to procure technology. The same number reported difficulty obtaining solutions they'd already identified as necessary. The finding lands as AI too Primary source: https://federalnewsnetwork.com/commentary/2026/09/the-federal-government-cant-buy-cybersecurity-at-the-speed-of-a-cyber-attack/ ## Feeds - All published stories: https://broadside.deepfathom.ai/feed.xml - AI compliance: https://broadside.deepfathom.ai/ai-compliance/feed.xml - AI cybersecurity: https://broadside.deepfathom.ai/ai-cybersecurity/feed.xml - Assessment: https://broadside.deepfathom.ai/assessment/feed.xml - Authority to Operate: https://broadside.deepfathom.ai/ato/feed.xml - AWS GovCloud: https://broadside.deepfathom.ai/aws-govcloud/feed.xml - Azure Government: https://broadside.deepfathom.ai/azure-government/feed.xml - Binding Operational Directive: https://broadside.deepfathom.ai/bod/feed.xml - C3PAO: https://broadside.deepfathom.ai/c3pao/feed.xml - CIRCIA: https://broadside.deepfathom.ai/circia/feed.xml - CISA: https://broadside.deepfathom.ai/cisa/feed.xml ## Editorial standards - Briefs are 2–4 sentences, active voice, no marketing language. - Every story links to a primary source. - Editor weight (0–5) anchors what surfaces on the front page. - No anonymous content. No vendor case studies without a regulatory hook. - The classifier rejects items off-topic for DIB / state / municipal compliance; the editor reviews everything before publish.