### Nation-State Threats and Critical Infrastructure Years of warnings about China's notorious **Volt Typhoon** hackers appear to be materializing, with new insights suggesting their pre-positioning within United States critical infrastructure. A recent closed-door war game for insurers simulated worst-case scenarios, underscoring the menacing and disruptive potential of such an incursion. ### Surveillance and Privacy Concerns **ICE's Office of Professional Responsibility** has reportedly initiated over 100 cases investigating online critics of the agency, citing "incidents of doxing and threats." This development raises significant questions about the scope of internal oversight and its impact on free speech. In the European Union, a renewed push for the controversial "Chat Control" bill means tech companies will again be able to scan citizens' personal texts, emails, and social media messages. Despite a majority of lawmakers voting against the proposal, the European Parliament extended the legislation, ostensibly to curb online child abuse material, but sparking widespread privacy concerns. Further revelations this week shed light on the surveillance practices at **Madison Square Garden (MSG)**. It was disclosed that MSG maintained a database categorizing hundreds of celebrities, prominent **Knicks** superfans, and even some **Taylor Swift** wedding guests. Labels used in this database included "LGBTQIA," "DO NOT HOST," and various risk levels. ### Vulnerabilities and Exploits Security firm **Nebula Security** has published exploit code for **GhostLock** (**CVE-2026-43499**), a use-after-free bug that resided in the **Linux kernel** for 15 years. This critical vulnerability allows any logged-in user to gain root access on an unpatched machine without special permissions or network access. The flaw, present in most mainstream Linux distributions since 2011, was fixed in April, but patch availability remains uneven across distributions like **Ubuntu**. Notably, **Nebula** discovered **GhostLock** using **VEGA**, their AI-driven bug-hunting tool, highlighting the increasing role of automated systems in uncovering long-standing vulnerabilities in legacy codebases. ### Misguided Tracking by Automated Systems Journalist Joel Feder recounted in **The Drive** being wrongly tracked for days and confronted by four police officers in Plymouth, Minnesota, due to an error by **Flock's** license plate cameras. The incident, stemming from a data-entry typo 2,000 miles away, falsely flagged his loaner vehicle as stolen. This highlights the dangers of over-reliance on automated surveillance systems and the potential for misidentification. ### Contractor Breaches and Government Contracts Consulting giant **Accenture** has confirmed a security breach after a threat actor, identified as "888," claimed to have exfiltrated 35 GB of sensitive data, including source code, RSA and SSH keys, Azure access tokens, and configuration files. This incident is particularly notable given **Accenture Federal Services'** role in holding **ICE's Cyber Defense and Intelligence Support Services contract**, providing 24/7 threat monitoring and incident response for the agency. ### The Pentagon's Cyber Workforce Initiatives The Pentagon has opened applications for **Cyber RAP**, a paid apprenticeship program designed to recruit individuals without prior cyber degrees or experience into full-time roles safeguarding departmental networks. While lauded by **US military CIO Kirsten Davies** for prioritizing "raw aptitude" over "academic gatekeeping," the program's annual pay of $22,584 and requirements for repayment if participants drop out raise questions about its viability and attractiveness. Separately, a provision in the Senate Armed Services Committee's FY2027 defense bill proposes a pilot program allowing **Defense Secretary Pete Hegseth** to conduct cyber operations through "contractor-owned, contractor-operated means." This initiative, which critics liken to government-sanctioned "hackers-for-hire," has sparked considerable debate, with former **Biden White House** cyber official Nick Leiserson warning it "contributes to global cyber instability." This controversial idea echoes past proposals, such as the **Scam Farms Marque and Reprisal Authorization Act**, introduced by **US Representative David Schweikert**, which sought to grant the President powers akin to those used for privateers in the War of 1812 to seize assets of foreign cybercriminals.