Europe named its attacker. The EU and the United Kingdom, acting together for the first time, sanctioned Russia's FSB Centre 16 along with two dozen individuals and entities over a decade of sabotage across the continent — including the December attack that came within reach of cutting power to half a million Poles in midwinter — while a nineteen-nation advisory pinned the same unit to a long campaign of squatting inside the world's neglected routers, and Dutch intelligence disclosed that Russian operators had quietly turned privately-owned doorbell cameras across NATO countries into a surveillance network for tracking weapons bound for Ukraine. The through-line is unglamorous: Moscow is not breaking down Europe's doors so much as walking through the ones left open, and the cost of that neglect showed up elsewhere too, in a German textile firm that filed for insolvency after an attack stopped its production line for six weeks, and in Lidl customers across three countries learning their data had been taken from a supplier they had never heard of. Brussels spent the same days building doors of its own, as von der Leyen's child-safety panel called for a bloc-wide social media ban for under-13s enforced by age verification, even while Parliament voted to let Meta and Google keep scanning private messages — a pairing that tells you which way European tech policy is now bending. And the AI order kept fracturing: Apple's suit against OpenAI drew Microsoft's leadership into open hostility toward the frontier labs it once courted, Asian chipmakers led a global selloff on bubble jitters, and Europe's own answer arrived as capital rather than regulation, with Helsing raising $1.8 billion to become the continent's most valuable defence startup.
Top Stories
- Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions — The Record from Recorded Future News · Threat Intelligence (CTI)
- Russian State Hackers Target Vulnerable Routers Worldwide, Joint Advisory Warns — Infosecurity Magazine · Threat Intelligence (CTI)
- Russian spies hacked security cameras to monitor weapons shipments to Ukraine — intelNews.org · Threat Intelligence (CTI)
- EU leaders eye social media ban for children under age 13 — The Record from Recorded Future News · EU & Technology
- Apple Sues OpenAI, Apple’s Real Problem — Stratechery by Ben Thompson · AI & Power
AI & Power
Apple Sues OpenAI, Apple’s Real Problem — Stratechery by Ben Thompson
Why it matters: The sharpest analysis yet of what Apple's suit against OpenAI reveals about Apple's own strategic bind.
Apple's trade-secret suit against OpenAI is read here as a symptom rather than a strategy: the company's real problem is that it has no answer to the interface layer OpenAI is building.
OpenAI to Require Hardware Passkeys for Access to Its Most Capable Cyber Models — ID Tech
Why it matters: A frontier lab gating its most capable cyber models behind hardware keys is de facto AI export control.
OpenAI will require hardware passkeys for access to its most capable cyber-security models, turning an authentication decision into a capability-control regime.
Microsoft chief turns hostile on frontier AI labs, warns companies to guard their IP — www.theregister.com - Articles
Why it matters: The AI alliance web keeps collapsing into IP litigation and mutual suspicion.
Microsoft's chief turned openly hostile toward frontier AI labs, warning companies to guard their intellectual property from the partners they once courted.
Silicon shadows: inside the black market for AI chips | FT Film — myFT following
Why it matters: Compute is the chokepoint, and the smuggling economy around it is where export control actually gets tested.
An FT investigation inside the black market for AI chips, tracing how restricted silicon still reaches buyers despite tightening Western export controls.
AI Data Centers and the Concentration of Wealth — Schneier on Security
Why it matters: Schneier connects the data-centre build-out to a structural transfer of wealth and power.
Schneier argues the AI data-centre boom is concentrating wealth and power in a handful of firms, with the public absorbing the energy and land costs.
Asian chips lead global tech selloff as AI concerns grow — Semafor
Why it matters: The AI trade wobbles: chipmakers lead a global selloff on bubble anxiety.
Asian chip stocks led a global technology selloff as investors grew more anxious that the AI build-out has run ahead of demand.
More Than 200 Experts Urge Action to Steer AI for Society’s Good — Bloomberg Technology
Why it matters: A large expert coalition pushes for public-interest steering of AI, not just safety rhetoric.
More than 200 experts called for coordinated action to steer AI toward societal benefit, pressing governments to move beyond voluntary commitments.
The loudest warning about AI and jobs yet — Platformer
Why it matters: The labour-displacement argument gets its most concrete framing to date.
Platformer reports the starkest warning yet on AI and employment, arguing displacement is arriving faster than the policy response.
Nvidia Partner GMI Cloud Seeks $635 Million GPU-Backed Bank Loan — Bloomberg Technology
Why it matters: GPUs as loan collateral is the clearest sign yet of AI's financialisation.
Nvidia partner GMI Cloud is seeking a $635 million bank loan backed by its GPUs, a financing structure that ties credit markets directly to AI hardware values.
EU & Technology
EU leaders eye social media ban for children under age 13 — The Record from Recorded Future News
Why it matters: The EU's biggest platform-regulation move since the DSA, and it runs straight through age verification.
EU leaders are moving toward a bloc-wide social media ban for children under 13, following a von der Leyen-commissioned child-safety panel that recommends mandated age assurance.
EU parliament lets Meta and Google keep scanning users’ messages, in a win for ‘Chat Control’ backers. What it means – and why it matters — EUobserver
Why it matters: Chat Control's backers win: voluntary scanning of private messages survives in the Parliament.
The European Parliament voted to let Meta and Google continue scanning users' private messages, handing a win to 'Chat Control' backers and reopening the EU's encryption fight.
European defencetech leader Helsing secures $1.8B Series E at $18B valuation — Tech.eu
Why it matters: Europe's answer to strategic dependence is arriving as capital, not just regulation.
Helsing raised a $1.8 billion Series E at an $18 billion valuation, the largest European defence-startup round on record and a bet on sovereign military AI.
NestAI unveils European-made military AI backed by Finland and Estonia — Tech Archives | Euractiv
Why it matters: Sovereign AI for European militaries, explicitly framed as reducing reliance on foreign models.
NestAI unveiled European-made military AI backed by Finland and Estonia, pitched as a way for European armed forces to stop depending on US foundation models.
Why the EU’s new social media roadmap is tougher than it looks — Cybersecurity and Data Protection – POLITICO
Why it matters: The enforcement teeth in the EU's platform roadmap are being underestimated.
POLITICO argues the EU's new social media roadmap is tougher than its soft framing suggests, with age assurance and design rules carrying real enforcement weight.
THE HACK: An ‘AI EU official’ in the making? — Tech Archives | Euractiv
Why it matters: The Commission experimenting with AI inside its own machinery is a sovereignty question in miniature.
Euractiv reports on plans for an 'AI EU official', raising the question of which models the Commission would run its own institutional AI on.
Nscale’s £2bn UK data centre hit by grid delays — Sifted
Why it matters: Europe's compute ambitions keep colliding with the physical grid.
Nscale's £2bn UK data centre has been hit by grid connection delays, underlining that Europe's AI infrastructure bottleneck is electricity, not intent.
From Digital Sovereignty to Economic Competitiveness — KuppingerCole Analysts
Why it matters: Reframing sovereignty as competitiveness is how the argument finally reaches finance ministries.
KuppingerCole argues digital sovereignty only wins political support once it is recast as an economic-competitiveness agenda rather than a defensive one.
UK to lay out social media curbs for 16 and 17 year-olds — Policy – POLITICO
Why it matters: The UK moves in parallel with Brussels, extending curbs to older teens.
The UK is preparing social media curbs for 16- and 17-year-olds, tracking the EU's direction of travel on youth platform regulation.
US & Technology
States are building their own election defense networks as federal support evaporates — CyberScoop
Why it matters: Federal retreat from election security is being backfilled by the states themselves.
US states are building their own election defence networks as federal support evaporates, fragmenting a function that was centrally coordinated a cycle ago.
A Leak of San Francisco Police Drone Footage Exposes the New Reality of Urban Surveillance — WIRED
Why it matters: A leak that shows what routine police drone surveillance actually looks like from the inside.
Leaked San Francisco police drone footage exposes the scale and banality of routine aerial surveillance over a major US city.
LAPD Regularly Pulled Over Innocent People Because License Plate Readers Flagged Their Cars As Stolen — 404 Media
Why it matters: Automated plate recognition failing in exactly the way critics predicted, at scale.
LAPD repeatedly stopped innocent drivers because automated licence-plate readers wrongly flagged their cars as stolen, a case study in automation bias.
Meta Is Flooding the Market With Smartglasses. Privacy Advocates Are Up in Arms. — Technology - WSJ.com
Why it matters: Always-on cameras on faces, sold as fashion, with privacy law nowhere near ready.
Meta is flooding the market with smart glasses over the objections of privacy advocates, normalising always-on wearable cameras faster than regulation can respond.
Zuck's AI ambitions put Meta on course to become America's next big cloud provider — www.theregister.com - Articles
Why it matters: Meta's AI spending is quietly turning it into a hyperscaler.
Meta's AI ambitions are putting it on course to become America's next major cloud provider, reshaping the competitive map at the infrastructure layer.
States sue to block Paramount/WBD merger that was approved by Trump admin — Ars Technica - All content
Why it matters: State AGs move against a media merger the administration waved through.
A dozen states sued to block the Paramount-Warner Bros. Discovery merger approved by the Trump administration, opening a federal-state split over media consolidation.
China & Technology
Xi Jinping to attend World AI Conference for first time as China elevates tech push — Tech - South China Morning Post
Why it matters: Xi's first personal appearance at the AI conference signals a state-level elevation of the AI push.
Xi Jinping will attend the World AI Conference for the first time, a signal that Beijing is elevating AI to the top tier of national strategy.
Chinese AI Startup DFSX Releases Chip to Take on the West — Technology - WSJ.com
Why it matters: Another domestic accelerator aimed squarely at the gap left by export controls.
Chinese AI startup DFSX released a chip pitched as a challenge to Western accelerators, part of Beijing's push to route around US export restrictions.
520 TFLOPS at 14nm: China Self-Developed AI Chip Achieves Architecture Breakthrough With Software-Defined Computing — Pandaily - China Tech News, AI & Electric Vehicle Insights
Why it matters: Architecture over lithography: China compensating for process-node limits with design.
A Chinese AI chip claims 520 TFLOPS on a 14nm process via software-defined computing, an architectural workaround for the lithography China cannot buy.
China works on AI safety benchmark as regulators target large model risks — Tech - South China Morning Post
Why it matters: China building its own model-risk benchmarks is regulatory divergence in the making.
Chinese regulators are developing an AI safety benchmark targeting large-model risks, establishing an evaluation regime separate from Western frameworks.
A New Era Begins: Sugon Dawn 8000 Marks China Entry Into 100,000-Card AI Computing Infrastructure — Pandaily - China Tech News, AI & Electric Vehicle Insights
Why it matters: China crossing the 100,000-accelerator threshold matters more than any single chip.
The Sugon Dawn 8000 marks China's entry into 100,000-card AI computing infrastructure, closing the gap on cluster scale rather than per-chip performance.
Chinese internet firms sign AI agent data protection pact — TechNode
Why it matters: Industry self-regulation for AI agents arrives in China before it does in the West.
Chinese internet firms signed a data-protection pact covering AI agents, pre-empting regulation on how autonomous agents handle user data.
Threat Intelligence (CTI)
[P1] Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions — The Record from Recorded Future News
Why it matters: Europe's first-ever joint EU-UK cyber sanctions, and a state attribution for grid sabotage.
The EU and UK jointly attributed the December 2025 attack on Poland's power grid — which could have cut electricity to 500,000 people in midwinter — to Russia's FSB Centre 16, and imposed their first coordinated cyber sanctions package.
severity critical · exploited in the wild · EU: NIS2, CER Directive, EU Cyber Diplomacy Toolbox, EU Cyber Sanctions Regime · actor FSB Centre 16 (Turla / Berserk Bear / Static Tundra) (90%), escalation
[P1] Russian State Hackers Target Vulnerable Routers Worldwide, Joint Advisory Warns — Infosecurity Magazine
Why it matters: Nineteen governments jointly warning about the same FSB unit Europe just sanctioned.
The NSA and 18 international partners issued a joint advisory warning that poorly configured and unpatched routers remain the primary entry point for FSB Centre 16 operations against critical infrastructure, with confirmed compromises across defence, communications, energy, financial services, government and healthcare.
severity high · exploited in the wild · EU: NIS2, CER Directive, EU Cybersecurity Act · actor FSB Centre 16 (Berserk Bear / Energetic Bear / Dragonfly / Static Tundra / Ghost Blizzard) (90%), escalation
[P1] Russian spies hacked security cameras to monitor weapons shipments to Ukraine — intelNews.org
Why it matters: Russia turned Europe's privately-owned doorbell cameras into an ISR network over NATO logistics routes.
Dutch intelligence services AIVD and MIVD disclosed a large-scale Russian operation that compromised internet-exposed IP cameras — including consumer doorbell cameras — along military logistics routes across NATO states to track weapons shipments bound for Ukraine.
severity high · exploited in the wild · EU: NIS2, CER Directive, Radio Equipment Directive, EU Cyber Resilience Act · actor Russian state services (Dutch attribution; unit not publicly specified) (75%), escalation
[P2] Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths — The Hacker News
Why it matters: Microsoft's code-level map of how ShinyHunters industrialised OAuth abuse across SaaS.
Microsoft documented a year of ShinyHunters-linked Salesforce data theft running through three distinct intrusion paths — vishing that walks employees through the OAuth consent flow, supply-chain compromise of trusted integrations such as Salesloft and Gainsight, and exploitation of misconfigured guest access to Aura endpoints.
severity high · exploited in the wild · EU: GDPR, NIS2, DORA · actor ShinyHunters (overlapping tradecraft; Microsoft stops short of hard attribution) (70%)
[P2] GigaWiper Lets Threat Actors Choose Their Own Destructive Attack — darkreading
Why it matters: A modular wiper that merges three malware families and deliberately throws away the keys.
GigaWiper is a modular Go backdoor, first seen in October 2025, that bundles remote administration with a physical-disk wiper, a FlockWiper reimplementation, and a Crucio-derived ransomware routine that discards its encryption keys — making 'ransomware' here a disguise for destruction.
severity high · exploited in the wild · EU: NIS2, CER Directive, DORA
[P3] Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 — The Hacker News
Why it matters: One directory listing left on, and three Microsoft 365 phishing operations fell out of it.
A Python HTTP server on a Budapest VPS, left with directory listing enabled, exposed the complete toolkits, credential logs and Telegram session files of three separate Evilginx-based adversary-in-the-middle operators targeting Microsoft 365 — including 218 captured accounts across a dozen countries, roughly 94 percent of them corporate mailboxes.
severity medium · exploited in the wild · EU: GDPR, NIS2 · actor codemado, mail-argenta, saroula01 (independent criminal operators) (80%)
Defence & National Security
Sea drones strike Iranian port in combat first for US — Defense News
Why it matters: First US combat use of maritime attack drones — a threshold crossing in unmanned warfare.
The US struck an Iranian port with uncrewed surface vessels, the first combat use of maritime attack drones by the American military.
Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules — SecurityWeek
Why it matters: The defence industrial base's cybersecurity mandate is being rolled back mid-flight.
The Pentagon suspended CMMC Phase 2, halting the cybersecurity certification mandate for defence contractors pending a 60-day review of the rules.
US to take over Strait of Hormuz, charge 20 percent fee for cargo shipped through, Trump says — Policy – POLITICO
Why it matters: A declared blockade plus a cargo levy on the world's most important oil chokepoint.
Trump said the US will take control of the Strait of Hormuz and charge a 20 percent fee on cargo transiting it, alongside a reinstated naval blockade of Iran.
9 nations back Ukraine’s Patriot alternative, Freyja — and want it flying in a year — Defense News
Why it matters: Nine nations backing a European interceptor is the concrete form of defence sovereignty.
Nine countries are backing Freyja, Ukraine's Patriot alternative, and want it flying within a year — European air defence built outside the US supply chain.
America’s Military Plans Depend on Infrastructure It Doesn’t Secure — The Cipher Brief
Why it matters: The mobilisation problem nobody owns: the military rides on infrastructure it cannot secure.
American military plans depend on commercial rail, ports and power that the Pentagon neither owns nor secures, a gap adversaries are already probing.
Auterion, Ukrainian drone-maker Skyfall to supply 50,000 FPVs — Breaking Defense
Why it matters: Drone production at industrial scale is now the measure of European defence capacity.
Auterion and Ukrainian maker Skyfall will supply 50,000 FPV drones, a volume that reframes attritable airpower as a manufacturing problem.
Digital Sovereignty & Identity
Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling — The Hacker News
Why it matters: Continuous ambient listening plus affect inference is a new category of biometric surveillance.
Meta filed a patent for AI that listens continuously and infers the user's emotional state, extending wearable surveillance from what you see to how you feel.
ITU Opens Standards Work on Identity and Trust for Humans and AI Agents — ID Tech
Why it matters: Identity for AI agents is becoming a standards fight, and the ITU just claimed a seat.
The ITU opened standards work on identity and trust for humans and AI agents, staking out international governance of machine identity before the market settles it.
US passport photo plan points to new layer of remote biometric verification — Biometric Update
Why it matters: A passport photo rule that quietly builds a remote biometric verification layer.
A US passport photo plan points toward a new layer of remote biometric verification, extending face matching well beyond the border.
Spain’s Gataca Raises New Funding to Scale Wallet-Based Identity Verification — ID Tech
Why it matters: European wallet-based identity gets fresh capital as EUDI deadlines approach.
Spain's Gataca raised new funding to scale wallet-based identity verification, part of the commercial build-out around the EU digital identity wallet.
Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID — Microsoft Security Blog
Why it matters: The largest enterprise identity provider making passkeys the default is a real shift in the phishing economics.
Microsoft made passkeys the default authentication method in Entra ID, pushing the largest enterprise identity estate toward phishing-resistant credentials.
Facewatch retail facial recognition to notify police of repeat offender matches — Biometric Update
Why it matters: Private facial recognition wired directly into police notification blurs a line that used to matter.
Facewatch's retail facial recognition will now notify police of repeat-offender matches, connecting private biometric watchlists to state enforcement.
Quantum & Cryptography
PQMicroLib-Core 1.3.0 achieves CAVP certification — PQShield
Why it matters: Post-quantum crypto reaching certified, constrained-device implementations is the migration's real test.
PQShield's PQMicroLib-Core achieved CAVP certification, bringing validated post-quantum cryptography to embedded and constrained devices.
Verifying Rust cryptography in SymCrypt, from standards to code — Microsoft Research Blog - Microsoft Research
Why it matters: Formally verifying the crypto library underneath Windows is the unglamorous work that actually holds.
Microsoft Research detailed formal verification of Rust cryptography in SymCrypt, taking implementations from standards text to machine-checked code.
Cybersecurity & Threats
[P3] Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found — The Hacker News
Why it matters: A dormant browsing-history collector shipped inside a developer extension with 1.6 million installs.
Google and Microsoft pulled ModHeader, a header-editing extension with roughly 1.6 million installs, after researchers found a built-in collector designed to encrypt and upload up to 1,000 visited domains — dormant only because its allow-list was empty, and switchable on by a routine update requiring no new permissions.
severity medium · EU: GDPR, NIS2, Cyber Resilience Act
[P2] New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email — The Hacker News
Why it matters: One email, and an AI agent silently writes a false fact about you into its permanent memory.
MemGhost is a one-shot payload framework that gets a personal AI agent to write an attacker's false 'fact' into the core files it loads every session, conceals the write from the visible reply, and thereby steers the agent's answers in all later conversations — reported at 87.5 percent end-to-end success against one agent stack and 71.4 percent against another.
severity high · EU: AI Act, NIS2, GDPR
[P2] Lidl discloses online shop breach after service provider hack — BleepingComputer
Why it matters: A third-party file, briefly exposed, and Lidl customers in three EU states get the letter.
Lidl notified online-shop customers in Germany, Belgium and the Netherlands that attackers accessed a separately stored file at an external IT provider and stole names, phone numbers, email addresses, dates of birth and customer numbers — with passwords, addresses and payment details flagged as potentially affected. The number of victims and the provider have not been disclosed.
severity high · exploited in the wild · EU: GDPR, NIS2
[P2] CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks — The Hacker News
Why it matters: An infostealer that Apple itself notarised, wearing the icon of Apple's own crash reporter.
CrashStealer is a native C++ macOS infostealer distributed inside an Apple-notarised, validly signed disk image, letting it pass Gatekeeper cleanly. It impersonates Apple's crash-reporting utility down to the com.apple.crashreporter bundle identifier, then harvests browser credentials, keychain contents, password-manager data and wallets, encrypting the haul before exfiltration.
severity high · exploited in the wild · EU: GDPR, NIS2
[P2] U.S. CISA adds a Cisco IOS flaw to its Known Exploited Vulnerabilities catalog — Security Affairs
Why it matters: CISA added an eighteen-year-old router flaw to KEV — which tells you what Russia is actually walking through.
CISA added CVE-2008-4128, a cross-site request forgery chain in the Cisco IOS 12.4 HTTP administration interface on Cisco 871 routers, to the Known Exploited Vulnerabilities catalogue on evidence of active exploitation, with a same-day federal remediation deadline.
severity high (CVSS 6.8) · exploited in the wild · CVE-2008-4128 · EU: NIS2, CER Directive · actor Not attributed by CISA; consistent with FSB Centre 16 edge-device targeting (50%)
[P2] German firm files for insolvency, blames cybercrims who shut down production for 6 weeks — www.theregister.com - Articles
Why it matters: A cyberattack stopped production for six weeks, and the company did not survive it.
ZEGO Textilveredelungszentrum, a German textile finisher in Aschaffenburg employing 60 people, filed for insolvency after a 29 March 2026 cyberattack halted production for nearly six weeks; management said the resulting outage and financial strain made the filing unavoidable. ZEGO has not disclosed the attack type, the actor, or whether data was taken.
severity high · exploited in the wild · EU: NIS2, GDPR