← Back to Security Blog

FBI Surveillance System Breached, New Pentagon CISO Named, CISA Expands KEV — Security Regulation Roundup

The FBI is investigating a breach of a system holding sensitive surveillance information. The Pentagon appoints James "Aaron" Bishop as its new CISO. CISA adds 23 iOS vulnerabilities from the Coruna exploit kit to the KEV catalog. Meanwhile, AI security vulnerabilities in Chrome's Gemini integration highlight the urgency of the EU AI Act's newly enforced prohibited practices. Google's 2025 zero-day report reveals 90 exploited vulnerabilities — half targeting enterprise infrastructure.

---

🔴 FBI Investigating Breach of Surveillance System

Regulatory Implications

This incident carries significant implications for government cybersecurity regulation and oversight:

• Congressional oversight: The breach is likely to accelerate legislative action on federal cybersecurity mandates, with both intelligence committees expected to hold classified briefings
• FISMA compliance: Questions will arise about whether the compromised system met Federal Information Security Modernization Act requirements
• Surveillance reform: The breach of surveillance-related data may reignite debates around Section 702 of FISA and data protection safeguards for intelligence systems
• Supply chain concerns: Investigators are examining whether the breach originated through a third-party vendor, echoing NIS2 and DORA supply chain security requirements

For EU organizations, this incident underscores the importance of NIS2 Article 21 requirements for incident handling and crisis management — even the most security-focused agencies remain vulnerable.

---

🛡️ Pentagon Appoints New CISO: James "Aaron" Bishop

What This Means for Regulation

The Pentagon CISO oversees cybersecurity policy for the Department of Defense — the world's largest organization by headcount. Bishop's appointment comes at a critical time:

• CMMC 2.0 enforcement: The Cybersecurity Maturity Model Certification program is entering full enforcement, requiring all defense contractors to meet verified cybersecurity standards
• Zero trust architecture: DoD's zero trust implementation deadline is approaching, with all components expected to achieve target-level maturity
• International alignment: Increasing coordination between U.S. defense cybersecurity standards and EU frameworks (NIS2, DORA) for allied interoperability
• AI/ML security: DoD's expanding use of AI systems requires alignment with emerging AI security standards — paralleling the EU AI Act's high-risk AI requirements

---

⚠️ CISA Adds Coruna Exploit Kit iOS Flaws to KEV Catalog

Compliance Impact

Under Binding Operational Directive (BOD) 22-01, all U.S. federal civilian agencies must remediate KEV-listed vulnerabilities within prescribed timelines. But the regulatory impact extends far beyond the U.S.:

• NIS2 (EU): Article 21 mandates vulnerability handling and disclosure — organizations using iOS devices in essential/important entity operations must patch immediately
• DORA (Financial): Financial entities under DORA must include mobile device vulnerabilities in their ICT risk management frameworks and incident reporting
• GDPR: Exploitation of these vulnerabilities could lead to personal data exfiltration, triggering 72-hour breach notification obligations under Article 33
• EU AI Act: AI systems running on compromised iOS infrastructure may fail high-risk AI system security requirements under Article 15

Coruna Exploit Kit: Key Details

Attribute	Detail
Classification	Nation-state grade commercial exploit kit
Target	iOS 13 through iOS 17.2.1
Vulnerabilities	23 chained exploits for full device compromise
Capability	Zero-click remote code execution, persistent access
KEV Status	All 23 CVEs now in CISA KEV catalog

---

🤖 AI Security Under Fire: Chrome Gemini Vulnerability & Fake Extensions

Two developments this week highlight the growing intersection of AI security and regulatory compliance:

Chrome Gemini Vulnerability (CVE-2026-0628)

Google patched CVE-2026-0628 (CVSS 8.8 — High), an elevation-of-privilege vulnerability in the Gemini AI integration within Chrome. Reported by Palo Alto Networks Unit 42, the flaw allowed malicious browser extensions with basic permissions to hijack the Gemini Live panel, potentially accessing:

• User conversations with the AI assistant
• Browsing context and page content shared with Gemini
• Any data processed through the AI panel

Fake AI Extensions Epidemic

Security researchers continue to flag malicious browser extensions masquerading as AI tools in official app stores. These extensions provide superficial AI functionality while silently exfiltrating user data, keystroke logs, and authentication tokens.

EU AI Act Relevance

---

📊 Google Zero-Day Report: 90 Exploited Vulnerabilities in 2025

Google's annual zero-day exploitation analysis reveals 90 zero-day vulnerabilities were exploited in the wild during 2025 — with a significant shift toward enterprise-targeting:

• 50% targeted enterprise products — security appliances, VPN gateways, network infrastructure
• Spyware vendors remain the most prolific zero-day users, with commercial surveillance tools accounting for the largest attributed share
• China-linked groups led nation-state attribution, focusing on network edge devices and critical infrastructure
• Less than half of all zero-days could be attributed to specific threat actors

Regulatory Takeaway

The enterprise focus of zero-day exploitation directly validates the regulatory approach of NIS2 and DORA:

• NIS2 essential entities operating network infrastructure are prime targets — Article 21 risk management measures are not optional recommendations but survival requirements
• DORA's operational resilience testing (including threat-led penetration testing) reflects the reality that financial sector infrastructure faces sustained, sophisticated attacks
• EU Cyber Resilience Act (CRA) requirements for manufacturers to provide security updates and vulnerability handling become critical as attackers increasingly target product-level flaws

---

🔄 Microsoft Copilot Data Protection Updates

Microsoft announced new controls over which files its Microsoft 365 Copilot AI assistant can access during data processing. The change comes in direct response to customer reports that Copilot was including confidential information in its outputs.

Key Changes

• DLP enforcement expansion: Data Loss Prevention labels will now apply to local files, not just OneDrive/SharePoint — preventing Copilot from accessing DLP-restricted content regardless of storage location
• Default protection: The new controls will be applied by default starting April 2026
• User responsibility: Organizations must properly configure DLP labels on sensitive files to prevent AI access

GDPR & AI Act Compliance

This development is directly relevant to EU compliance:

• GDPR Article 5(1)(f): Integrity and confidentiality — AI tools accessing data beyond their intended scope may violate the principle of appropriate security
• GDPR Article 25: Data protection by design — Microsoft's change reflects the regulatory expectation of built-in privacy safeguards
• EU AI Act Article 10: Data governance requirements for AI systems must ensure training and processing data meets quality and relevance standards

---

⚡ Cisco SD-WAN Vulnerabilities Exploited in the Wild

Cisco confirmed that two recently patched Catalyst SD-WAN vulnerabilities — CVE-2026-20128 and CVE-2026-20122 — are being actively exploited. SD-WAN infrastructure is classified as critical infrastructure in multiple regulatory frameworks.

---

📋 Compliance Action Items — Week of March 7, 2026

1. Patch iOS devices immediately — All 23 Coruna exploit kit CVEs now in CISA KEV; NIS2/DORA-regulated entities must prioritize
2. Update Cisco SD-WAN — CVE-2026-20128 and CVE-2026-20122 actively exploited; critical infrastructure risk
3. Audit AI tool permissions — Review browser extensions claiming AI functionality; remove unverified extensions
4. Configure Microsoft 365 DLP — Ensure DLP labels are applied to sensitive files before Copilot default protections activate in April
5. Review Chrome security updates — Patch CVE-2026-0628 (Gemini vulnerability); assess AI-integrated browser components
6. EU AI Act readiness — Prohibited practices now enforceable; inventory AI systems for compliance by August 2026 high-risk deadline
7. NIS2 incident response drill — The FBI breach underscores that even top-tier security organizations face compromise; test your 24-hour early warning procedures