Eric Geller

The Trump administration says it's working with states to pilot-test critical infrastructure security projects. But at least 26 states and D.C. aren't involved, and many didn't know about it until I asked. My new story, based on a nationwide survey: cybersecuritydive.com/news/white-hou…

"The department did not answer questions about why Rubio would decide to activate disappearing messages if his phone contained software that ensured those messages could not be fully deleted." theatlantic.com/national-secur…

The White House says the new AI-powered vulnerability management clearinghouse established in Trump's EO has started operations. They're calling it "Gold Eagle." Press release says almost nothing about who's involved or what they're doing. whitehouse.gov/releases/2026/…

Lawmakers like @RonWyden and @RepTedLieu have been warning about SS7 flaws for years (lieu.house.gov/media-center/p… lieu.house.gov/media-center/i… wyden.senate.gov/news/press-rel…), but this might be the highest-profile demonstration of those flaws yet.

Remarkable story here: Iran seems to have used a well-known vulnerability in cell networks to track U.S. military forces during the war. ft.com/content/44351c…

The Trump administration has suspended the second phase of a cybersecurity regulation program for defense contractors, saying it was costing those firms too much money to comply: war.gov/News/Releases/… It's the latest hurdle in a long-running saga for these rules.

Hugely embarrassing failure here, and great story by @ddimolfetta. nextgov.com/cybersecurity/…

The U.S. and a bunch of partners are reiterating warnings to critical infrastructure organizations about Russian government hackers exploiting vulnerabilities in edge devices like routers: media.defense.gov/2026/Jul/09/20…

Verified Voting has a great website where you can see the voting equipment used in every jurisdiction in the U.S., as well as explanations of the different types of technology. #mode/navigate/map/voteEquip/mapType/ppEquip/year/2026" target="_blank" rel="nofollow noopener">verifiedvoting.org/verifier/#mode…

Barcodes have been controversial with some election security activists for a long time, since the voter can't actually know what's encoded in them. But most security experts say they're fine as long as states maintain actual paper ballots in case of machine error, recount, etc.

DHS forcing states to implement "election integrity" measures to get federal election security $: dhs.gov/news/2026/07/1… Req't to (promise to) drop barcode/QR-equipped ballots is big. Many states just bought a ton of those devices to replace all-electronic machines after 2016.

CISA has published a report about a contractor's recent leak of CISA security keys on GitHub. It's fairly candid about the agency's shortcomings and offers advice for other organizations. cisa.gov/news-events/ne…

CISA has published the charter for ANCHOR-CI. There's a few new details, including about how sector council establishment will work and how CISA will operate the program. cisa.gov/sites/default/…

Anthropic today unfroze access to its Mythos and Fable AI models after the government lifted its export-control ban. The company says the original jailbreak wasn't unique to its models but it's improved its safety classifier anyway. anthropic.com/news/redeployi…

New: More than a year after eliminating a key public-private critical infrastructure coordination framework, DHS is finally creating a replacement. The new system allows more types of councils but also emphasizes state and local responsibility. public-inspection.federalregister.gov/2026-13268.pdf

OMB has issued the post-quantum cryptography migration memo to agencies that Trump called for in his recent EO: whitehouse.gov/wp-content/upl…

OpenAI has voluntarily agreed to a government request to limit access to its new AI models. The company's CEO says the government is vetting each customer it proposes adding to a limited preview program. cybersecuritydive.com/news/openai-mo…

Remarkable to see even Republican election officials endorse a blunt warning from their national associations about the Trump administration's lack of election security support for the midterms. usatoday.com/story/news/pol…

"In a private Telegram channel, the group is offering $500 to people to visit law firms and plug in USB sticks, one cybersecurity professional familiar with the incidents told CNN." cnn.com/2026/06/27/pol…

The FCC today approved rules requiring Emergency Alerting System operators to adopt strong passwords, use network firewalls, and promptly apply security updates. FCC is also proposing to require operators to authenticate alerts before transmitting them. docs.fcc.gov/public/attachm…

ICYMI: My new story from yesterday about how most states aren't involved in a cybersecurity partnership that the White House has touted.