Policy & Security desk · Policy & Regulation, Cybersecurity

Nadia Rao

Covers regulation and security from the filings, final rules, and CVE write-ups.

Nadia covers what regulators, agencies, and attackers actually do — not what the press releases say they do. Expect careful distinctions between proposed rules, enacted rules, and enforced rules.

Articles by Nadia Rao

States Asked an Appeals Court to Reverse the FTC-Meta Antitrust Loss
Policy & Regulation

States Asked an Appeals Court to Reverse the FTC-Meta Antitrust Loss

A coalition of states and DC has asked a US appeals court to reverse the lower-court ruling that effectively ended the FTC's monopoly case against Meta.
CISA Set Today as the Deadline to Patch an Exchange Bug Under Active Attack
Cybersecurity

CISA Set Today as the Deadline to Patch an Exchange Bug Under Active Attack

CVE-2026-42897, a spoofing flaw in on-prem Exchange Server, is under active exploitation. CISA's federal patch deadline is May 29.
CLARITY Act, Explained: The Crypto Market Structure Bill Everyone Keeps Voting On
Policy & Regulation

CLARITY Act, Explained: The Crypto Market Structure Bill Everyone Keeps Voting On

The Digital Asset Market Clarity Act would split crypto oversight between the SEC and CFTC and define when a token is a security. Here is what it actually does.
Trump's AI Cybersecurity Directive Expands Info-Sharing. Frontier Approval Stays Off the Table.
Policy & Regulation

Trump's AI Cybersecurity Directive Expands Info-Sharing. Frontier Approval Stays Off the Table.

Trump is expected to sign an AI cybersecurity directive expanding info-sharing to AI companies. Mandatory federal approval for frontier models is explicitly excluded.
The AI Labs Are Building Cyber Capabilities Faster Than Defenders Are Building Detection
Cybersecurity

The AI Labs Are Building Cyber Capabilities Faster Than Defenders Are Building Detection

OpenAI and Anthropic disclosed vulnerability-finding capabilities (Mythos, GPT-5.5) that compress the disclosure-to-exploitation window. Defensive infrastructure has not kept pace.
NGINX Rift: An 18-Year-Old Heap Buffer Overflow in the World's Most Deployed Web Server
Cybersecurity

NGINX Rift: An 18-Year-Old Heap Buffer Overflow in the World's Most Deployed Web Server

CVE-2026-42945, a CVSS 9.2 vulnerability in NGINX rewrite module, has been in the code since 0.6.27. Patches rolling out. Affects nearly every web server on the public internet.
CLARITY Act Cleared the Senate Banking Committee 15-9. The Real Test Is 60 Senate Votes.
Policy & Regulation

CLARITY Act Cleared the Senate Banking Committee 15-9. The Real Test Is 60 Senate Votes.

Senate Banking voted 15-9 to advance the Digital Asset Market CLARITY Act, with two Democrats joining all Republicans. The full Senate vote needs 60 by the July 4 deadline.
Cisco SD-WAN Hit With CVSS 10.0 Auth Bypass. Exploitation Began Within Four Hours of Disclosure.
Cybersecurity

Cisco SD-WAN Hit With CVSS 10.0 Auth Bypass. Exploitation Began Within Four Hours of Disclosure.

Cisco patched a CVSS 10.0 authentication bypass in SD-WAN Controller and Manager. The first attack attempts appeared less than four hours after public disclosure.
The CLARITY Act Hits Committee Tomorrow With 100+ Amendments and One Uncommitted Republican
Policy & Regulation

The CLARITY Act Hits Committee Tomorrow With 100+ Amendments and One Uncommitted Republican

The 309-page Digital Asset Market CLARITY Act gets its committee markup vote May 14. Senator Kennedy is uncommitted. The arithmetic is tight.
SEC Chair Atkins Lays Out How Federal Securities Laws Apply to Crypto
Policy & Regulation

SEC Chair Atkins Lays Out How Federal Securities Laws Apply to Crypto

SEC Chair Paul Atkins issued an interpretation distinguishing securities from commodities in crypto. What is actually binding vs. what is guidance.
Two Active Exploitation Stories This Week, Both With CISA Deadlines
Cybersecurity

Two Active Exploitation Stories This Week, Both With CISA Deadlines

Ivanti EPMM and Palo Alto PAN-OS both have active-exploit advisories with imminent due dates. What is confirmed vs. what is speculation.
Anthropic Is Gating the Cyber-Capable Model It Disclosed Last Week
Cybersecurity

Anthropic Is Gating the Cyber-Capable Model It Disclosed Last Week

Anthropic launched Project Glasswing, restricting access to Mythos Preview. The "thousands of zero-days" figure is Anthropic's own and covers identification, with working exploits a separate bar.