Schneier-on-Security

Published Thursday, September 24, 2026 at 05:36 AM PT BLUF: Schneier on Security reports observation of sophisticated malware variant with technical characteristics consistent with nation-state capability; no attribution confirmed. Active CAPTCHA-based social engineering variant in circulation. Tracking — details insufficient for immediate action guidance. DETAILS Malware sophistication assessed as matching nation-state capability level (Schneier direct observation); no direct evidence of attribution available CAPTCHA-themed social engineering variant confirmed in circulation — frames malware payload as CAPTCHA challenge to trick users into execution No confirmed CVE, target sector, affected systems, or geographic focus provided in available material Detection/mitigation techniques not yet documented Schneier assessment: insufficient evidence to attribute or identify specific threat actor IMPACT ...

Published Tuesday, September 15, 2026 at 05:28 AM PT BLUF: Material provided is a historical policy analysis essay by Schneier and Cohn (Lawfare) examining the post-9/11 shift from targeted wiretaps to mass surveillance infrastructure. NOT a confirmed active security breach, vulnerability, or incident. No specific targets, dates, or operational threat vector identified. DETAILS: Source: Schneier on Security essay co-authored with Cindy Cohn; published in Lawfare Subject: Government-wide surveillance architecture shift (post-9/11) Scope of analysis: Transition from targeted methods (individual wiretaps, pen register/trap-and-trace orders) to mass surveillance (internet backbone interception, bulk telephone/internet metadata collection) Classification: Policy/architecture critique, not incident report Related context in memory: Multiple unrelated Schneier articles (Harvest/NSA code-breaking, FIFA network vulnerability, squid proxy bug, AI video surveillance, post-quantum crypto adoption, vehicle telemetry surveillance, cybersecurity mission creep, passport database leak) INSUFFICIENT TO CONFIRM: ...

Published Friday, July 10, 2026 at 01:22 PM PT BLUF: France’s cybersecurity agency ANSSI will cease certifying security products lacking quantum-resistant encryption starting 2027, forcing government bodies and critical infrastructure operators to migrate legacy systems. Organizations relying on French certifications must begin post-quantum crypto assessments immediately. DETAILS ANSSI announced the certification halt at the France Quantum conference; implementation begins 2027 Policy targets government bodies and critical operators as primary enforcement mechanism Quantum-resistant encryption standards exist (NIST finalized post-quantum algorithms in 2022); transition is technically feasible but operationally complex Timeline provides ~2.5 years for compliance; businesses should begin migration planning now per ANSSI guidance This represents the first major government agency to enforce post-quantum cryptography via certification requirements IMPACT ...