CYBERSECURITY

SolarWinds Web Help Desk Vulnerability Targeted by Threat Actors

Security researchers at Huntress Labs have identified a vulnerability in SolarWinds’s Web Help Desk that threat actors are exploiting to allow them to execute code remotely.

The vulnerability was listed on the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities last week, and SolarWinds issued a warning, classifying it as a “critical severity” for users to patch the vulnerability. According to SolarWinds, the vulnerability “could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.” Read more

ENFORCEMENT + LITIGATION

Tracking After Rejection? ATP Tour Complaint Highlights Risks of Misaligned Cookie Controls

California resident Nathaniel Bee filed a lawsuit this week alleging that the ATP Tour’s website used third-party tracking technology that captured details on how visitors interacted with the site, including what content they viewed; how they navigated the website; and what type of device they used, without user consent in violation of the California Invasion of Privacy Act. According to the complaint, that information was transmitted to third parties, including Google and Comscore Inc., and was used for targeted advertising and analytics. Read more

GSA Introduces a New Framework for Protecting CUI in Contractor Systems

In January, the General Services Administration’s (GSA) Office of the Chief Information Security Officer issued a new procedural guide, CIO-IT Security-21-112 Rev. 1, that sets expectations for protecting Controlled Unclassified Information (CUI) when it resides in nonfederal contractor systems. Although the document is internal guidance, it creates an approval framework that may soon determine whether a contractor is eligible for GSA contracts involving CUI. Read more

DATA PRIVACY

CIPA Demand Letters Are Here to Stay; Reducing Risk from Chat, Session Replay, and Analytics

Until California’s legislature provides clearer guardrails, companies should expect continued class action activity under the California Invasion of Privacy Act (CIPA), targeting common website tracking technologies. Plaintiffs’ firms are actively testing how far this decades-old statute extends in the modern web environment, and courts have not reached a consensus. That uncertainty creates real litigation risk for organizations that rely on tools like chat widgets, session replay, and analytics. Read more

ARTIFICAL INTELLIGENCE

Patentability Implications of the EU AI Act

Novelty is a core requirement for any invention to be patentable. Put simply, your invention generally cannot have been publicly disclosed before the patent application’s effective filing date. In the United States, 35 U.S.C. § 102 includes a one-year grace period for certain public disclosures made before you file—many other jurisdictions do not have this grace period. Europe, for example, generally applies an absolute novelty standard, where your invention can bar patentability if you publicly disclose first and file later. Read more

Privacy Tip #479

Federal Judge Says ICE Prohibited from Using IRS Data for Enforcement

On February 5, 2026, a Massachusetts federal judge issued an order staying information-sharing between the IRS and ICE, as well as a preliminary injunction prohibiting Kristi Noem, Secretary of the Department of Homeland Security, ICE, acting-Director Todd Lyons, and any DHS and ICE agent from “inspecting, viewing, using, copying, distributing, relying on, or otherwise acting upon any return information that had been obtained from or disclosed by the IRS” through a Memorandum of Understanding (MOU) that was signed between the two agencies on April 7, 2025.

Learn more about how taxpayer and other data has been shared between federal agencies in this administration in this week's privacy tip. Read more