White House signs executive order preempting state-level AI regulations.

Summary

By the CyberWire staff

White House signs executive order preempting state-level AI regulations.

President Trump yesterday signed an executive order, "Ensuring a National Policy Framework for Artificial Intelligence," aimed at preempting state-level AI regulations. The White House cites three reasons for the order: "First, State-by-State regulation by definition creates a patchwork of 50 different regulatory regimes that makes compliance more challenging, particularly for start-ups. Second, State laws are increasingly responsible for requiring entities to embed ideological bias within models. For example, a new Colorado law banning 'algorithmic discrimination' may even force AI models to produce false results in order to avoid a 'differential treatment or impact' on protected groups. Third, State laws sometimes impermissibly regulate beyond State borders, impinging on interstate commerce."

CNBC notes that tech companies like Google and OpenAI will welcome the law, while states are likely to challenge the order in court. Some states—notably, California, Utah, Colorado, and Texas—have already passed their own laws regulating AI. States that refuse to comply with the executive order may face Federal funding restrictions.

Control what runs in your environment. Reduce your attack surface.

ThreatLocker helps organizations reduce risk by allowing trusted applications to run while limiting their access to only the resources they need. It’s a straightforward, default deny approach that gives you more control and visibility—without slowing down operations. Explore how ThreatLocker can help simplify your security strategy.

Researchers warn of attacks against Gladinet CentreStack and Triofox.

Huntress warns that attackers are exploiting a flaw in Gladinet’s CentreStack and Triofox platforms to achieve remote code execution. The flaw stems from the use of hardcoded cryptographic keys. Huntress states, "As of December 10, we have seen nine organizations that have been impacted by this vulnerability. These businesses ranged across different sectors, from healthcare to technology."

No CVE has been assigned, but Gladinet has issued fixes for the flaw. Users are urged to apply updates promptly.

Humans Are Not the Weakest Link. Guess who FAIls?

Humans have been labeled the weakest link for ages. But this year showed how easily both humans and AI can be manipulated. In this session, Cato CTRL experts reveal real attacks from the wild where adversaries steered people and AI systems into harmful actions using simple prompts and inputs. The session reframes how you should think about AI risk and what to do when machines start making the mistakes, so register to join us.

UK fines LastPass for 2022 data breach.

The UK Information Commissioner's Office (ICO) has fined LastPass £1.2 million (US$1.6 million) over alleged security failings that allowed an attacker to steal information belonging to 1.6 million British users in 2022, BleepingComputer reports. The ICO said in a press release, "We found that LastPass failed to implement sufficiently robust technical and security measures, which ultimately enabled a hacker to gain unauthorised access to its backup database. There is no evidence that hackers were able to unencrypt customer passwords, as these are stored locally on customer devices and not by LastPass."

Notes.

Today's issue includes events affecting , and the United Kingdom the United States.

Attacks, Threats, and Vulnerabilities

MITRE Releases 2025 List of Top 25 Most Dangerous Software Vulnerabilities (SecurityWeek) XSS remains the top software weakness, followed by SQL injection and CSRF. Buffer overflow issues and improper access control make it to top 25.

Legislation, Policy, and Regulation

Announced pick for No. 2 at NSA won’t get the job as another candidate surfaces (The Record) Joe Francescon, announced in August as the NSA's new deputy director, will not be filling the role, sources told Recorded Future News, and the Trump administration has another pick in mind.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Wild West Hackin’ Fest @ Mile High 2026 (Denver, Colorado, USA, Feb 11 - 13, 2026) More than just a conference, Wild West Hackin’ Fest (WWHF) is committed to offering high quality information security education to beginners and seasoned professionals alike. With reasonably priced training, conferences, hands-on labs, and workshops, WWHF lowers the barrier to entry for those seeking to enter into the world of information security. WWHF also offers a venue for those already established in the industry to share ideas, give back, and continue learning.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 12.12.25

Top stories.

White House signs executive order preempting state-level AI regulations.

Researchers warn of attacks against Gladinet CentreStack and Triofox.

UK fines LastPass for 2022 data breach.

Notes.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Newly Noted Events