United States

The SEC has rescinded amendments that previously made it easier for companies to exclude shareholder proposals, a significant shift in corporate governance rules. The rescission may face litigation that could pause or overturn it, creating uncertainty, and experts warn of a potential 'race to the bottom' as states adopt divergent rules. This change will notably affect ESG-related shareholder proposals and investor engagement.

CISA added two actively exploited Check Point vulnerabilities to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within three days under BOD 26-04. CVE-2026-93616 is a CVSS 9.8 unauthenticated directory traversal/file upload flaw in Check Point Security Management Server products, while CVE-2026-85102 is an authentication bypass in Security Gateway and Spark Firewall. Organizations running affected Check Point products must apply the R82.20 Security Hotfix or Jumbo Hotfix Accumulators immediately, as LivePatch does not resolve the issue.

CISA added CVE-2026-93952, a maximum-severity, actively exploited zero-day in Arista VeloCloud Orchestrator (VCO) On-Prem, to its Known Exploited Vulnerabilities catalog. U.S. federal agencies are mandated to remediate by September 25, 2026, and organizations using VCO should treat this as an urgent patch-or-mitigate requirement.

A new Future of Privacy Forum report documents a surge in US chatbot legislation, with 37 states introducing 124 chatbot-related bills in 2026 and 18 state chatbot-specific laws now enacted. The laws focus on user-experience requirements such as disclosures, crisis protocols, parental controls, and design restrictions, with California SB 1119 and New York S 9051 among recent companion chatbot bills. Companies deploying chatbots or AI agents should assess compliance with this emerging patchwork of state requirements.

CISA added the actively exploited Arista VeloCloud Orchestrator zero-day (CVE-2026-93952, CVSS 10) to its Known Exploited Vulnerabilities catalog, and federal agencies must patch within three days under Binding Operational Directive BOD 26-04. Organizations running VCO On-Prem should immediately upgrade to versions 5.2.3.16 or 6.4.2.8 and review logs for suspicious activity.

CISA has added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches (CVSS 8.8), to its Known Exploited Vulnerabilities catalog due to active exploitation enabling arbitrary code execution with SYSTEM-level access. Federal agencies must remediate within mandated timeframes, and private organizations are strongly urged to patch immediately to prevent full network compromise.

CISA added CVE-2026-94127, a critical (CVSS 9.8) zero-day RCE vulnerability in F5 BIG-IP APM, to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive BOD 26-04, federal agencies must patch within three days, signaling heightened enforcement scrutiny for all organizations running affected BIG-IP APM OAuth Authorization Server configurations.

F5 released emergency patches for a critical zero-day (CVE-2026-94127) in BIG-IP APM that is actively exploited for remote code execution. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, ordering U.S. federal agencies to secure affected systems by Friday. Organizations using BIG-IP APM as an OAuth Authorization Server must patch immediately or apply the provided iRule mitigation.

California enacted new employment legislation in 2026, taking effect in 2027, covering wage and hour, expanded leave and accommodation obligations, and emerging rules governing artificial intelligence and workplace surveillance. Government enforcement activity is increasing, requiring employers to prepare for heightened scrutiny.

California Governor Gavin Newsom issued an executive order directing state agencies to explore mandatory 'kill switch' capabilities and other AI safety measures for AI developers. While not yet binding, the order initiates a study and recommendations process that could lead to future legislation or regulations, signaling increased state-level AI oversight in California.

The CFTC issued a notice of proposed rulemaking to codify informal registration exemptions for commodity pool operators (CPOs) and commodity trading advisors (CTAs), previously available only via a December no-action letter. If finalized, the rule would replace temporary relief with a permanent exemption framework, reducing regulatory uncertainty for private funds and advisors in derivatives markets. Public comments are open until October 5, 2025.

The U.S. SEC issued a temporary five-year innovation exemption on September 17, 2026, permitting qualifying venues to facilitate secondary trading of tokenized U.S. stocks via automated market makers and blockchain liquidity pools. This opens a new regulatory pathway for tokenized securities trading, benefiting crypto exchanges and infrastructure providers such as Coinbase, Robinhood, and Circle.

The SEC introduced an Innovation Exemption establishing a five-year framework allowing qualifying venues to operate automated market maker (AMM) pools for tokenized NMS stocks without registering as exchanges, and permitting certain liquidity providers to avoid dealer registration. The framework imposes strict conditions including preservation of economic, dividend, voting, and liquidation rights, a 30-day issuer objection window, and trading volume caps. While near-term adoption is expected to be limited, the exemption signals a significant regulatory shift in U.S. securities market structure for tokenized assets.

The U.S. Senate's 49-50 cloture vote killed the Clarity Act, leaving federal crypto market structure legislation stalled and policy to be shaped by the SEC and CFTC. The SEC issued a temporary conditional exemption for tokenized U.S. stocks trading via permissioned liquidity pools, while the CFTC submitted new crypto rules to the White House for review. This creates continued U.S. regulatory uncertainty, benefiting offshore hubs like the UAE.

US states are advancing a fragmented set of prepaid and gift card fraud rules. Maryland enforces strict anti-fraud packaging mandates, New York has proposed concealing all card numbers (potentially a de facto national standard with only 180 days to comply if passed), and California has raised the gift card cash-back limit to $15, increasing fraud and operational risk for retailers. Colorado's 2026 ban on credit card deposits for online gambling also affects prepaid funding of betting accounts.

The SEC is advancing a crypto custody rule that would clarify how broker-dealers can custody non-security crypto assets without special registration and where investment advisers may hold client crypto assets, including state-chartered trusts. The proposal is under White House OMB review and will soon be formally proposed for public comment, alongside broader crypto offering and tokenization exemption rules.

U.S. federal prosecutors in Manhattan and the DOJ criminal division are investigating whether Binance knowingly permitted trading that violated U.S. sanctions on Iran. This follows Binance's 2023 guilty plea and $4.3 billion fine, signaling escalating U.S. enforcement of sanctions compliance in the cryptocurrency sector.

CISA has added three actively exploited Linux kernel vulnerabilities (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266) to its Known Exploited Vulnerabilities catalog, directing federal agencies to patch within three days. The flaws include a critical TLS receive path issue (CVSS 9.8), an AF_ALG socket race condition (CVSS 7.8), and an out-of-bounds write in bridge Netfilter ebtables SNAT (CVSS 8.8), posing risks of denial-of-service, memory corruption, and cryptographic failures.

The FBI published CJIS Security Policy v6.1 on June 25, 2026, raising encryption requirements for Criminal Justice Information (CJI) in transit and at rest from 128-bit to at least 256-bit symmetric keys, and increasing vulnerability scanning frequency from quarterly to at least monthly. Priority 1 controls are already sanctionable, while Priority 2-4 controls remain in zero-cycle status until September 30, 2027, though state CSAs may set their own timelines.

The DOL Wage and Hour Division issued three new FLSA opinion letters: FLSA2026-11 clarifies when walking time to and from a break area may be part of a bona fide noncompensable meal period; FLSA2026-12 addresses whether FLSA-exempt nonprofit employees may volunteer for their employing organization; and FLSA2026-13 addresses whether a restaurant supervisor who also bartends may retain tips and participate in tip pools. These letters provide authoritative compliance guidance that employers should review against their wage-and-hour practices.