Shane Jacobson, CEO of the American Cancer Society, had similar thoughts. “Codifying shifting policy preferences into formal federal regulations risks triggering repeated cycles of overhaul with each change in administration,” he said in a statement. “Such back-and-forth would create a chronically unpredictable environment, making it extremely difficult for institutions and investigators to plan and sustain the multi-year, long-term research essential to clinical trials and breakthrough discoveries that patients urgently need.”

Nancy Brown of the American Heart Association echoed these worries, saying, “Policies that undermine independence or shift decisions away from established scientific and public health expertise risk weakening the innovation and collaboration needed to meet current and future health challenges.”

And it’s not just the people in the biomedical sciences who are worried. The American Geophysical Union called the change “a rule that would rewrite the terms of US science” and accused the government of “using the language of scientific rigor as a screen for political gatekeeping.” Its statement echoed a number of the concerns in Ars’ coverage.

“Political officials would have the authority to reject proposals that passed rigorous expert evaluation if they determine the work does not advance ‘the President’s policy priorities’ or is inconsistent with ‘the national interest,’ which could change or reverse course at any moment,” its statement said. “We have spent generations building peer review precisely because decisions about which science to fund should rest on scientific merit, not political alignment. This proposal would undo that.”

The American Physical Society was equally blunt. “These proposals would let political preference override expert peer review, restrict travel, limit collaboration, impede the sharing of results, and affect programs that train the next generation of scientists,” it said. “The proposed federal rule would establish regulations that would have politics shadow every research dollar, making it far harder to undo, no matter who holds office next.” In a follow-up, it said, “The proposal crosses the line, threatening all science, under any administration, now and into the future.”

The post Editorial: It’s time to step up and have your say for science appeared first on MASSIVE News.

The browser is the operating environment for modern work — it’s where employees access email, SaaS applications, collaboration tools, HR systems, finance platforms, customer data, developer resources and AI services. All of this activity makes the browser a high-value target for attackers because it sits between users, identities, applications, and sensitive enterprise data.

Recent trends around adversary speed and vulnerability exploitation underscore the risk. The Verizon 2026 Data Breach Investigations Report found vulnerability exploitation surpassed stolen credentials as the top breach entry point in 2025. The CrowdStrike 2026 Global Threat Report found 42% of vulnerabilities were exploited before public disclosure, a key indicator of adversaries’ interest in zero-days. 

The time between vulnerability discovery and patching creates a dangerous gap, which is growing with the rise of frontier AI models. After a fix is released, organizations must validate the update, test compatibility, stage deployment, and confirm installation across managed and unmanaged devices. During this window, attackers may already be exploiting the weakness or chaining it with other techniques to move from initial access to data theft or privilege escalation.

Zero-day vulnerabilities affecting browsers and web technologies draw attention for good reason. They are exploited before patches are available, before organizations can understand them and apply mitigations. While not every zero-day will affect every business environment, organizations must take steps to reduce their risk. 

A Problem for Every Enterprise

The browser ecosystem can multiply exposure because many browsers are built on the same underlying foundation. Chromium is an open-source browser project used as a shared core across much of the browser market. If vulnerable code lives in a shared core rather than in a feature unique to a single browser, the vulnerability can affect multiple browsers at once. When that happens, any browser that incorporates the affected component may inherit the exposure, depending on how that vendor implemented, modified, configured, or patched the code.

Not every vulnerability affects every browser in the same way. Vendors may customize components, add hardening, disable certain features, or patch on different timelines. Given this context, businesses should think about browser risk based on shared components and browser architecture, in addition to the specific browser they use.

This approach matters because enterprise environments are highly interconnected. A single browser-based exposure can intersect with identity, SaaS access, unmanaged devices, cloud applications, privileged accounts, and sensitive data. Attackers do not need every user or every system to be vulnerable; they only need one workable path into an organization.

The Challenge of Defending Against Zero-Day Exploits

Perhaps most alarming is that even with better reporting, the full scope of zero-day exploitation remains difficult to measure. Publicly known zero-days are only the cases that have been detected, investigated, and disclosed. By definition, some zero-day exploitation may remain unknown to vendors, security teams, and victims for extended periods.

That uncertainty makes zero-days difficult to prepare for using patching alone. Security teams can patch known vulnerabilities and monitor known indicators. But they cannot rely on known information to stop threats that are still undisclosed, still under investigation, or already being used quietly by sophisticated attackers.

This is especially relevant for browser security because web activity is constant, distributed, and user-driven. Employees move between trusted applications, personal browsing, third-party sites, embedded content, downloaded files, and cloud services throughout the day. That creates a large and dynamic attack surface that traditional network and endpoint controls may not fully see in real time.

Why Browser Risk Extends Beyond Zero-Days 

Browser risk does not begin and end with zero-days. While zero-day exploitation remains a serious concern, attackers routinely rely on phishing, credential theft, malicious downloads, session hijacking, and unpatched vulnerabilities to gain access and move through enterprise environments.

Successful compromise often involves an exploit chain. In a browser context, that may include exploitation of rendering logic, JavaScript execution, document handling, or memory safety weaknesses, followed by a sandbox escape, privilege escalation, or another technique that helps the attacker move from browser activity to system access. Defenders are rarely dealing with a single issue. They are dealing with a chain of opportunities that attackers can combine, adapt, and reuse.

Unpatched N-day vulnerabilities may pose even broader enterprise risk because technical details, exploit paths, and proof-of-concept code can become publicly available after disclosure. Once that happens, the issue shifts from a vendor-only race to a broader attacker opportunity, especially for organizations that need time to test, approve, and deploy patches across users, devices, and environments.

Even when attackers do not directly exploit the browser, the browser is still central to many common attack paths. Phishing, clickjacking, cross-site scripting, HTML smuggling, malicious downloads, credential theft, and session abuse all rely on the browser as the place where users interact with web content, applications, and data. That makes browser security a front-line enterprise control.

The Importance of Enterprise Browser Security

Businesses need protection that works before every patch is tested, deployed, and adopted. The challenge is not just defending against zero-days. It’s reducing risk from the broader set of attacks that use the browser to reach users, applications, identities, and data.  

A strong browser security strategy reduces risk from zero-days, unpatched N-days, and browser-mediated attacks, including phishing, malicious scripts, data exfiltration, credential theft and web-based social engineering.

Taken together, these risks highlight the need for defenses that protect users and data at the point where web risk becomes business risk: inside the browser session. That protection should work across users, devices, applications, and browsers, without depending entirely on perfect patch timing or complete endpoint control.

CrowdStrike Falcon® Secure Access is built for this challenge. Rather than relying on patch availability or network-level inspection, Falcon Secure Access operates inside the browser’s JavaScript execution environment, placing security controls at the layer where browser-based attacks occur. Its zero-day exploit prevention capability uses a moving target defense approach called JavaScript Language Randomization (JSLR), which continuously randomizes the JavaScript runtime environment to make it harder for attackers to exploit browser vulnerabilities — even before a patch exists or has been deployed across the organization. 

Beyond zero-day protection, Falcon Secure Access addresses the broader browser attack surface by blocking phishing and adversary-in-the-middle techniques, protecting session tokens against hijacking and MFA bypass, and preventing credential theft and data exfiltration at the point of execution. Because it deploys as a lightweight runtime security module inside the browser, these protections extend across managed and unmanaged devices to cover employees, contractors, and third parties regardless of whether a traditional endpoint agent is present. For organizations that cannot afford to wait for perfect patch timing (and no organization can), Falcon Secure Access provides a layer of defense that works inside the browser session, where web risk becomes business risk.

Watch it in action and see how Falcon Secure Access can help add enterprise browser security for any user, on any device, using any browser, anywhere:

Additional Resources

• Join us at Fal.Con 2026 as we bring together cyber leaders from across the industry to help secure the AI revolution.
• Download the Falcon Secure Access data sheet to see how CrowdStrike helps protect every user, on any browser and any device, while modernizing secure access for today’s distributed workforce.

The post Browser Security: Zero-Days Are Only Part of the Problem appeared first on MASSIVE News.

The teal wave has been hailed as a welcome feature of our democracy. How refreshing to have a bevy of free-thinking, free-speaking independents (even if a couple are now forming a new party). But it has also contributed to the decline of a major “party of government” and, some would say, by extension and indirectly to the rise of One Nation. And that is bringing its costs.

This overlooks an important point. While the federal spending during COVID, judged in retrospect, was obviously more than needed, it kept a lot of people and businesses going. The Liberals might rightly want to distance themselves from Scott Morrison, but that government’s COVID record was far from as bad as now portrayed.

But another quick change of leader, to Andrew Hastie, wouldn’t necessarily help. Hastie came into parliament (at a 2015 byelection) only a couple of years after Taylor (2013) but he is less experienced in senior frontline positions.

The Liberals don’t know how to respond to One Nation. Hastie is adamant be won’t “bend the knee” to the insurgents. Some Liberals want accommodation. Taylor’s language varies, as he seeks to avoid offending One Nation supporters. “I never attacked One Nation voters, and I never would. I never will,” he said on Monday.

One time Florence bogged, opening up a sink hole. The second time she was wedged in rock.

When well prepared, Hastie can be a strong political performer, but he has been knocked around by the vicious attacks on him over giving evidence against Ben Roberts-Smith, the VC winner accused of five counts of the war crime of murder. Hastie’s political resilience – an incredibly important quality in politics – has yet to be tested.

Liberals are tossing overboard their past, like a sinking ship discarding ballast.

While the main attention has been on a drop in One Nation’s support (and Labor’s rise), the equally important message is what’s happening to the Coalition vote. In Newspoll it’s down a point to 17%. In Redbridge it’s fallen two points to 18%.

Then there is the “wedge”, or wedges, the Liberals face.

The Liberal Party reminds one of that cumbersome machine, nicknamed Florence, that became stuck (twice) in a tunnel in the Snowy 2.0 project.

They’ve tried the leadership switch, and that hasn’t worked. Angus Taylor gets into muddles (as he did last week over multiculturalism). He looks as though he’d rather be back on his farm than having to be out and about every day, everywhere, which is the brief for an opposition leader. He is not cutting through.

More generally, the Liberals are wedged between needing to attract back voters who have fled to One Nation but also small-l former Liberal voters who have backed the teals. That surely is an ideological and policy needle that defies threading.

The success of the teals in taking Liberal seats has been a major factor in the Liberals’ parlous position.

“That takes a lot of work inside the party to go back to our roots, and then to look at our messaging and our communications to the Australian public, because you can’t keep getting poll after poll saying that it’s diabolical out there and just ignore it.”

For any revival, the Liberals need to win back urban seats, but the teals are now substantially dug in.

Both problems beset the Liberals as two more polls published at the weekend document their strife.

Read more:
Two new polls show drop in support for One Nation and the Coalition

“I’m putting myself out on a limb a little bit,” McIntosh said. “I think it’s time for the Liberal party to rebrand itself. Some people think that we’re stuck in the past and our policies need to resonate with the Australia of today and the future. So I think it’d be a really good time for us to revisit our values. What we stand for and the way we project ourselves to Australians.

Anyway, if the Liberals changed leaders again soon and it didn’t work, what then? No obvious candidates would remain, although shadow treasurer Tim Wilson would see himself as an option.

Various desperate suggestions are being put forward. Frontbencher Melissa McIntosh, interviewed on Monday on Sky, which is having to change its name for licence reasons, suggested the Liberals should rebrand too.

The teals defeated a number of Liberal moderates. In Kooyong Monique Ryan took out a potential future leader, Josh Frydenberg. If Frydenberg had held Kooyong he would have likely become leader either after the 2022 election or the 2025 one.

Peter Dutton has of course been thoroughly trashed. Taylor is criticising the Liberals’ record in COVID. He said on Monday, “I think during COVID we allowed big government to become accepted […] we needed to come out of COVID with a strong plan to pare back on both spending and the role of government in people’s lives”.

For Liberals determined to look on the bright side, however, Florence eventually did get out of her predicament. A recent Snowy Hydro video “Catching up with Florence!” shows her moving. Taylor can only hope.

As they agonise about their situation, Taylor is putting forward what is more or less a classic Liberal economic agenda. Economics is traditionally the Liberals’ strong ground but their current messages are not suiting the mood of a disgruntled electorate. Not that voters listen to a leader many of them have written off.

The post View from The Hill: Liberals now wedged in tunnel, staring at a sinkhole appeared first on MASSIVE News.