Information Technology

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog and requires federal agencies to remediate affected systems by October 26, 2026. The unauthenticated command-injection flaw affects only Nextcloud deployments using the optional Built-in CODE Server app below version 26.4.303, so contractors should verify deployment details and coordinate targeted remediation.

Leonardo DRS secured a prime position on NASA’s 10-year SEWP VI contract vehicle and a separate Joint Interagency Task Force 401 counter-UAS IDIQ with a $500 million ceiling. SEWP VI ordering begins November 1, 2026, but neither vehicle guarantees revenue; task-order flow and funded requirements will determine the opportunity’s value.

Finalized NIST post-quantum standards create near-term planning, implementation, and validation work for federal contractors, even though proposed RSA and ECC transition dates remain unsettled. Contractors can inventory cryptographic dependencies and assess hybrid ML-KEM pilots while monitoring standards for certificates, TLS, and messaging; no solicitation, award, or contract value is identified.

The Mandarin’s 2026 Frank and Fearless survey found that 71% of public-service respondents use AI at work, up from 28% in 2024. Higher adoption among Commonwealth respondents than state respondents may inform supplier planning for AI governance, training, and assurance, but the survey identifies no agency requirement, funding, or procurement opportunity.

BigBear.ai Holdings says it has secured more than $225 million in federal contract awards since July, including more than 25 generative AI wins across homeland security, defense, intelligence, and civilian missions. The aggregate figure signals agency demand but does not identify individual awards, obligations, vehicles, or solicitations, so contractors should track funding and teaming developments rather than treat it as a direct bid opportunity.

NIST CMVP Certificate #5493 lists Fortinet’s FortiClient Crypto Module v1.0 as an active software module validated to FIPS 140-3 Security Level 1, with a stated sunset date of August 16, 2031. Federal buyers can use the certificate in product due diligence, but must verify that the proposed configuration falls within its scope and accounts for its caveats; no contract opportunity or pricing is identified.

Canada is committing roughly $5 billion to Telesat while expanding satellite partnerships with Europe, South Korea, and Norway, aiming to reduce reliance on a single provider. The move raises potential opportunities across satellite capacity and supporting services, but no funding mechanism, procurement requirements, award schedule, or open solicitation has been identified.

Repo squatting exploits lookalike repository names to steer developers and automated build systems toward malicious code. Government contractors and procurement teams can reduce exposure by checking repository ownership, tracking approved sources, and evaluating supplier controls for software provenance and integrity.

At IACP 2026 in Orlando, Semtech will demonstrate AirLink 5G capabilities for public-safety agencies, including carrier network slicing, FIPS 140-3 support through an AirLink OS 6.1 update, and expanded fleet management. The announcement signals technology for agencies to evaluate, but identifies no solicitation, contract award, pricing, or procurement deadline.

The Federal Trade Commission is reportedly developing an investigation involving Anthropic and OpenAI as Washington scrutinizes AI safety-incident disclosures, lobbying, and proposals to preempt state regulation. No contract action or new requirement is identified, but government AI contractors may wish to assess reporting commitments and prepare for potential federal–state policy differences.

The **Federal Communications Commission** has restricted certain new foreign-made drones, Wi-Fi routers, and home robotic devices from entering the U.S. market without an exemption or special approval, citing cybersecurity and national security concerns. For government and other institutional buyers, model-level approval checks may be important to sourcing and replacement plans; approval delays could also limit product choice and affect acquisition timelines.

NOAA is shifting high-performance computing, weather-data storage and forecasting applications from on-premises systems to cloud platforms, with Google Cloud the primary provider for WCOSS modernization. The schedule points to near-term needs in cloud engineering, migration and operational support, but no solicitation, contract value or open bid opportunity has been identified.

Axon announced Body 5 and Body 5 Pro on October 24, 2026, with increased on-device AI processing, improved connectivity and video, and 20% longer battery life. No pricing or general availability dates were provided, so public-safety agencies can use the announcement for market research but cannot yet set acquisition costs or schedules.

South Carolina and federal officials are scheduled to announce Project Lifeline 250 at Newberry Health Hospital on October 26, 2026. The pilot could signal future healthcare cybersecurity work, but no funding, technical requirements, vendor selection, or solicitation has been disclosed.

The NSA, CISA and FBI urged organizations to patch two critical PHP remote-code-execution flaws after emergency fixes were released on October 21. Reported exploitation attempts reached millions, but successful compromises and widespread exploitation remain unconfirmed; agencies and contractors should inventory underlying PHP runtimes and isolate systems that cannot be patched promptly.

The SEC’s Division of Examinations announced FY 2027 priorities for examinations of more than 34,000 registrants, including cybersecurity, operational resilience, advanced technologies, private funds and credit, broker-dealer controls, and evolving market infrastructure. The announcement is a regulatory oversight signal—not a solicitation, award, or new mandate—but gives contractors serving financial firms areas to assess for service alignment.

The Department of Veterans Affairs is gathering industry input for MOSAIC, a potential effort to improve enterprise data access, reliability, and integration. Responses to the RFI are due November 4, 2026, at 3 p.m. Eastern and are limited to 25 pages; requirements and acquisition strategy remain under development.

State actions are creating funding and deployment uncertainty for automated license plate reader programs: Texas ended state funding for Flock Safety cameras, and Florida directed its Department of Transportation to remove cameras. Proposed restrictions in Oregon, Pennsylvania, New Jersey, and New York could add further compliance, contract-change, and renewal risks for agencies and providers.

The U.S. Consumer Product Safety Commission appointed Chief Data Officer Beth Puchek as its Chief AI Officer, giving her agencywide responsibility for AI strategy and governance. The appointment is relevant to a potentially $58 million data-solutions BPA covering modernization, governance, and AI/ML enablement; Everforth ECS received its first task order.

The Department of the Air Force plans an Automated Classification Management Environment (ACME) Industry Day on November 9, 2026, in the National Capital Region, with attendance capped at three representatives per vendor. Vendors that responded to the related RFI and expressed interest in Function 1: Integrator are expected to receive separate invitations for one-on-one meetings on November 9–10; venue and registration details remain unavailable.

A cybersecurity discussion highlights how poorly documented systems can leave IT Operations identifying vulnerabilities while application owners or system managers control patch decisions. For agencies and contractors, the operational takeaway is to define ownership, remediation commitments, escalation paths, and documented risk acceptance; the discussion identifies no procurement or formal requirement.

A federal judge ruled that the U.S. Office of Personnel Management violated the Privacy Act by granting Department of Government Efficiency personnel broad access to systems containing personally identifiable information on millions of current, former, and prospective federal workers. Remedies remain undecided, including whether extracted data must be deleted; the ruling raises practical privacy, access-control, and data-retention concerns for contractors supporting federal personnel systems.

CISA and cybersecurity agencies from four allied countries issued joint guidance on managing AI token consumption and mitigating denial-of-tokens and denial-of-wallet risks. Federal contractors should assess usage monitoring, cost controls, provider quotas, and continuity planning for AI services; the guidance is advisory, not a new mandatory compliance rule.

The Defense Logistics Agency awarded incumbent Leidos a five-year, $95 million contract to support and modernize its Enterprise Logistics Management System through August 2031. The continuation award signals sustained investment in AI-enabled logistics, cloud technology, and software modernization, but is not an open solicitation or current bid opportunity.

North Carolina Attorney General Jeff Jackson and 22 other attorneys general are urging the FCC to preserve E-Rate as it reviews the program’s scope, eligibility rules, and potential screen-time conditions. With North Carolina receiving more than $54 million in discounts in 2026, changes could affect school connectivity budgets and demand for contractors serving schools and libraries, particularly rural districts.

Federal databases, surveys, and measurement systems are evolving in scope, access, and demographic coverage, complicating efforts to assess research outcomes over time. The issue points to potential demand for data governance, interoperability, analytics, and program evaluation support, but no specific solicitation, agency requirement, or funding amount is identified.

An independent audit found accessibility barriers on all 28 Illinois municipal websites reviewed, including inaccessible PDFs, keyboard-navigation issues, color-contrast problems, and chat-widget concerns. The findings point to potential demand for municipal accessibility audits and remediation ahead of DOJ ADA Title II deadlines: April 26, 2027, for municipalities serving populations over 50,000, and April 26, 2028, for smaller municipalities.

The Federal Bureau of Prisons will host a November 9–10, 2026, industry day in Washington, DC, to assess commercial payment systems for staff dining halls. Providers may request demonstrations, but the event is market research only; no solicitation or purchase commitment has been announced.

The U.S. Department of Justice reached a settlement with Honeywell Aerospace valued at more than $2 million over allegations that cybersecurity requirements were not met on a network handling Department of Defense information from April 2020 to December 2023. The case highlights potential liability for inaccurate cybersecurity compliance certifications even when no breach is reported, while a separate CMMC self-assessment delay announced in July 2026 has no revised effective date in the available information.

HP Inc. reported $950,000 in third-quarter in-house lobbying and $1.07 million in spending with three outside lobbying firms. Its priorities include ICT and semiconductor supply-chain resilience, implementation of enacted tax and defense laws, and patent issues—policy activity with potential implications for federal technology suppliers, not a contract award or solicitation.

Two Marines filed a proposed class-action lawsuit alleging that a Defense Manpower Data Center file-sharing vulnerability exposed unencrypted personal records for about 3.05 million military-connected people over roughly nine months. The case raises cybersecurity, privacy, and incident-notification concerns for contractors supporting DoD systems, but no procurement action or new requirement has been announced.

Quest Diagnostics said unauthorized access to its Quantum Lab Services Manager system may have exposed patient records, though the number affected is unknown. The incident is a healthcare cybersecurity and third-party-risk signal for government buyers and contractors; the company reports services and operations remain unaffected, and no procurement opportunity was announced.

A government-wide IT modernization playbook draws on the Navy’s technology-acquisition framework, urging agencies to map portfolios, evaluate pilots with standardized measures, and plan for scaling or retiring systems. The guidance is not a solicitation or award, but gives vendors a clearer basis for structuring pilots around measurable outcomes and enterprise transition plans.

Washington Headquarters Service is seeking prototype concepts for Project Argus, a modern platform to replace the Department of Defense’s legacy BIRD system and support intelligence-resource analysis and Congressional Justification Books. White papers are due November 13, 2026; respondents should address operations across Impact Levels 2–7, on-site analyst collaboration, and contingency sustainment of BIRD beyond September 2027.

A review tracking 49 federal privacy proposals through September 2026 spans consumer data, AI, children’s information, health and location data, employee monitoring, and data brokers; two measures have become law, though the source does not identify them or their requirements. Contractors should monitor the policy landscape and assess privacy and AI-governance readiness, while treating pending proposals as potential future requirements—not current mandates or procurement opportunities.

Dell Technologies recommends that AI hardware buyers share detailed demand forecasts earlier as shortages span memory, CPUs, drives, optical components, cooling, and power systems. Its $95 billion AI backlog at the end of fiscal Q2 2027 signals strong demand and potential delivery risks for government AI deployments and supporting contractors.

The FAA will hold a Domestic Datalink Services Industry Day in Washington, D.C., on December 8–10, 2026, as market research—not a solicitation—to inform acquisition planning and requirements. Capability statements are due November 10; the agency is considering end-to-end services and monitoring, with a potential contract of up to 10 years and transition planning tied to the existing contract’s stated 2029 expiration.

Asheville City Council voted 5–2 to terminate the city’s contract with Flock Safety, ending police access to the surveillance-camera service the following day. The decision highlights unresolved questions about searches, retention, and deletion of data; no contract value, replacement vendor, or follow-on solicitation was reported.

The Waterloo Regional Police Service plans to favor Canadian suppliers where possible in future capital and operating procurements amid U.S. tariffs. It is also reassessing existing U.S. contracts—particularly IT—for tariff exposure, data sovereignty, and operational security, while cooperative purchasing tenders and the next budget cycle offer potential entry points for suppliers.

NIST is developing standards and an implementation use case to address security risks as organizations deploy autonomous AI agents. The work focuses on agent identity, context-based data access authorization, and auditing, signaling an emerging market need rather than a current solicitation, award, or compliance mandate.

MegazoneCloud can now resell AWS GovCloud (US) and offer related cloud design, deployment, migration, and operations services to public-sector, defense, and regulated-industry customers. The status adds a potential procurement channel, but is not a contract award or evidence of funded agency demand.

Zero Networks said an autonomous AI model gained administrator access and credentials on an intentionally unsegmented machine but could not move laterally into systems protected by its microsegmentation. The evaluation offers government security teams and contractors a capability signal for assessing containment after a compromise, but it is not a government award, endorsement, or procurement opportunity.

At the 7th U.S.-ASEAN Cyber Policy Dialogue, the United States and ASEAN members reaffirmed cooperation on cyber strategies, incident information sharing, cybercrime, scams, and critical infrastructure protection. The statement identifies policy priorities—not a contract, funding opportunity, solicitation, or procurement timeline.

The proposed EU Cloud and AI Development Act would create four cloud-sovereignty assurance levels for public-sector procurement, with potential requirements for data location, foreign access, and service continuity. Contractors serving European and U.S. markets should assess the proposal separately from U.S. FOCI and FedRAMP obligations; the analysis also notes proposed FOCI-related provisions for certain unclassified Department of War work above $5 million.

A technical guide outlines OAuth 2.1-style authentication, audience-bound tokens, per-tool scopes, and audit controls for AI agents using Model Context Protocol servers. It identifies no government buyer, funding, solicitation, or acquisition path, but offers topics for agencies and contractors to consider in AI security evaluations.

The proposed AI Cyber Defense Act would direct NIST to develop voluntary guidance against AI model distillation attacks and convene government and industry stakeholders on critical-infrastructure cybersecurity. It does not authorize funding or create a procurement mandate, but could give AI security providers and federal contractors a forum to contribute expertise if the bill advances.

Owl Cyber Defense launched XD Chat, a secure messaging solution that connects existing chat platforms across classified and unclassified networks, including in bandwidth-constrained environments. The announcement identifies no customer, solicitation, award, price, or procurement timeline, so it signals a capability for government evaluation rather than a defined acquisition.

SAP reports that defense-related buyers are examining the origins, data pathways, and governance of AI embedded in enterprise software more closely than smaller businesses. The trend may create demand for sovereign AI and cloud options, but no specific agency requirement, solicitation, award, or contract is identified.

CISA, the FBI, the U.S. Secret Service, and international partners report that SafePay has affected about 600 organizations worldwide since August 2024, including critical-infrastructure operators. Contractors should review the advisory’s indicators and mitigations, urgently patch cited Cisco, Veeam, and SonicWall vulnerabilities, and assess protections for remote access, networks, and backups.

A **Department of Homeland Security** order directs federal civilian agencies to remove DeepSeek products and covered third-party offerings built with DeepSeek technology, and prohibits new purchases. Contractors should review covered contracts containing **FAR 52.204-30**; the notices leave the effective date and method for identifying covered implementations unspecified.