US bans use of China's DeepSeek AI tools by government agencies

Castilume, Wednesday, 21 October. Nova here with Atlas. Coffee ready? Let's go straight into it.

On the board: four stories. Two outlets minimum on each, and we'll tell you why it matters.

On to AI. US bans use of China's DeepSeek AI tools by government agencies.

Here's what The Guardian is reporting. Use of tools 'may result in the transfer of sensitive data' to China, defense department says The US government on Monday ordered its agencies to stop using artificial intelligence tools from the Chinese startup DeepSeek, as the countries race for dominance in the fast-moving sector. A notice from the Department of Homeland Security announced the ban on products developed by DeepSeek, and tools created using DeepSeek by third parties, saying they must be removed from IT devices. The DHS can issue direction to civilian agencies but not the military or intelligence services. The US defense department did not respond to an AFP request for comment.

BleepingComputer also notes: Department of Homeland Security is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems.

Bottom line for a small team: wait for pricing and real availability before you change any plans.

Here's number two. Anthropic pitches AI safety bill that may block a model if more than 50 people could be killed.

Per TechCrunch: The proposed policy seems to offer protections against AI run amok but actually forbids federal agencies from blocking a model's release without the permission of a judge. Over the past year, concerns have swirled over the potential dangers posed by artificial intelligence, and debates have raged over the proper path for AI safety. Now, Anthropic appears to have put forth its own vision for how the government might regulate its industry. Politico recently reported that the AI lab has been shopping around a new draft bill on AI safety that it hopes Congress might consider adopting.

Also reported by The Tech Buzz, Mashable and UA.NEWS.

For a small business here, three questions: can you use it this month, what does it cost, and where does your data go? If the story can't answer those yet, file it and move on.

Story three, security. Stolen UpdraftCentral keys used to backdoor WordPress sites.

According to BleepingComputer: A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database. The developer offers several WordPress tools for backup, storage, and site management: "Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website," TeamUpdraft said in an advisory yesterday.

Also reported by Mezha.net and Cyber Kendra.

Quick check for your team: do you run anything exposed to the internet that matches this report? If yes, lock it down and patch today. If not, keep an eye on it.

Next, from the security desk. Mozilla, Google, Apple block compromised eMudhra CA certificates.

BleepingComputer reports: Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to impersonate legitimate websites and intercept encrypted communications. A security researcher known as Wayne discovered the weakness on October 17 while scanning publicly available certificate data. According to Mozilla's incident report, all eight certificates used P-384 private keys generated in April 2025 that had values smaller than 256, allowing anyone to recover them by testing just 256 possible numbers.

Over at Dark Reading: Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.

The takeaway: keep your public-facing systems patched and behind a login. That alone blocks most of what's in stories like this.

That's Castilume for today. The news, then what it means. Sources for every story are on the episode page. I'm Nova.

And I'm Atlas. See you tomorrow!