Curated intelligence for federal IT decision makers.

Federal IT newsFedScoop · 2026-08-12

VA-Oracle EHRM Contract Faces Funding and Timeline Challenges

The Department of Veterans Affairs (VA) is seeking to expand its $10 billion contract with Oracle Cerner for the Electronic Health Record Modernization (EHRM) initiative, as the project faces funding shortages and delays. The original contract ceiling is nearly exhausted, and the VA has proposed extending the period of performance by three years, potentially until May 2031.

The project has been hindered by "unanticipated complexity," including technical glitches, training issues, and COVID-19 restrictions. These challenges have necessitated extensive site-specific customizations and rework, delaying deployments. While 14 sites have been successfully deployed, the remaining 120 sites cannot be completed within the current contract timeline. VA estimates the remaining funds will be exhausted by the first quarter of fiscal year 2027.

The proposed contract modification does not alter the nature of the work but seeks to increase the funding ceiling and extend the ordering period. The VA recently evaluated alternative EHR providers, including Epic and Meditech, but concluded that Oracle is the only vendor capable of meeting all requirements. The House-passed fiscal 2027 appropriations bill includes $3.4 billion for EHRM, though this was not included in the Senate’s continuing resolution. VA Secretary Doug Collins emphasized the project’s importance for veteran care and inter-hospital communication.

• The VA-Oracle EHRM contract is nearing its funding ceiling and requiring an extension.
• Technical and logistical challenges have delayed deployments and increased costs.

Federal IT newsFederal News Network · 2026-08-12

GAO Report Highlights Concerns Over OPM Workforce Reductions

A recent GAO report examines the implications of significant workforce reductions at the Office of Personnel Management (OPM), raising concerns about the agency's ability to fulfill its mission. Over the past 18 months, OPM has played a central role in reshaping federal workforce policies while experiencing a 34% reduction in its own staff, well above the government-wide average of 11%. The report highlights the loss of institutional knowledge, particularly among employees over 60, and the departure of younger professionals, which conflicts with the administration’s focus on hiring emerging talent.

The report notes that OPM’s workforce cuts have occurred alongside increased responsibilities in key areas, such as the Merit System Accountability and Compliance shop, which lost 41% of its full-time employees. GAO expressed concern over whether OPM can maintain operational capacity and meet mission needs, especially given existing skills gaps in project management, leadership development, and data analytics.

OPM has cited AI as a potential solution to workforce challenges, but GAO cautioned that AI requires skilled oversight to avoid errors in critical decision-making. The agency provided limited information to GAO, missing key documents like strategic workforce and reorganization plans, leaving questions unanswered about the long-term impact of these reductions.

The findings suggest that OPM’s workforce cuts may have broader implications for federal agencies and employees, particularly in areas like hiring, classification, and retirement services. GAO continues to collaborate with Congress to assess the effects of these reductions and determine next steps.

• OPM lost 34% of its workforce, raising concerns about mission readiness.
• Reductions disproportionately affected older employees and young professionals.

CybersecurityBleepingComputer · 2026-08-12

Fake Remote Workers Exploit Hiring Process Vulnerabilities

A growing cybersecurity threat involves fake remote workers infiltrating organizations through vulnerabilities in the hiring process. According to a July 2026 alert from the U.S. Department of State, North Korean IT workers have been impersonating nationals of other countries to gain legitimate employment, often redirecting salaries to North Korean agencies and engaging in cybercriminal activities.

These fraudulent workers employ tactics such as falsifying identities, creating AI-generated professional profiles, and using unorthodox payment methods like cryptocurrency. They also disguise their locations using VPNs and remote desktop software, while facilitators in the claimed country of residence handle device delivery and connectivity. Despite traditional employment checks verifying identity and eligibility, these methods fail to confirm the actual user of employer-issued devices.

Organizations are advised to implement robust vetting processes, including government-issued document scanning and biometric liveness detection, to mitigate these risks. Specops Secure Onboarding, for example, combines these methods to ensure that the person onboarding matches the identity documents and is physically present, reducing the likelihood of credential misuse.

The FBI warns that these fake workers can exfiltrate proprietary information and may even attempt extortion if discovered. Indicators of fake worker operations include frequent changes to registered information, mismatched payment account names, and abnormal login activity. Strengthening onboarding processes with advanced identity-proofing measures is crucial to safeguarding organizational networks from such threats.

• Fake remote workers exploit gaps in hiring processes to gain access to corporate networks.
• Advanced identity verification methods are essential to mitigate risks from fraudulent hires.

CybersecurityBleepingComputer · 2026-08-12

FBI Warns of Cybercriminals Targeting Accounts for Explicit Content

The FBI has issued a public service alert regarding cybercriminals targeting social media and other online accounts to steal sexually explicit images and videos. The stolen content is often used for blackmail, sold on criminal marketplaces, or shared with other criminals to pressure victims into providing additional private material. Sextortion, a form of online blackmail, often involves threats to leak explicit content unless victims comply with demands.

The FBI and the National Collegiate Athletic Association (NCAA) have also warned that student-athletes are being targeted in similar schemes. They urge coaches and athletic department leadership to raise awareness within their communities. The FBI advises against storing explicit content on social media or internet-accessible sites, recommends using complex passwords, and enabling multi-factor authentication.

The alert highlights common tactics cybercriminals use, such as sending unsolicited messages requesting verification codes or password resets. Victims are encouraged to cease all communication with perpetrators and contact law enforcement immediately. The FBI emphasizes that legitimate platforms will never request sensitive verification codes from users.

While the FBI has not disclosed specific reasons for the alert, it often issues warnings in response to increased incidents. For example, in 2021, the bureau reported a significant rise in sextortion complaints. Cybercriminals involved in such schemes face severe penalties, with one Canadian man recently sentenced to 33 years for targeting children in a sextortion scheme.

• Cybercriminals are targeting accounts to steal explicit content for blackmail and sale.
• Student-athletes are also vulnerable to these schemes.

AI in enterpriseCIO.com · 2026-08-13

AI Agent Deployments Hampered by Data Infrastructure Challenges

Recent studies highlight a critical obstacle in enterprise AI adoption: legacy data systems are ill-equipped to support AI agents. Separate research from Google/MIT and Cloudera reveals widespread delays and cancellations of AI projects due to data accessibility, governance, and infrastructure limitations.

A Cloudera/Wakefield survey of 1,500 enterprise architects found 95% had postponed or scrapped AI initiatives in the past year, primarily due to data governance and compliance hurdles. Similarly, Google/MIT's research shows over half of 300 IT leaders paused AI agent deployments to address foundational data issues like silos and lack of context. Both reports emphasize that AI agents require multimodal, context-aware data with real-time access - capabilities most legacy systems lack.

The studies identify key infrastructure pain points: entrenched data silos, inaccessible unstructured data, batch processing architectures that prevent real-time decisions, and insufficient contextual metadata. Despite these challenges, 98% of Google/MIT respondents are actively deploying or planning to use AI agents, primarily in customer service, IT management, and security operations.

Successful AI adoption correlates with data accessibility - organizations providing agents access to over 70% of their data report significantly higher decision accuracy than those sharing less than 30%. Recommendations include implementing unified data governance, shifting to event-driven pipelines, and adopting 'AI-native' system designs that prioritize machine-readable data structures from inception.

• 95% of enterprises delayed/cancelled AI projects due to data infrastructure limitations
• AI agents require real-time access to multimodal, context-rich data to function effectively

CybersecurityBleepingComputer · 2026-08-12

Signal Rolls Out Automatic Key Verification to Mitigate Man-in-the-Middle Attacks

Signal has launched Automatic Key Verification, a new security feature designed to protect users from man-in-the-middle attacks. This feature enhances the platform's encryption by verifying the integrity of conversations without requiring manual intervention. It operates within a key transparency system, leveraging trusted third-party auditors Cloudflare and Trail of Bits to validate public encryption keys.

According to Signal software engineer Katherine Yen, the system ensures that the association between a user’s phone number or username and their public encryption key remains consistent and transparent across Signal's ecosystem. This prevents malicious actors from swapping out keys without the owner’s knowledge, a critical defense against interception attempts. Users can enable the feature via Settings > Privacy > Advanced, and verify public keys during chats by clicking "Verify Automatically." Successful verification is indicated by a green checkmark and an "Encryption verified" message.

For those preferring manual verification, Signal retains its safety number system as an alternative. The platform emphasizes that Automatic Key Verification complements existing security measures, enhancing assurance over time. This release follows Signal’s May introduction of additional safeguards against phishing and social engineering, prompted by state-sponsored hacking incidents targeting high-profile users.

These updates underscore Signal’s commitment to bolstering user privacy amid evolving cybersecurity threats.

• Signal’s Automatic Key Verification enhances encryption integrity using third-party auditors.
• The feature prevents man-in-the-middle attacks by ensuring key consistency across Signal’s ecosystem.