Security Flaw Exposed 30 Years of DNA Evidence Files to Tampering Risk

Thermo Fisher Scientific has issued a high-severity security bulletin after researchers found that data files produced by its Applied Biosystems DNA analysis instruments could be altered without detection.

The bulletin, published on 31 July 2026 and assigned CVE-2026-17583 with a CVSS score of 8.2, covers .fsa and .hid file types generated by several Applied Biosystems Human Identification software products, including the 3500/3500xL and 3730/3730xL Data Collection Software, SeqStudio and SeqStudio Flex systems, and GeneMapper ID-X. Thermo Fisher said modification could occur "if laboratory controls are circumvented" and has released software updates that add digital signatures so labs can verify files have not been changed. Products that have reached end of life, including the 3130 series and ABI PRISM 3100 and 310 systems, will not receive updates.

According to reporting by the Wall Street Journal, the vulnerability is believed by researchers to have existed since 1995, when the affected machine types first came into use, and became easier to exploit as AI coding tools matured. The WSJ reported that Nathan Adams, a systems engineer at Forensic Bioinformatics who worked on the research, used Anthropic's Claude to help write code that altered a DNA file, and said his first successful attempt took around 45 minutes. Thermo Fisher, which was contacted by the researchers in May and acknowledged the issue privately in July, said it has no evidence the vulnerability has been exploited and is working with the US Cybersecurity and Infrastructure Security Agency. The company recommends encrypted storage, restricted access and firewall controls as interim safeguards.

DNA evidence has long been treated as a highly reliable input to criminal investigations and prosecutions, and the WSJ noted that most convictions do not rest on DNA evidence alone. Even so, the finding raises questions for a forensic science system that, according to the WSJ, has more than 200 labs operating without a single national regulator overseeing security practices. Sarah Chu of the Perlmutter Center for Legal Justice told the paper the episode reflects protocols that have not kept pace with security standards adopted elsewhere. Defense attorneys already routinely challenge how DNA evidence is collected and analysed in criminal cases, and a verified method for detecting tampering, once the new digital-signature requirement is in place, may become a factor in how such evidence is scrutinised going forward.

Who Owns AI Security in the Enterprise? Governance Is Still in Its Infancy

Who actually owns AI security in your organisation — and how mature is your governance around it? Two senior CISOs from vastly different environments give a straight answer: ownership sits with the CISO for now, and governance, even in well-run programmes, is still in its infancy. AI is shifting enterprise risk from defending infrastructure to defending decisions. Agentic AI operates semi- or fully autonomously, traditional security controls don’t fit probabilistic systems, and no single vendor covers the full attack surface. Speakers: Andy Holliday, CISO at Petrofac, Lester Godsey, CISO at Arizona State University and Stewart Tinson, Project Director, AI-360 You’ll learn: • Why the CISO is the only realistic owner of AI security risk for the next 5 years • Why agentic AI breaks deterministic security controls and what to do about it • How ASU built an actionable AI framework supporting 60+ large language models • Practical controls: API key hygiene, command whitelists, blast radius reduction • Why no single vendor can cover AI security end-to-end Key topics: Agentic AI risk • AI governance maturity • Threat model transformation • CISO ownership • Incident response for AI • Ethics & training data bias • Vendor landscape reality • Probabilistic vs deterministic controls For CISOs, CIOs, and risk leaders making decisions about AI adoption now.

BrightTALK