• AMD has disclosed a critical vulnerability affecting its Zen 5 processor lineup that compromises the reliability of random number generation, a fundamental security feature in modern computing.

    The flaw, tracked as CVE-2025-62626, impacts the RDSEED instruction used by systems to generate cryptographically secure random numbers essential for encryption, authentication, and other security operations.

    The vulnerability stems from a defect in the RDSEED instruction implementation on Zen 5 processors. Under certain conditions, the instruction returns a value of zero while incorrectly signaling success through the carry flag (CF=1).

    This behavior creates a dangerous scenario where software believes it has received a valid random number when it has actually obtained a predictable zero value. The issue affects both 16-bit and 32-bit forms of the RDSEED instruction, though the 64-bit version remains unaffected.

    Understanding the RDSEED Flaw

    AMD learned about this bug through an unconventional channel. The issue was first reported publicly on the Linux kernel mailing list rather than through AMD’s standard Coordinated Vulnerability Disclosure process.

    This public disclosure path highlights the collaborative nature of open-source security research but also underscores the challenge of managing security information across diverse reporting channels.

    The severity of this vulnerability cannot be understated. Random number generation forms the backbone of cryptographic security in modern systems.

    When RDSEED fails silently by returning zeros while indicating success, applications may generate weak encryption keys, predictable authentication tokens, or compromised security protocols.

    CVECVE DescriptionCVSS Score
    CVE-2025-62626Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values.7.2 (High) CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

    An attacker with local system access could potentially exploit this weakness to predict or influence cryptographic operations, leading to data breaches or unauthorized access.

    System administrators can utilize the 64-bit form of RDSEED exclusively, mask the RDSEED capability from software detection by modifying boot parameters, or implement software logic to treat zero returns as failures requiring retry attempts. The company plans to release microcode updates and AGESA firmware revisions across its product portfolio.

    AMD EPYC 9005 Series processors will receive updates by mid-November 2025, while consumer Ryzen 9000 Series, Ryzen AI 300 Series, and Threadripper 9000 processors target late November releases. Embedded processor variants will see patches deployed through January 2026.

    Organizations running affected Zen 5 systems should prioritize applying these updates once available through their original equipment manufacturers.

    Until patches are deployed, implementing the recommended software workarounds provides essential protection against potential exploitation of this random integrity vulnerability.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post AMD Zen 5 Processors RDSEED Vulnerability Breaks Integrity With Randomness appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Open VSX Registry and the Eclipse Foundation have completed their investigation into a significant security incident involving exposed developer tokens and malicious extensions.

    The comprehensive response reveals how the platform is strengthening defenses across the entire VS Code extension ecosystem following the breach.

    The security incident began when researchers at Wiz identified multiple extension publishing tokens inadvertently exposed by developers in public repositories.

    Investigation confirmed that a limited number of tokens associated with Open VSX accounts had been compromised, creating a direct pathway for attackers to publish or modify extensions without authorization.

    The Open VSX team emphasized that these exposures resulted from developer mistakes rather than infrastructure compromise, immediately revoking all affected tokens upon discovery. The exposure highlighted a critical vulnerability in the development workflow where sensitive credentials can easily slip into version control systems.

    Understanding the Threat

    Open VSX collaborated with Microsoft Security Response Center to introduce a new token prefix format specifically designed for easier and more accurate scanning of exposed tokens across public repositories, enabling developers and security teams to identify compromised credentials faster.

    Security researchers at Koi Security subsequently identified a coordinated malware campaign called “GlassWorm” that leveraged the leaked tokens to publish malicious extensions to the platform.

    While initial reports characterized this as a self-propagating worm comparable to the ShaiHulud incident on npm, Open VSX clarified that the malware operated differently.

    The extensions were designed to steal developer credentials, enabling attackers to expand their reach across the ecosystem, but the malware did not autonomously replicate or propagate across systems.

    The campaign resulted in several malicious extensions reaching the marketplace before removal. Open VSX removed all identified malicious extensions immediately upon notification and revoked or rotated associated tokens without delay.

    However, reported download statistics require context. The cited figure of 35,800 downloads includes inflated counts generated by bot traffic and visibility-boosting tactics employed by threat actors, potentially overstating actual user impact.

    As of October 21, 2025, Open VSX declared the incident fully contained with no indication of ongoing compromise or remaining malicious extensions on the platform.

    The response led to concrete improvements strengthening platform security, including implementing shorter default token validity periods to limit leak impact, streamlining token revocation workflows for faster response times, and deploying automated security scanning at publication to detect malicious code patterns before extensions reach users.

    Open VSX continues intensive collaboration with affected developers, ecosystem partners, and independent researchers to maintain transparency and reinforce preventive measures.

    These improvements demonstrate how security incidents, while disruptive, can drive meaningful ecosystem hardening and establish stronger protections for the broader developer community relying on open-source extension marketplaces.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Open VSX Registry Addresses Leaked Tokens and Malicious Extensions in Wake of Security Scare appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers and firewall monitoring services have detected a dramatic surge in reconnaissance activity targeting Windows Server Update Services (WSUS) infrastructure.

    Network sensors collected from security organizations, including data from Shadowserver, show a significant increase in scans directed at TCP ports 8530 and 8531 over the past week.

    While some scanning activity appears connected to legitimate security research initiatives, analysts have identified additional traffic from unknown sources not associated with known research organizations, raising concerns about potential exploitation attempts.

    The scanning activity correlates directly with CVE-2025-59287, a critical vulnerability in WSUS servers that enables remote code execution.

    Attackers can exploit this flaw by connecting to vulnerable WSUS infrastructure via either port 8530 (unencrypted) or 8531 (TLS-encrypted).

    Successfully establishing a connection allows threat actors to execute arbitrary scripts directly on compromised servers with no authentication requirements.

    Reconnaissance Followed by Full Compromise

    SANS analysis reveals that threat actors typically follow a two-stage attack pattern when targeting WSUS servers. The initial phase involves reconnaissance and scanning to identify vulnerable systems, which aligns with the recent surge in port scanning activity.

    Once attackers successfully identify and connect to susceptible servers, they proceed to the exploitation phase, deploying malicious scripts that grant them extensive control over the affected infrastructure.

    Experts emphasize that any publicly exposed WSUS server displaying characteristics of vulnerability should be presumed compromised at this stage.

     a significant increase in scans for port 8531/TCP
    a significant increase in scans for port 8531/TCP

    The availability of sufficient technical details in public disclosures has lowered the barrier to entry for potential attackers, enabling even moderately skilled threat actors to develop and deploy exploitation code.

    Organizations should assume that exploitation attempts have already occurred against any systems matching the vulnerable profile that have been connected to internet-facing networks.

    The severity of this vulnerability demands urgent action from system administrators and security teams managing WSUS deployments. Organizations must immediately audit their network perimeter to identify any WSUS servers accessible from untrusted networks.

    CVE IDVulnerabilityAffected ProductsCVSS Score
    CVE-2025-59287WSUS Script ExecutionWindows Server Update Services (Multiple versions)9.8

    Those discovering exposed instances should implement emergency isolation procedures and conduct comprehensive forensic investigations to determine whether compromise has occurred.

    Organizations without immediate patch availability should implement network segmentation, restricting WSUS server access to authorized internal networks only.

    Advanced threat detection systems should be configured to alert on suspicious outbound connections and script execution originating from WSUS processes, as these behaviors often indicate successful compromise.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Actively Scanning for TCP Port 8530/8531 Linked to WSUS Vulnerability CVE-2025-59287 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apple released iOS 26.1 and iPadOS 26.1, addressing multiple vulnerabilities that could lead to privacy breaches, app crashes, and potential data leaks for iPhone and iPad users.

    The update targets devices starting from the iPhone 11 series and various iPad models, including the iPad Pro (3rd generation 12.9-inch and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later).

    This release underscores Apple’s ongoing commitment to rapid response against evolving threats, especially as cyber risks intensify in an era of advanced malware and targeted attacks.

    The patches address over 50 issues across core components like WebKit, the Kernel, and Accessibility features. Many stem from memory corruption risks, privacy issues, and sandbox escapes, which could allow malicious apps to snoop on user data or destabilize the system.

    Security researchers from ByteDance, Trend Micro’s Zero Day Initiative, Google, and independent experts discovered most flaws, highlighting the collaborative nature of vulnerability hunting in the iOS ecosystem.

    Key Privacy and Sandbox Vulnerabilities Patched

    Several fixes focus on preventing apps from overstepping boundaries, a common vector for data theft. For instance, in Accessibility (CVE-2025-43442), a permissions flaw let apps detect other installed applications, potentially enabling fingerprinting.

    Apple mitigated this with stricter restrictions. Similarly, the Apple Account component (CVE-2025-43455) blocked malicious apps from screenshotting sensitive info in embedded views through enhanced privacy checks.

    In the Kernel and Apple Neural Engine, memory handling improvements (CVE-2025-43398, CVE-2025-43447, CVE-2025-43462) prevent unexpected crashes or kernel corruption, which could lead to denial-of-service attacks.

    Assets and CloudKit updates (CVE-2025-43407, CVE-2025-43448) reinforce sandbox integrity by validating symlinks more rigorously and preventing apps from escaping their confines to access protected files.

    Contacts and Photos also received logging and temporary file tweaks (CVE-2025-43426, CVE-2025-43391) to redact sensitive data and curb unauthorized access. A notable fix in Stolen Device Protection (CVE-2025-43422) adds logic to prevent physical attackers from disabling the feature, vital for protecting lost or stolen devices.

    ComponentCVEImpactDescriptionResearcher
    AccessibilityCVE-2025-43442App identifies installed appsPermissions issue with added restrictionsZhongcheng Li (ByteDance)
    Apple AccountCVE-2025-43455Malicious app screenshots sensitive infoPrivacy issue with improved checksRon Masas, Pinak Oza
    KernelCVE-2025-43398Unexpected system terminationImproved memory handlingCristian Dinca (icmd.tech)
    AssetsCVE-2025-43407App breaks sandboxImproved entitlementsJZ
    CloudKitCVE-2025-43448App breaks sandboxImproved symlink validationHikerell (Loadshine Lab)
    ContactsCVE-2025-43426App accesses sensitive dataImproved data redaction in loggingWojciech Regula (SecuRing)
    Stolen Device ProtectionCVE-2025-43422Attacker disables protectionAdded logicWill Caine

    WebKit Overhaul Targets Web-Based Exploits

    WebKit, powering Safari and web views, dominates the update with fixes for crashes, memory corruption, and cross-origin data exfiltration.

    A use-after-free vulnerability (CVE-2025-43438) could crash Safari via malicious content, while buffer overflows (CVE-2025-43429) risked arbitrary code execution.

    Apple addressed these through better memory management, bounds checking, and disabling risky optimizations like array allocation sinking (CVE-2025-43421).

    Privacy threats include keystroke monitoring (CVE-2025-43495) and cross-origin image theft in Canvas (CVE-2025-43392). Visiting spoofed sites could trick users (CVE-2025-43493, CVE-2025-43503), now countered with UI state improvements.

    ComponentCVEImpactDescriptionResearcher
    WebKitCVE-2025-43480Cross-origin data exfiltrationImproved checks (Bugzilla 276208)Aleksejs Popovs
    WebKitCVE-2025-43438Safari crash via use-after-freeImproved memory management (Bugzilla 297662)shandikri (Trend Micro ZDI)
    WebKitCVE-2025-43495Keystroke monitoringImproved checks (Bugzilla 300095)Lehan Dilusha Jayasinghe
    WebKit CanvasCVE-2025-43392Cross-origin image exfilImproved cache handling (Bugzilla 297566)Tom Van Goethem
    WebKitCVE-2025-43429Process crash via buffer overflowImproved bounds checking (Bugzilla 298232)Google Big Sleep

    Other components like Camera, Siri, and Text Input received targeted patches for logic flaws and lock screen leaks (CVE-2025-43450, CVE-2025-43454, CVE-2025-43452).

    Experts urge immediate updates, as unpatched devices remain vulnerable to zero-day exploits. Apple’s security page details all fixes, crediting researchers under its bounty program. With iOS 26.1, users gain stronger defenses against a landscape rife with sophisticated threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Apple Patches Multiple Critical Vulnerabilities in iOS 26.1 and iPadOS 26.1 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Identity compromise has become one of the most significant threats facing cloud infrastructure, particularly when attackers gain access to legitimate credentials.

    These valid access keys enable adversaries to bypass traditional security defenses, creating opportunities for widespread exploitation.

    Amazon Web Services environments have witnessed a surge in such attacks, with the Simple Email Service emerging as a preferred tool for conducting malicious email operations at scale.

    The service provides attackers with a reliable, scalable platform to execute phishing campaigns and Business Email Compromise schemes once they’ve obtained valid AWS credentials.

    FortiGuard Labs recently uncovered a sophisticated campaign that exploits stolen AWS credentials to abuse the Simple Email Service.

    During this investigation, researchers identified a massive attack infrastructure known as TruffleNet, which leverages the open-source secret-scanning tool TruffleHog to systematically validate compromised credentials and conduct reconnaissance across AWS environments.

    TruffleNet Reconnaissance Topology (Source – Fortinet)

    The campaign involved activity from over 800 unique hosts distributed across 57 distinct Class C networks, demonstrating the operation’s unprecedented scale and coordination.

    Fortinet researchers noted that the infrastructure exhibited remarkably consistent characteristics, including specific port configurations and the presence of Portainer, a container management platform.

    The initial TruffleNet connections typically began with a simple GetCallerIdentity API call to verify credential validity, followed by GetSendQuota queries targeting Amazon Simple Email Service.

    Unlike typical cloud attacks that rely on VPN services or TOR nodes, the vast majority of TruffleNet IP addresses showed no prior malicious reputation, suggesting purpose-built infrastructure dedicated exclusively to this campaign.

    Further analysis revealed that adversaries utilized compromised WordPress sites to obtain DKIM cryptographic keys, subsequently configuring AWS SES to send emails on their behalf.

    This sophisticated technique involved creating multiple email identities within SES using stolen authentication credentials, enabling attackers to impersonate legitimate organizations.

    The campaign culminated in targeted Business Email Compromise attacks against the oil and gas sector, with fraudsters sending invoices purporting to be from ZoomInfo and requesting $50,000 ACH payments.

    The fraudulent communications directed payment inquiries to typosquatted domains, demonstrating the attackers’ attention to detail in maintaining credibility throughout the social engineering process.

    Technical Infrastructure and Attack Methodology

    The TruffleNet infrastructure demonstrated sophisticated operational security through its tiered architecture design.

    Host-level analysis identified 10 hosting autonomous system numbers, with the majority mapped to US-based providers WS Telecom Inc. and Hivelocity LLC.

    Most hosts maintained open ports 5432 and 3389, though these were repurposed from their standard PostgreSQL and RDP assignments.

    The deployment of Portainer across numerous nodes provided attackers with a centralized management interface, effectively functioning as infrastructure-as-a-service for coordinating large-scale credential testing operations.

    Identity Compromise and BEC (Source – Fortinet)

    The attack progression involved multiple AWS API calls executed in a specific sequence. Following initial reconnaissance, attackers attempted privilege escalation by creating new IAM identities, though this effort failed in several instances.

    However, one compromised user account possessed sufficient privileges to interact directly with SES. The CreateEmailIdentity API request included stolen DKIM signing attributes from previously compromised domains, with the following technical implementation observed in FortiGuard Labs’ analysis:

    {"dkimSigningAttributes":{"domainSigningAttributesOrigin":"AWS_SES_US_EAST_1","domainSigningPrivateKey":"HIDDEN_DUE_TO_SECURITY_REASONS"},"emailIdentity":"cfp-impactaction[.]com"}

    This request parameter demonstrates how attackers weaponized legitimate AWS functionality by importing compromised cryptographic keys from external sources.

    Six email identities were ultimately established during the campaign, including domains such as cfp-impactaction[.]com, cndbenin[.]com, and novainways[.]com.

    Several of these domains shared hosting infrastructure in France and exhibited connections to other malicious activities, including XMRig cryptomining operations and the Coroxy trojan.

    The attackers executed their Business Email Compromise operation immediately following infrastructure preparation, sending vendor onboarding invoices with legitimate-appearing W-9 forms containing publicly available employer identification numbers to enhance credibility.

    FortiCNAPP’s composite alerting technology successfully detected the campaign by evaluating multiple behavioral indicators simultaneously, including anomalous cloud connections, suspicious automation activity, and offensive tool usage.

    The platform generated high-confidence alerts that correlated network anomalies with behavioral deviations, providing security teams with actionable intelligence to respond to the identity-driven threat effectively.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New TruffleNet BEC Campaign Leverages AWS SES Using Stolen Credentials to Compromise 800+ Hosts appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have flagged a new malicious extension in the Open VSX registry that harbors a remote access trojan called SleepyDuck. According to Secure Annex’s John Tuckner, the extension in question, juan-bianco.solidity-vlang (version 0.0.7), was first published on October 31, 2025, as a completely benign library that was subsequently updated to version 0.0.8 on November 1 to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers can exploit Anthropic’s Claude AI to steal sensitive user data. By leveraging the model’s newly added network capabilities in its Code Interpreter tool, attackers can use indirect prompt injection to extract private information, such as chat histories, and upload it directly to their own accounts.

    This revelation, detailed in Rehberger’s October 2025 blog post, underscores the growing risks as AI systems become increasingly connected to the outside world.

    According to Johann Rehberger, the flaw hinges on Claude’s default “Package managers only” setting, which permits network access to a limited list of approved domains, including api.anthropic.com.

    While intended to let Claude install software packages securely from sites like npm, PyPI, and GitHub, this whitelist opens a backdoor. Rehberger showed that malicious prompts hidden in documents or user inputs can trick the AI into executing code that accesses user data.

    Indirect Prompts Attack Chain

    Rehberger’s proof-of-concept attack begins with indirect prompt injection, where an adversary embeds harmful instructions in seemingly innocuous content, like a file the user asks Claude to analyze.

    Leveraging Claude’s recent “memory” feature, which lets the AI reference past conversations, the payload instructs the model to extract recent chat data and save it as a file in the Code Interpreter’s sandbox, specifically at /mnt/user-data/outputs/hello.md.

    Next, the exploit forces Claude to run Python code using the Anthropic SDK. This code sets the environment variable for the attacker’s API key and uploads the file via Claude’s Files API.

    Crucially, the upload targets the attacker’s account, not the victim’s, bypassing normal authentication. “This worked on the first try,” Rehberger noted, though Claude later grew wary of obvious API keys, requiring obfuscation with benign code like simple print statements to evade detection.

    A demo video and screenshots illustrate the process: An attacker views their empty console, the victim processes a tainted document, and moments later, the stolen file appears in the attacker’s dashboard up to 30MB per upload, with multiple uploads possible. This “AI kill chain” could extend to other allow-listed domains, amplifying the threat.

    Rehberger responsibly disclosed the issue to Anthropic on October 25, 2025, via HackerOne. Initially dismissed as a “model safety issue” and out of scope, Anthropic later acknowledged it as a valid vulnerability on October 30, citing a process error.

    The company’s documentation already warns of data exfiltration risks from network egress, advising users to monitor sessions closely and halt suspicious activity.

    Experts like Simon Willison highlight this as part of the “lethal trifecta” in AI security: powerful models, external access, and prompt-based control.

    For mitigation, Anthropic could enforce sandbox rules limiting API calls to the logged-in user’s account. Users should disable network access or whitelist domains sparingly, avoiding the false security of defaults.

    As AI tools like Claude integrate deeper into workflows, such exploits remind us that connectivity breeds danger. Without robust safeguards, what starts as helpful automation could become a hacker’s playground.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Can Manipulate Claude AI APIs with Indirect Prompts to Steal User Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In a recent setback for Windows administrators, Microsoft’s October 2025 security update addressing a critical vulnerability in Windows Server Update Services (WSUS) has inadvertently broken hotpatching functionality on a subset of Windows Server 2025 systems.

    The flaw, tracked as CVE-2025-59287, allows remote code execution in WSUS environments, posing significant risks to enterprise update infrastructures. Microsoft confirmed the issue on October 24, 2025, emphasizing that it affects only devices running the latest server edition.

    The problematic update was initially pushed to all Windows Server 2025 machines, bypassing enrollment status for Microsoft’s innovative Hotpatch feature.

    Hotpatching enables seamless security updates without reboots, a key selling point for reducing downtime in virtualized setups. However, a small number of Hotpatch-enrolled devices, primarily physical servers and virtual machines (VMs), received the update before Microsoft halted distribution.

    Now, the patch is restricted to non-Hotpatch systems, leaving enrolled users to navigate workarounds amid ongoing threats.

    This glitch highlights the complexities of rolling out zero-downtime updates in hybrid cloud environments, where WSUS serves as a central hub for patch management.

    Security experts warn that delaying fixes for CVE-2025-59287 could expose networks to exploitation, especially in sectors such as finance and healthcare that rely on uninterrupted server operations. Microsoft’s rapid response underscores the challenges of balancing speed and stability in patch cycles.

    Workarounds and Path Forward for Affected Systems

    For the limited devices that installed the faulty update, Microsoft advises patience. These machines are temporarily sidelined from the Hotpatch track, meaning they won’t receive November or December hotpatches.

    Instead, they’ll pull standard monthly security updates requiring restarts, ensuring compliance but increasing operational friction. Come January 2026, a planned baseline update (KB5066835) will realign them, with Hotpatch resuming in February 2026. Administrators should monitor update histories via Windows Update logs to confirm status.

    Devices that downloaded but haven’t installed the update can avoid disruption by navigating to Settings > Windows Update, pausing updates, then unpausing and rescanning. This triggers the corrected version, preserving Hotpatch eligibility.

    Hotpatch-enrolled systems untouched by the initial rollout will receive the WSUS fix through a layered approach. Starting October 24, 2025, they’ll get the security update KB5070893 on top of the October baseline (KB5066835).

    This combo delivers CVE-2025-59287 mitigation without derailing the Hotpatch schedule users stay on track for November and December releases. Notably, only WSUS-enabled machines face a post-install restart, minimizing broader impact.

    Microsoft urges immediate action and provides detailed guidance on its support site. As enterprises grapple with this, it serves as a reminder of the trade-offs in adopting rebootless patching amid evolving threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Patch for WSUS Vulnerability has Broken Hotpatching on Windows Server 2025 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • President Donald Trump’s 60-day window for military strikes on alleged Latin American drug boats has closed, according to the legal fine print of the War Powers Resolution. If the U.S. president cannot obtain congressional approval for military action after 60 days, that law says those actions must be terminated. The Pentagon said their first such strike occurred on September 2; White House officials formally notified Congress of the strikes on September 4, which makes today day 61. 

    And that’s why the White House reportedly now claims war powers restrictions do not apply to President Trump’s actions against these alleged drug traffickers. The New York Times and Washington Post both reported that new legal wrinkle over the weekend. 

    As of Sunday, the U.S. military claims to have conducted 15 of these strikes, which have killed 65 people and left three survivors. NBC News reminded readers Monday, “The administration has produced no evidence supporting its allegations about the boats, their passengers, the cargo or the number of people killed, injured or surviving.”

    But the White House now claims these strikes do not constitute “hostilities” as described in the War Powers Resolution. An anonymous White House official told the Post the Pentagon’s “operation comprises precise strikes conducted largely by unmanned aerial vehicles launched from naval vessels in international waters at distances too far away for the crews of the targeted vessels to endanger American personnel.” The Times calls this “an important development for the history of a law that presidents of both parties have chafed at over the past half century.” 

    “A similar situation arose in 2011, when [President] Obama directed the United States to participate in a NATO-led air war over Libya that ended up lasting more than 60 days,” Charlie Savage and Julian Barnes of the Times write. “Congress had not passed a spending bill for the operation, but, for policy reasons, Mr. Obama did not want to halt or scale back American participation before the war was over.” Yet “one [White House] faction came up with a theory that Mr. Obama had the authority to continue the military campaign without changes because American involvement fell short of 'hostilities.' Mr. Obama embraced that argument and kept going, weathering significant criticism.”

    If that White House position is accepted and unchallenged by the current Congress, the implications would be “significant,” argues former State Department counsel Brian Finacune. “First, the U.S. government can continue its killing spree at sea, notwithstanding the time limits imposed by the War Powers Resolution,” Finacune wrote Monday at Just Security. Second, “The administration’s theory places a broad swath of common U.S. military action—standoff strikes with little risk to U.S. forces—outside the scope of the War Powers Resolution and its restrictions. And the White House is doing so while it postures not only for further killing at sea, but also for possible military action against Venezuela.” And “Third, this legal theory could further complicate congressional efforts to rein in unauthorized military action by this and future presidents.”

    Finacune’s read: The White House’s latest “creative lawyering” in this case “is yet another legal abuse and arrogation of power by the executive. And it is a power grab in the service of killing people outside the law based solely on the President’s own say so,” he warns. His advice? “The legislative branch should reject the executive’s strained legal interpretation of the War Powers Resolution, including possibly in legislation. Congress should also continue efforts to halt these killings at sea and block an unlawful attack on Venezuela.” Read the rest, here

    Developing: The U.S. military is planning operations to send troops into Mexico to fight drug cartels, NBC News reported Monday, citing current and former U.S. officials. “The early stages of training for the potential mission, which would include ground operations inside Mexico, has already begun…But a deployment to Mexico is not imminent” because “a final decision has not been made,” three NBC reporters write. 

    As we discussed in a recent podcast episode on the topic, the troops would be expected to come from Joint Special Operations Command operating under Title 50 status with assistance from the CIA. According to currently-understood plans, “U.S. troops in Mexico would mainly use drone strikes to hit drug labs and cartel members and leaders,” which would “require operators to be on the ground to use them effectively and safely, the officials said.”

    Also: Pentagon chief Pete Hegseth has forbidden military officials to discuss the boat strikes with lawmakers without prior approval, CNN reported Sunday. But that’s just one of several topics the secretary won’t let officials discuss with Congress without approval. Others include the Golden Dome program, acquisition reform, “critical munitions,” and the National Defense Strategy. 

    But that’s not all. “Other topics include budget and reconciliation spending plans; critical minerals; Foreign Military Sales reform; AUKUS, a trilateral security partnership between Australia, the United Kingdom, and the United States; anomalous health incidents also known as ‘Havana Syndrome’; and Spectrum, which refers to the electromagnetic spectrum that underpins military operations and other key US government functions,” CNN’s Natasha Bertrand reports.  

    Congressional reax: “The new rules have put a large barrier between the military & Congress,” GOP Rep. Don Bacon wrote on social media this weekend. The “Pentagon says the change is very small. But I already see the impact with military members being afraid to communicate. This is another amateur move.”

    Reminder: Hegseth in February claimed on social media, “Transparency doesn't happen on its own, and this will be the most transparent administration ever.” Meanwhile, “Hegseth, whose tenure has been beleaguered by leaks, has taken a number of steps to more tigh[t]ly control information since earlier this year, including barring most engagements between DoD personnel and think tanks, reporters, or other outside events and conferences,” Bertrand writes. More, here

    Mapped: Visualize Trump’s possible war on Venezuela thanks to an informative multimedia presentation published Sunday by Reuters. The outlet “spoke to three U.S. military officials and three maritime experts who said the new construction in [the former Roosevelt Roads military base in Ceiba,] Puerto Rico and [the Henry E. Rohlsen Airport at St Croix in] the Virgin Islands pointed to preparations that could enable the U.S. military to carry out operations inside Venezuela.”

    Related reading: 


    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1783, the United States disbanded the Continental Army, one day after Gen. George Washington delivered his farewell to the troops.

    Around the Defense Department

    Hegseth visited the Korean DMZ before negotiations this week on the future of U.S. troops stationed in South Korea, Reuters reported Monday from Seoul. Those troop talks are slated for Tuesday as “Washington is considering making the role of the 28,500 U.S. troops in South Korea more flexible,” though it’s not clear yet exactly how that might play out. 

    Back stateside, a federal judge in Oregon paused Trump’s order to send National Guard troops to Portland until at least Friday. The ruling came down Sunday evening, “which essentially extends her earlier temporary restraining order blocking President Trump from using Guard troops to protect an Immigration and Customs Enforcement building in the city that has been the site of daily protests since early June,” the New York Times reports. 

    Notable: “The judge also said the protests outside the Portland ICE building did not amount to a rebellion,” Oregon Public Broadcasting reports. In her 16-page ruling, U.S. District Court Judge Karin Immergut “referenced several dictionary definitions and even cited prominent events from American history in the late 1700s, including the Whiskey Rebellion and Shays’ Rebellion, two events that saw bloodshed shortly after the nation’s founding.”

    By the way:Trump's National Guard deployments aren't random. They were planned years ago,” NPR reported Monday morning. 

    And Black Americans in Memphis say they’re being “racially profiled and harassed” by Trump’s police task force, ProPublica reported Monday. “Among those who have reported being harassed: a ride-share driver stopped for not wearing a seat belt despite having one on as she drove a passenger to the airport; a pastor pulled over for looking lost as she left a church gathering; and, in a case of mistaken identity, a 72-year-old man roused from bed and marched out of his apartment while clad in only his robe and underwear.”

    “If you’re not white, we’re just all going to be targeted,” one resident told ProPublica. 

    Additional reading: 

    Industry

    DOGE is leading the Pentagon’s overhaul of its drone program, Reuters reports, “including streamlining procurement, expand[ing] homegrown production, and acquir[ing] tens of thousands of cheap drones in the coming months, according to Pentagon officials and people with knowledge of the matter.” In June, Trump designated drones as a priority in an executive order; in July, Hegseth issued a memo saying that the Pentagon would approve the purchase of “hundreds” of drone-related products and otherwise boost drone development, manufacturing, and deployment.

    DOGE’s involvement had not previously been reported, Reuters writes, citing five people with knowledge of the matter, adding that Pentagon officials “did not immediately respond to a comment request.” Read on, here.

    Anduril's drone wingman makes first flight, following software delays. The California milestone followed the August flight of rival General Atomics’ prototype for the Air Force’s collaborative combat aircraft competition. Defense One’s Thomas Novelly has a bit more, here.

    Workers stick around longer when you boost wages and give them better-qualified co-workers, nation’s largest shipbuilder finds. In April, HII announced that it would attempt to boost workforce recruiting and retention by raising wages and moving away from hiring green workers. The effort, later funded in part by a portion of the $4 billion granted by Congress to boost U.S. naval shipbuilding in July, is paying off, CEO Chris Kastner said during HII’s third-quarter earnings call on Thursday. Defense One’s Lauren C. Williams reports, here.

    Additional reading: 

    Etc.

    Responding to apparent misinformation, Trump threatened to go to war with Nigeria in a social media post on Saturday. “If the Nigerian Government continues to allow the killing of Christians, the U.S.A. will immediately stop all aid and assistance to Nigeria, and may very well go into that now disgraced country, ‘guns-a-blazing,’ to completely wipe out the Islamic Terrorists who are committing these horrible atrocities,” the U.S. president wrote in the afternoon. 

    “I am hereby instructing our Department of War to prepare for possible action,” he posted, and added, “If we attack, it will be fast, vicious, and sweet, just like the terrorist thugs attack our CHERISHED Christians! WARNING: THE NIGERIAN GOVERNMENT BETTER MOVE FAST!”

    Context: “[R]ecent claims circulating among some U.S. right-wing circles” including West Virginia GOP Rep. Riley Moore “that as many as 100,000 Christians had been killed in Nigeria since 2009 are not supported by available data,” Reuters reports

    What’s really taking place: “Islamist insurgents such as Boko Haram and Islamic State West Africa Province have wrought havoc in [Nigeria] for more than 15 years, killing thousands of people, but their attacks have been largely confined to the northeast of the country, which is majority Muslim. While Christians have been killed, the vast majority of the victims have been Muslims,” the wire service explained Sunday. Indeed, researchers reviewed 1,923 attacks on civilians in Nigeria in 2025, but “the number of those targeting Christians because of their religion stood at 50,” according to the crisis-monitoring group ACLED

    Nigeria’s reax: “There is no Christian genocide,” replied Daniel Bwala, a top adviser to Nigerian President Bola Tinubu. “We don't take [Trump’s threat] literally, because we know Donald Trump thinks well of Nigeria.”

    Trump has threatened more than a half-dozen countries with military action since his second term began in January, including Canada, Panama, Denmark and Greenland, Venezuela, Afghanistan, Mexico, and now Nigeria. He has ordered actual strikes on Iran and Yemen.

    Related reading:Trump threat of military action in Nigeria prompts confusion and alarm,” the Washington Post reported Monday. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated phishing campaign has emerged, exploiting the trust placed in legitimate cloud hosting services.

    Threat actors are leveraging Cloudflare Pages and ZenDesk platforms to conduct large-scale credential theft operations targeting unsuspecting users.

    The campaign demonstrates a concerning trend where established infrastructure services become vectors for social engineering attacks.

    Security researchers have identified over 600 malicious domains registered under the *.pages[.]dev domain structure, representing a significant coordinated effort.

    These threat actors employ typosquatting techniques to impersonate customer support portals for well-known brands. By registering domains that closely resemble legitimate services, attackers create a convincing facade that lower users’ defenses before engagement.

    Arda Büyükkaya, a cyber threat intelligence analyst at EclecticIQ, identified and documented this ongoing phishing infrastructure after noting the suspicious pattern across multiple domains.

    The attack methodology combines social engineering with technical sophistication, revealing how adversaries continue evolving their techniques to circumvent traditional security awareness.

    The Infection and Social Engineering Mechanism

    The phishing pages themselves are generated using artificial intelligence, creating convincing but ultimately malicious content. Each page includes an embedded live chat interface staffed by human operators who engage directly with victims.

    These operators maintain the deception by requesting phone numbers and email addresses under the guise of providing technical support assistance.

    Once sufficient personal information is gathered, operators instruct victims to install Rescue, a legitimate remote monitoring tool that becomes dangerous when installed on compromised systems.

    This installation grants attackers full remote access to the victim’s device, enabling them to harvest sensitive data and account credentials at will.

    The threat actors also abuse Google Site Verification and Microsoft Bing Webmaster tokens for SSO poisoning, further expanding their attack surface.

    Their primary objective remains financially motivated account takeover and fraud, positioning this campaign as a serious threat to enterprise and individual users alike.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Beware of New Phishing Attack that Abuses Cloudflare and ZenDesk Pages to Steal Logins appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶