• Microsoft reported a DNS-related outage on October 29, 2025, affecting access to key services, including Microsoft Azure and Microsoft 365.

    The issue surfaced around 9:37 PM GMT+5:30, leaving users unable to reach the Microsoft 365 admin center and experiencing widespread delays in other applications.

    Businesses relying on these platforms for email, collaboration tools, and cloud computing faced operational hurdles, highlighting the fragility of global DNS infrastructure.

    The outage stemmed from connectivity problems in portions of Microsoft’s internal infrastructure. Initial reports indicated that DNS resolution failures prevented proper routing of traffic, impacting authentication and service endpoints.

    Administrators attempting to manage Office 365 tenants encountered error messages, while end-users saw sluggish performance in apps like Outlook, Teams, and SharePoint.

    Azure Virtual Machines and storage services also reported intermittent unavailability, potentially stalling development workflows and data processing tasks.

    Microsoft DNS Outage

    The disruption spanned multiple regions, with complaints flooding social media and tech forums from North America, Europe, and Asia. Small enterprises and large corporations alike voiced frustrations, as the outage coincided with end-of-month reporting deadlines for many.

    Cybersecurity experts noted that while no data breaches were reported, the event underscored vulnerabilities in dependency chains where a single DNS hiccup can cascade across interconnected services.

    Microsoft’s status page confirmed the scope included admin portals and core productivity tools, but spared some ancillary features like OneDrive file syncing in isolated cases.

    Microsoft’s engineering teams swiftly identified the root cause as unhealthy network and hosting infrastructure. By 9:51 PM GMT+5:30, they began unblocking affected systems and redistributing traffic to mitigate the issue.

    A subsequent update at 9:58 PM detailed a deeper review of infrastructure health, followed by rerouting to alternate healthy paths announced at 10:06 PM.

    As of 10:37 PM IST, recovery efforts continued, with Microsoft promising full restoration soon. The company emphasized that this was an isolated internal issue, not a cyberattack, and advised users to monitor the Azure status page for real-time updates.

    This incident adds to a string of cloud reliability challenges in 2025, prompting calls for enhanced redundancy in DNS systems. While downtime appears limited to under two hours so far, it serves as a reminder of the critical role DNS plays in modern cloud computing.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft DNS Outage Disrupts Azure and Microsoft 365 Services Worldwide appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A groundbreaking security vulnerability has emerged that fundamentally challenges the integrity of modern trusted execution environments across Intel and AMD server platforms.

    Researchers from Georgia Tech, Purdue University, and van Schaik LLC have unveiled TEE.fail, a sophisticated attack methodology that exploits weaknesses in DDR5 memory bus interposition to extract sensitive cryptographic keys from supposedly secure environments.

    This discovery represents the first successful demonstration of memory bus interposition attacks on DDR5-based systems, affecting Intel SGX, TDX, and AMD SEV-SNP implementations running on the latest server hardware.

    The attack leverages a critical shift in trusted execution environment design, where manufacturers moved from client-oriented hardware with robust integrity protections to server-grade implementations using deterministic AES-XTS memory encryption.

    Unlike earlier SGX implementations that utilized Merkle tree-based integrity verification and replay protections, current server TEEs prioritize performance and scalability over security guarantees.

    This trade-off enables support for terabytes of protected memory while reducing latency, but introduces vulnerabilities that TEE.fail exploits through physical memory bus monitoring.

    TEE.fail researchers noted that the attack can be executed for under $1,000 using readily available hobbyist equipment from secondhand markets.

    The research team demonstrated successful key extraction from machines maintaining Intel’s fully trusted “UpToDate” attestation status, highlighting that even systems meeting the highest security certifications remain vulnerable to this attack vector.

    Probe isolation networks, DDR5 RDIMM interposer and logic analyzer connecting pods (Source – Tee.fail)

    The implications extend beyond theoretical vulnerabilities, as the researchers successfully extracted provisioning certification keys (PCK) from production systems and used them to forge arbitrary SGX and TDX attestations.

    Memory Bus Interposition Technique

    The attack methodology centers on constructing a DDR5 memory interposition probe using components sourced from electronic equipment resellers.

    The researchers developed a custom interposer by modifying DDR5 RDIMM riser boards and incorporating probe isolation networks salvaged from decommissioned Keysight test equipment.

    The isolation network, consisting of carefully matched resistors, capacitors, and inductors, prevents electrical interference with the target system while enabling memory bus traffic observation.

    // Example of deterministic encryption verification
    void ecall_experiment() {
        memset(global_memory, 0x00, burst_size);
        uncached_read(global_memory);
        wait_for_logic_analyzer_collection();
    
        memset(global_memory, 0xFF, burst_size);
        uncached_read(global_memory);
        wait_for_logic_analyzer_collection();
    
        memset(global_memory, 0x00, burst_size);
        uncached_read(global_memory);
        wait_for_logic_analyzer_collection();
    }

    The attack exploits Intel’s use of deterministic AES-XTS encryption combined with precise control over enclave execution timing.

    By implementing controlled-channel attacks to pause enclave execution at specific points and utilizing cache thrashing techniques to force memory accesses, researchers achieved synchronized data collection with their logic analyzer setup.

    The deterministic nature of the encryption enables correlation between observed ciphertexts and known plaintext values, creating a direct pathway to cryptographic key recovery through ECDSA nonce extraction during signing operations performed by Intel’s Provisioning Certification Enclave.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New TEE.fail Attack Breaks Trusted Environments to Exfiltrate Secrets from Intel and AMD DDR5 Environments appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Tel Aviv, Israel, October 29th, 2025, CyberNewsWire

    Sweet Security Brings Runtime-CNAPP Power to Windows

    Sweet Security, a leader in Runtime Cloud and AI security solutions, today announced an extension of its Runtime CNAPP sensor to include Windows environments.

    With this launch, organizations can secure Windows workloads and applications in the cloud.

    The new capability brings the same deep visibility, real-time detection, risk prioritization, and automated investigation that power Sweet’s Runtime CNAPP for Linux to one of the most complex and widely used operating systems in the enterprise cloud.

    Protecting cloud workloads running on the Windows operating system has long been a challenge due to the complexity and the wide range of attack vectors that adversaries can exploit.

    Many existing solutions rely on an EDR agent that’s been repurposed for the cloud, but was ultimately designed for totally different attack scenarios than the ones present in the cloud. 

    Sweet’s Windows sensor was developed specifically for the cloud using Rust, which allows for minimal resource footprint.

    Sweet’s Windows sensor covers all the usual attack vectors, such as DLL injection, registry manipulation, PowerShell scripting, etc., in addition to covering application-level requests and responses (Layer 7 data), peering into applications’ behavior.

    Like all of Sweet’s runtime signals, the Windows sensor relies on Sweet’s renowned behavioral baselining technology, which allows it to detect not just known attack techniques or binary signatures, but also the abuse of legitimate tools for malicious purposes.

    The signals are also cross-correlated with cloud audit logs and cloud identities (CDR and ITDR) for maximum context and observability.

    In a recent customer evaluation, Sweet’s Windows sensor identified a credential-dumping attempt within seconds. The sensor correlated PowerShell execution, registry export, and file creation anomalies that traditional sensors failed to detect.

    From detection to full investigation, the entire process took under two minutes, demonstrating how Sweet’s behavioral and AI-powered detection capabilities accelerate response times and reduce investigation noise.

    With Sweet’s Windows runtime sensor, customers now have a clear view of activity across all workloads. They are now able to detect and address potential threats faster and with greater confidence, protecting critical workloads and maintaining business continuity.

    With the extension to Windows, Sweet Security now leverages its patented LLM-powered correlation and investigation, behavioral baseline, and L7 capabilities to provide full-stack protection for the cloud with its runtime CNAPP, including:

    • Cloud Application Detection and Response (CADR) 
    • Cloud Security Posture Management (CSPM)
    • Kubernetes Security Posture Management (KSPM)
    • Cloud Infrastructure Entitlements Management (CIEM) 
    • Compliance & Governance 
    • Vulnerability Management 
    • CI/CD Pipeline Hardening 
    • Identities Security (ITDR)
    • API Security 
    • Dynamic Application Security Testing (DAST)
    • Data Security (DSPM)

    “This launch marks a major step forward for the entire cloud security industry,” said Orel Ben Ishay, co-founder and VP of R&D, Sweet Security.

    “Windows has historically been a blind spot for runtime protection. By bringing the same depth of behavioral insight, AI-powered detection, and real-time investigation that we deliver for Linux to Windows environments, we are eliminating one of the most significant visibility gaps in cloud security. Detection and full investigation can now take less than two minutes, providing teams with actionable insights faster than ever. This is a foundational step toward our vision of universal runtime protection across all cloud workloads.”

    With this launch, Sweet Security continues to redefine runtime-native CNAPP, helping organizations detect and stop sophisticated attacks before they impact critical cloud workloads.

    For more information on Sweet’s Windows sensor or Runtime CNAPP, users can book a demo today or contact their customer support representative. 

    About Sweet Security

    Sweet Security is redefining enterprise cloud protection.

    As the leading provider of Runtime CNAPP solutions and a pioneer in AI Security, Sweet unifies runtime context with advanced AI intelligence to protect the modern enterprise across applications, workloads, and infrastructure.

    Its platform delivers real-time detection and response, vulnerability and posture management, identity threat protection, and API security—powered by patent-pending, LLM-driven detection, reducing alert noise to just 0.04%.

    By bridging cloud and AI security, Sweet enables organizations to accelerate innovation, reduce operational risk, and achieve industry-leading MTTR times.

    Privately funded, Sweet is backed by Evolution Equity Partners, Munich Re Ventures, Glilot Capital Partners, CyberArk Ventures, and an elite group of angel investors. For more information, users can visit sweet.security.

    Contact

    Chloe Amante

    Montner Tech PR

    camante@montner.com

    The post Sweet Security Brings Runtime-CNAPP Power to Windows appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Tel Aviv, Israel, October 29th, 2025, CyberNewsWire Sweet Security Brings Runtime-CNAPP Power to Windows Sweet Security, a leader in Runtime Cloud and AI security solutions, today announced an extension of its Runtime CNAPP sensor to include Windows environments. With this launch, organizations can secure Windows workloads and applications in the cloud. The new capability brings […]

    The post Sweet Security Brings Runtime-CNAPP Power to Windows appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Amazon Web Services encountered significant operational challenges in its US-EAST-1 region on October 28, 2025, with elevated latencies affecting EC2 instance launches and cascading issues across container orchestration services.

    The disruption, which began earlier in the day, impacted multiple AWS offerings reliant on Elastic Container Service (ECS), highlighting ongoing vulnerabilities in the cloud giant’s densely interconnected infrastructure.

    Customers reported delays and failures in launching virtual machines and tasks, underscoring the region’s critical role in global operations.​

    The incident originated in the use1-az2 Availability Zone around midday PDT, where EC2 instance launches faced prolonged delays due to internal networking and resource provisioning hiccups.

    AWS quickly notified affected users via the Personal Health Dashboard, but the problem soon extended to ECS, causing elevated failure rates for task launches on both EC2-backed and Fargate serverless containers.

    A subset of customers in US-EAST-1 experienced container instances disconnecting unexpectedly, leading to halted tasks and disrupted workflows.​

    Beyond core compute, the outage rippled into analytics and data processing tools like EMR Serverless, which relies on ECS warm pools for rapid job execution.

    Jobs in EMR faced execution delays or outright failures as unhealthy clusters persisted in impacted cells. Other hit services included Elastic Kubernetes Service (EKS) for Fargate pod launches, AWS Glue for ETL operations, and Managed Workflows for Apache Airflow (MWAA), where environments stalled in unhealthy states.

    App Runner, DataSync, CodeBuild, and AWS Batch also saw increased error rates, though existing EC2 instances remained operational.​

    ECS’s cellular architecture, which distributes clusters across regional cells, amplified the scope; clusters assigned to affected cells saw impacts across all availability zones.

    AWS identified the root issues in a small number of these cells but withheld specifics on the underlying cause, reminiscent of prior dependency failures in the same region, according to the status page.

    Recovery Timeline

    AWS initiated throttles on mutating API calls in use1-az2 to stabilize the system, advising retries for “request limit exceeded” errors. By 3:36 PM PDT, EC2 launches normalized, but ECS recovery lagged, with no immediate customer-visible improvements.

    Progress accelerated by 5:31 PM, as AWS refreshed EMR warm pools and observed Glue error rate reductions, estimating full resolution in 2-3 hours.​

    At 6:50 PM, ECS task launches showed positive signs, prompting recommendations for customers to recreate impacted clusters with new identifiers or update MWAA environments without config changes.

    Throttles continued in three ECS cells, but the EMR Serverless warm pools were nearly finished. By 8:08 PM, EMR was fully refreshed, and ECS successes increased, with an estimated time of arrival (ETA) of 1 to 2 hours.

    A significant recovery hit at 8:54 PM, and by 9:52 PM, two cells had fully recovered, lifting their throttles, while the third lagged.​

    The issue was entirely resolved at 10:43 PM PDT, restoring normal operations across all services. AWS confirmed no lingering impacts, though some backlogs might cause minor delays.​

    This episode, following a major US-EAST-1 outage on October 20, exposes persistent fragility from internal service interdependencies. While not as widespread as the earlier DynamoDB-triggered event, it disrupted workflows for developers and enterprises in the busiest AWS region.

    Experts note that such incidents, though contained, erode trust in multi-region strategies without robust failover. AWS urged diversified cluster placements and proactive monitoring to mitigate future risks.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post AWS US-EAST-1 Region Experiences Delays in EC2 Instance Deployments appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical cross-site scripting (XSS) vulnerability has been discovered in the popular LiteSpeed Cache plugin for WordPress, affecting millions of websites worldwide.

    The vulnerability, tracked as CVE-2025-12450, poses a significant risk to site visitors and administrators alike.

    The LiteSpeed Cache plugin is one of the most widely used performance optimization tools in the WordPress ecosystem, with over 7 million active installations.

    The plugin helps websites load faster by caching content and optimizing server responses. However, the newly discovered flaw undermines this security by allowing attackers to inject malicious scripts into web pages.

    Understanding the Vulnerability

    The vulnerability stems from insufficient input sanitization and output escaping in the plugin’s URL handling. This means the plugin fails to properly clean user-supplied data before displaying it on web pages.

    Attackers can exploit this weakness by crafting specially designed links and tricking users into clicking them.

    When a user clicks a malicious link, arbitrary JavaScript code executes in their browser, potentially stealing sensitive information, session cookies, or performing unauthorized actions on their behalf.

    The reflected XSS attack requires user interaction, making it less severe than stored XSS variants, but still dangerous. Attackers typically distribute these malicious links through email, social media, or compromised websites.

    Users who click on these links while logged into their WordPress sites become vulnerable to account hijacking or data theft.

    The vulnerability uncovered by Nicholas Giemsa of Trustwave affects all versions of LiteSpeed Cache up to and including version 7.5.0.1. The security team has already released a patch in version 7.6, which implements proper input sanitization and output escaping mechanisms.

    PropertyDetails
    CVE IDCVE-2025-12450
    CVSS Score6.1 (Medium)
    Vulnerability TypeImproper Neutralization of Input During Web Page Generation (Cross-site Scripting)
    Affected VersionsUp to 7.5.0.1

    WordPress site administrators should immediately update their plugins to version 7.6 or newer to close this security gap.

    The CVSS score of 6.1 (Medium severity) reflects the vulnerability’s potential impact. While not classified as critical, the widespread use of this plugin means millions of websites could be at risk if administrators delay applying the patch.

    Website administrators using the LiteSpeed Cache plugin should prioritize updating to version 7.6 immediately through the WordPress plugin dashboard.

    Additionally, they should monitor their sites for suspicious activity and consider implementing Web Application Firewalls (WAF) to add an extra layer of protection against XSS attacks.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post WordPress Plugin Vulnerability Exposes 7 Million Sites to XSS Attack appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new open-source tool called HikvisionExploiter has emerged, designed to automate attacks on vulnerable Hikvision IP cameras.

    Released on GitHub in mid-2024 but gaining renewed attention amid 2025’s surge in camera exploits, this Python-based utility targets unauthenticated endpoints in cameras running outdated firmware, such as version 3.1.3.150324.

    Developed for researchers and red teamers, it streamlines reconnaissance and exploitation, highlighting how easily exposed devices can be compromised for surveillance hijacking or credential theft.

    HikvisionExploiter performs a series of automated checks, starting with verifying access to the /onvif-http/snapshot endpoint to capture live images without authentication.

    It then retrieves and decrypts configuration files using AES and XOR methods, extracting usernames, privilege levels, and other sensitive data from XML outputs.

    The toolkit supports multithreaded scanning of thousands of targets listed in a simple targets.txt file, logging results in timestamped, color-coded folders for easy analysis.

    Advanced features include remote command execution via command injection flaws and an interactive shell for deeper access, making it a comprehensive weapon for testing network defenses.

    Installation requires Python 3.6+, libraries like requests and pycrypto, and optional FFmpeg for compiling snapshots into videos.

    Users can integrate it with tools like Nuclei for broader vulnerability detection across exposed cameras found via Shodan searches for the specific firmware string.

    The Core Vulnerability: CVE-2021-36260

    At the heart of the toolkit is CVE-2021-36260, a critical command injection flaw in Hikvision’s web server that allows unauthenticated attackers to execute arbitrary OS commands.

    Discovered in 2021, the vulnerability stems from inadequate input validation in endpoints such as/SDK/webLanguage, enabling remote code execution with high privileges.

    It affects numerous Hikvision camera models, particularly in the DS-2CD and DS-2DF series, running firmware versions prior to the vendor’s patches.

    CVE IDAffected ProductsCVSS 3.1 ScoreSeverityDescriptionExploit Prerequisites
    CVE-2021-36260DS-2CD2021G1-I(W), DS-2CD2023G2-I(U), DS-2CD2026G2-IU/SL, DS-2CD2027G2-L(U), and over 100 other DS-2CD/DS-2DF models (firmware < V5.5.0 build 210702)9.8CriticalCommand injection via insufficient validation in web server endpoints, allowing arbitrary command execution. ​Network access to exposed web interface; no authentication required.​

    This flaw has been actively exploited since 2021, and CISA has added it to its Known Exploited Vulnerabilities catalog due to real-world attacks.

    In 2025, researchers noted novel abuse techniques, such as using the “mount” command to drop malware on compromised devices.

    With thousands of Hikvision cameras still exposed online, attackers can steal snapshots, user data, or pivot to network breaches, fueling ransomware or DDoS operations.

    Security experts urge immediate firmware updates to at least V5.7.0 or later, network segmentation, and disabling unused ports.

    For organizations, regular scans with tools like this ethically can identify exposures, but widespread unpatched deployments demand urgent action to prevent surveillance sabotage.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hikvision Exploiter – An Automated Exploitation Toolkit Targeting Hikvision IP Cameras appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers are calling attention to a spike in automated attacks targeting PHP servers, IoT devices, and cloud gateways by various botnets such as Mirai, Gafgyt, and Mozi. “These automated campaigns exploit known CVE vulnerabilities and cloud misconfigurations to gain control over exposed systems and expand botnet networks,” the Qualys Threat Research Unit (TRU) said in a report

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. military left another survivor after destroying four more boats off the Latin American coast Monday, Pentagon chief Pete Hegseth announced Tuesday on social media in a 28-second video of the fiery attacks. 

    Three U.S. strikes targeted the boats, which Hegseth said were “operated by Designated Terrorist Organizations (DTO) trafficking narcotics in the Eastern Pacific,” though he did not provide supporting evidence. “Eight male narco-terrorists were aboard the vessels during the first strike. Four male narco-terrorists were aboard the vessel during the second strike. Three male narco-terrorists were aboard the vessel during the third strike,” the defense secretary said on Twitter. 

    “Regarding the survivor,” Hegseth said, U.S. military officials from Southern Command “immediately initiated Search and Rescue (SAR) standard protocols; Mexican SAR authorities accepted the case and assumed responsibility for coordinating the rescue.” 

    So far, the U.S. has attacked at least 13 boats, killing at least 57 people near Latin America since September 1. And with Hegseth’s order to send the USS Gerald R. Ford out of the Mediterranean Sea and toward Venezuela means the U.S. is about to be in the “fairly unusual position of having only a single aircraft carrier deployed and none in the waters off both Europe and the Middle East,” the Associated Press reported Wednesday. 

    New: NDAs at the Pentagon for Trump’s war on drug boats. “U.S. military officials involved with President Donald Trump's expanding operations in Latin America have been asked to sign non-disclosure agreements,” which is “highly unusual, given that U.S. military officials are already required to shield national security secrets from public view,” Reuters reported Tuesday. 

    Notable legal context for U.S. troops and civilians involved in the boat strikes: “Any military officials involved in the clearly legally controversial Venezuelan boat strikes must negotiate their twin duties of following a superior order and not following a patently illegal order,” like killing civilians who may not in fact be drug smugglers or terrorists, writes former Pentagon counsel Jack Goldsmith. 

    However, the Justice Department’s Office of Legal Counsel is sitting on a classified, unpublished memo that amounts to a “golden shield” of immunity, as Charlie Savage of the New York Times reported Friday. That memo effectively “immunizes the officer (and everyone else) who relies on it from subsequent punishment,” Goldsmith writes. 

    “And then, of course, there is the president’s pardon power, the after-action and more powerful equivalent of the before-action OLC golden shield…I expect Trump to issue hundreds and possibly thousands of preemptive pardons to everyone in his administration who may conceivably be subject to future investigation or prosecution,” Goldsmith reminds his readers. The result would seem to be the unrestrained executive Trump himself described when he said six years ago, “I have an Article II, where I have the right to do whatever I want as president.”

    Related reading:Irreconcilable Presidential Determinations: On Tren de Aragua and the Venezuelan Government,” which comes from more recent former Pentagon counsel Ryan Goodman along with Michael Schmitt and Anna Jimenez, writing Wednesday in Just Security

    In other legal concerns: “Two Illinois National Guard members told CBS News they would refuse to obey federal orders to deploy in Chicago as part of President Trump's controversial immigration enforcement mission,” CBS reported Tuesday. 

    “[I]t's really hard to be a soldier right now…we have somebody in power who's actively dismantling our rights—free speech, due process, freedom of the press,” one of the soldiers said. “I signed up to defend the American people and protect the Constitution.”

    “It's a slow normalization of using the military in American cities,” the soldier said. “Today it's Chicago. Tomorrow it could be somewhere else…Crime is down. This is not about safety—it's about control."

    Related:Appeals court will reconsider decision that allowed Trump to deploy National Guard troops to Portland,” CNN reported Tuesday. Oregon Public Broadcasting has similar coverage, here

    Coverage continues below…


    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1929, “Black Tuesday” marked the start of America’s Great Depression.

    President Trump made at least 11 false claims while speaking to U.S. troops stationed in Japan, CNN’s Daniel Dale reported in an abbreviated fact check on Tuesday. “This is not a comprehensive list of the falsehoods in the speech.”Misinformed topics included the 2020 election, grocery prices, inflation, and a cluster of inaccuracies regarding former President Biden. 

    From Capitol Hill: Senators challenge Hegseth’s bottleneck on communications with Congress. Two senators raised concerns on Tuesday about a new Pentagon policy—first reported last week by Breaking Defense—that could bar defense personnel and military commanders from communicating with lawmakers without prior approval, Defense One’s Lauren C. Williams reported from a hearing to consider nominees for several senior Defense Department roles. 

    “I'm concerned about the October 15 memo from the secretary, which basically throttles communication between people working at the Pentagon and Congress, including this committee. And I hope that's something to discuss and consider,” said Sen. Angus King, I-Maine, the ranking member on the Senate Armed Services Committee’s strategic forces panel.

    Sen. Roger Wicker, R-Miss., who chairs the committee, concurred. “It has been suggested that that memo was misconstrued, and it may need to be clarified. So, thank you for bringing that up,” Wicker said.

    About the document: It says that “unauthorized engagements” with lawmakers could “undermine Department-wide priorities critical to achieving our legislative objectives” and heighten tensions between the Pentagon and Capitol Hill. Republican and Democratic lawmakers have lambasted the policy change, saying the move could ultimately stymie the Pentagon’s legislative goals. More, here

    Related expert reax: “Reduced information flow from DoD could result in more confusion regarding the DoD’s plans and may weigh on the contractors’ abilities to attract capital for investment,” said analyst Byron Callan, writing (PDF) Tuesday.

    Developing: The Pentagon is trying to fire allegedly underperforming civilian personnel with “speed and conviction,” according to a Sept. 30 memo (PDF), The Hill and the Washington Post reported Tuesday. “Employees targeted for firing now have just seven days to challenge unfavorable review,” The Hill writes. 

    On Friday, the Navy launched a review of Marines’ and sailors’ personal social media posts, Task & Purpose reported Tuesday. Officials will be looking for “social media activity that is misaligned with the [Navy’s] current social media guidance,” Navy Secretary John Phelan said in a message to the force Friday. 

    For what it’s worth: “Phelan’s message comes as elections are scheduled throughout the country for next week.” More, here

    Additional reading: 

    Industry

    General Dynamics CEO warns of government shutdown effects. General Dynamics boasted nearly $12.91 billion in revenue in the third quarter of 2025 as well as increased submarine production, according to the company’s earnings call Friday. But gains were tempered by worries about the potential effects of an extended government shutdown, Defense One’s Williams reported Tuesday. 

    “On a company-wide basis, we see annual revenue of around $52 billion and margins of around 10.3 percent,” CEO Phebe Novakovic said of the company’s outlook for the rest of the year. But, she added, “Let me remind you that we’re in the midst of a government shutdown with no end in sight. The longer it lasts, the more it will impact us, particularly the shorter cycle businesses. So forecasts in this environment are difficult at best, and less reliable than one would hope.”

    Should the shutdown extend into next year, she said, “that increases the likelihood that it’ll have additional impacts on particular lines of business that begin to run out of funding.

    About GD’s portfolio: Shipbuilding saw about $4.1 billion in revenue growth in the third quarter, up by about $497 million from the same quarter last year, with “increased throughput” in construction of the Columbia-class and Virginia-class submarines, Novakovic said. The firm also highlighted steady build progress for the first Columbia-class submarine, saying they expect all major modules to be delivered to the Electric Boat facility in Groton, Conn. Read more, here

    Commentary: “Don’t give up the shipyards,” argues Hunter Stires, Project Director of the U.S. Naval Institute’s Maritime Counterinsurgency Project and Maritime Strategist to the 78th Secretary of the Navy Carlos Del Toro, writing Tuesday in Defense One.

    And from last week, Trump Pushes for New Classes of Navy Warships,” the Wall Street Journal reported Friday. 

    Lastly, Boeing Defense workers’ strike is nearing the three-month mark after they rejected Boeing’s offer over the weekend, Reuters reported Monday. 

    At issue: “IAM leaders have pressed the planemaker for higher retirement plan contributions and a ratification bonus closer to the $12,000 that Boeing gave to union members on strike last year in the company's commercial airplane division in the Pacific Northwest.” 

    Background: About 3,200 St. Louis-area workers have been on strike since August 4, which has contributed to delays in sending F-15EX fighters to the Air Force. Read more, here

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have flagged a new security issue in agentic web browsers like OpenAI ChatGPT Atlas that exposes underlying artificial intelligence (AI) models to context poisoning attacks. In the attack devised by AI security company SPLX, a bad actor can set up websites that serve different content to browsers and AI crawlers run by ChatGPT and Perplexity. The technique has been

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶