• A new malware variant dubbed “PDFly” is abusing a heavily modified PyInstaller stub to hide its Python bytecode, forcing analysts to reverse-engineer a custom decryption routine before any meaningful analysis can begin. A closely related sample, “PDFClick,” shows almost identical behavior, suggesting a small family of PyInstaller-based droppers that deliberately break standard tooling. Both samples […]

    The post PDFly Variant Uses Custom PyInstaller Tweaks to Obfuscate Payload, Thwarting Analysis appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Recent major cloud service outages have been hard to miss. High-profile incidents affecting providers such as AWS, Azure, and Cloudflare have disrupted large parts of the internet, taking down websites and services that many other systems depend on. The resulting ripple effects have halted applications and workflows that many organizations rely on every day. For consumers, these outages are

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ASUS has discontinued the File Shredder feature in its Business Manager software following the discovery of a critical security vulnerability, CVE-2025-13348. The company issued a security bulletin on February 2, 2026, addressing a flaw affecting ASUS Business Manager version 3.0.36.0 and earlier releases. Rather than patching the vulnerability through conventional updates, ASUS opted to remove […]

    The post ASUS Discontinues “File Shredder” Feature to Patch Critical Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Pentagon’s new science and innovation board, announced last week, merges the Defense Innovation Board with the Defense Science Board to “streamline” how the department addresses the hardest technological and scientific national security challenges. But it comes on the heels of cuts that could undermine future scientific and innovation progress for the Defense Department, creating new opportunities and new hurdles to long-standing Pentagon goals.

    Streamlining is a persistent target for the Pentagon. But it’s one that it has had trouble achieving in previous years, according to GAO reports, lawmakers, and military leaders across administrations. It is one reason why the so-called “valley of death,” as in the chasm between a cutting-edge research program and an actual weapon getting into the hands of soldiers, remains a common complaint—and one of the key reasons the Defense Innovation Board was created in the first place.

    The late former Defense Secretary Ash Carter established the Defense Innovation Board, a civilian body that has historically featured tech and finance leaders like Eric Schmidt, Michael Bloomberg, and Neil deGrasse Tyson, in 2016, to bring thought leadership from top business leaders into the Pentagon. The board produced a wide variety of key recommendations that the Pentagon later adopted, such as moving to large-scale enterprise cloud computing and adopting a long list of ethics principles for the development, testing, deployment, and operation of artificial intelligence across the military.

    The Defense Science Board, meanwhile, largely produced reports for Congress and military leadership on specific Defense Department issues, such as how to reform testing and evaluation and bringing more digital engineering into the department.

    The new Science, Technology and Innovation Board, or STIB, includes a large number of defense science experts in areas like next-generation autonomy, testing, advanced hypersonics, and acquisition, as well as private-sector experts in fields like advanced neural networks.

    The new board emerges at a time when the military is keen to integrate artificial intelligence into more of what it does, reach new research breakthroughs more rapidly, and quickly produce large numbers of cheap, highly autonomous drones.

    One former senior defense official said  the board (but really any science or innovation body advising the Pentagon) should look at “all aspects of AI, from energy requirements, ethics, and direction of research,” to “how to accelerate the fusing of the massive amounts of all-domain sensory data the department has to train multimodal AI for offensive and defensive operations.”

    However, the former senior official pointed out that the board is uniformly white and largely male. “It misses the mark as far as representation goes, thereby handicapping its credibility with the American public,” they said.

    Another question is whether the new board will conduct public meetings, as the Defense Innovation Board did, or meet in private, like the Defense Science Board. The STIB announcement makes no mention either way, and a Pentagon spokesperson did not respond to a request for comment Monday.

    Shrinking the defense science, research, oversight footprint

    The new board is the latest in a series of Pentagon moves to merge together offices or activities launched over the last decade and accelerate the adoption of AI, particularly dual-use AI from companies that also sell to the public.

    On January 12, the Pentagon announced a new strategy to accelerate the use of large-scale foundation models like Google’s Gemini. They simultaneously announced an “overhaul” to more closely align offices like the Chief Digital and Artificial Intelligence Office, the Strategic Capabilities Office, and the Defense Innovation Unit under the under secretary of defense for research and engineering.

    These moves align with what current and former military officials, government watchdogs, and lawmakers have long been urging Pentagon leadership to do: reform the way the Pentagon buys technology to be more like DIU. The reorganization of these offices and activities was taken by many observers across the political spectrum as a sign that Pentagon leadership had finally begun to do just that, and was on its way to busting down bureaucratic obstacles to buying ready-to-use commercial technology, especially software.

    But the new merger of the Defense Science Board with the innovation board also comes amid a large-scale scaling back in funding for basic sciences. According to the most recent version of the 2026 National Defense Authorization Act, the department would cut support for basic research at U.S. universities by nearly 5%.

    At the same time, the Pentagon is de-emphasizing, if not reconsidering, the ethical use of AI. The new AI acceleration strategy released in January does not even mention the AI ethics principles the Defense Innovation Board proposed, and the Pentagon adopted, back in 2020. Instead, it advises the Department of Defense (which refers to itself as the DoW) to “incorporate standard ‘any lawful use’ language into any DoW contract through which AI services are procured within 180 days.”

    The department’s ability to determine lawful use is also shrinking, at least at the highest levels, following the replacement of several top JAGs last February and the sidelining of other JAG officers when considering controversial moves, such as firing at unarmed boats or deploying the National Guard for immigration enforcement. The department has also significantly reduced its Office of Inspector General, which provides key oversight on issues like safety and policy effectiveness.

    All of that is causing confusion and disagreement with some of the very AI companies the Pentagon is courting. Researchers at Anthropic, for instance, are concerned the Defense Department might ask them to change or modify AI tools against company guidelines in order to fit whatever definition of “lawful use” the Pentagon is working with at the moment, according to reporting from Reuters.

    One current official said the public reporting on the disagreement between the department and Anthropic overstated the issue somewhat, and that the new policy simply says the Pentagon “should be the entity dictating lawful use and safeguards and not having companies specifying how products will be used within cases of lawful use. The conversation of who will write those safeguards is separate.”

    A former senior defense official who worked on areas like deployed artificial intelligence agreed that some of the concerns about the Pentagon’s new approach to AI safety were a tad panicky.

    However, they said, a larger issue is the testing and evaluation standards the Pentagon and the services use to field AI software. “As long as those standards remain high, the policy stuff surrounding them is window dressing… because terrible, unvetted software won't get scaled and fielded.”

    But the Pentagon has also been reducing the amount of money and staff dedicated to ensuring that testing and evaluation remains rigorous, essentially shrinking the office that oversees service testing by half last May. But the former official said that because the services themselves do the initial testing, and are far more committed to fielding safe AI that won’t harm service members than a Pentagon office would be, that reduction in and of itself doesn’t present a problem.

    Still, while any particular merger or reduction may not be a cause for alarm by itself, the totality of the shrinking could be. Might these cuts and mergers affect core areas the Pentagon depends on to set standards for things like deploying AI? That’s worth keeping track of, said the second former official.

    “If those standards decline, you have problems. The number of people you have doing AI safety, in particular, is potentially related to that, but not necessarily,” they said. The Pentagon leadership was right to cut the “waste and duplication in the [testing and evaluation] process,” they said. “And I also think they are probably implementing it in the dumbest way possible.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft is making a significant move to strengthen Windows security by phasing out NTLM (New Technology LAN Manager). This legacy authentication protocol has been part of Windows for over 30 years. The company plans to disable NTLM by default in upcoming Windows releases, replacing it with more secure Kerberos-based alternatives. NTLM is an old authentication […]

    The post Microsoft Takes Major Security Step by Disabling NTLM Authentication by Default appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated social engineering campaign targeting Windows users across the UK, using fake event invitations to silently install ScreenConnect a legitimate remote access tool that attackers have weaponized to gain complete system control. The attack chain begins with deceptive simplicity: victims receive emails that look like personal invitations from friends or colleagues. These messages are […]

    The post Fake Party Invites Lure Victims Into Installing Malicious Remote Access Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Congress didn’t give the White House all the munitions funding it asked for, but defense executives say it’s enough—along with the administration’s goading and global instability—to persuade them to pour more of their own funds into boosting production. 

    In a last-minute request, the Trump administration asked lawmakers to bump munitions spending spread out over multiple years by more than $28.8 billion. Congress, which last summer allocated an extra $25 billion for munitions and related supply-chain support via the reconciliation bill, added just under $2 billion over the president’s request for a select set of critical munitions in the compromise spending bill that still needs to be approved by Congress and the president.

    But that is “in sync with what we were expecting,” said Rylan Harris, who leads business development for Northrop Grumman’s armament systems business unit. “We've been getting the demand signals from the customer set long before now, whether that's the amount of munitions that have been expended around the world, or just the stock of ammunition. We've been seeing those demand signals already, which has helped us focus a lot of our investments in increasing capacity.” 

    And the administration could try to get more munitions funding through supplemental funding or another budget reconciliation bill to produce the quantities it needs, said Tom Karako, the director of the Center for Strategic and Internationals Studies’ missile defense project. 

    “The short answer is, something else has to happen…And so that's either going to need to be a supplemental [funding bill], or need to be a reconciliation 2.0, or it would need to be a reprogramming, or moving things around within the reconciliation money, for instance,” Karako said. “Those are basically the options, and the latter two are less desirable because somebody's ox is going to get gored. And so what the right thing to do is to probably do a [munitions] supplemental. But, you know, that's going to require some legislative activity, and that's a challenge.”

    More is more 

    The administration’s affinity for non-traditional budgeting hasn’t gone unnoticed. 

    “Traditionally, there's been annual appropriations. The administration is striving to modify that. They've already got authorization for a range of effectors or missiles through Congress—part of the process, not the complete process. But it's already been introduced, and it's advancing on a seven-year basis for, I think, it’s four or five specific missile systems, including THAAD and PAC-3,” Lockheed Martin CEO James Taiclet said during the company's earnings call last week.

    Thursday, Lockheed Martin said it would quadruple its THAAD missile interceptor production—and share profits with the government if certain metrics are met. That move comes after the company announced it would triple its production of Patriot missiles ahead of a White House executive order seemingly designed to push defense companies to produce weapons faster and fund development themselves. 

    “There's incentives in both the Patriot and the THAAD framework agreements for us to outperform the objectives. And so what we have agreed upon is a profit sharing above a certain robust level, I'll call it, where we start to share some of the increased profits with the U.S. government by plowing some of those increased profits back into something like I just talked about, which is additional spare parts or it’s additional equipment or tooling in the factory,” Taiclet said. “And so there's a sort of reinvestment mechanism in a profit-sharing vehicle, if you will, for us to even better support these programs going forward on behalf of and with the government.”

    The 2026 spending bill includes multiyear procurement authority, or money to buy weapons through fiscal year 2032 at a lower cost, for the Advanced Medium-Range Air-to-Air Missile, Joint Air-to-Surface Standoff Missile, Long Range Anti-Ship Missile, Patriot Advanced Capability-3, Standard Missile-3 Block 1B, Standard Missile-6, THAAD, and Tomahawk, according to a summary of the bill. 

    There’s also $6.3 billion for critical munitions, which includes $1.9 billion more than requested for increased production over multiple years, and $500 million for solid rocket motor industrial base expansion, workforce development, and supplier qualification. 

    “Funding included in this Act is in addition to nearly $2.1 billion of mandatory funds currently apportioned from [budget reconciliation]. The agreement also makes significant investments toward solid rocket motor production, a key component of critical munitions,” appropriators wrote in a joint explanatory statement for the compromise spending bill. 

    Treading lightly

    These changes come at a time when defense industry leaders feel like they must walk a thin line to keep the U.S. government and shareholders happy. 

    President Donald Trump singled out RTX in critical social media posts earlier this year that were focused on how the company plans to bolster its production and manufacturing while also increasing revenue. CEO Christopher Calio said the company expects to do up to $93 billion in sales for 2026.  

    “We understand that our products are critical to national security and security of our partners and allies. And I can tell you, across the organization, we absolutely feel the responsibility and urgency to deliver more and to deliver it faster. And, candidly, we understand the frustration,” Calio said during the company’s earnings call. 

    RTX increased munitions output 20 percent for key programs last year, including GEM-T, AMRAAM and Coyote. And Calio wants to “significantly increase output again” in 2026 for those programs and others, such as SM-6 and Tomahawk.

    The government pays us “to manage our suppliers and deliver,” he said. “Because to take production to the levels that the department needs, you're just going to need to continue to invest in that industrial base and bring new suppliers into the fold.”

    Get ready, stay ready

    A persistent challenge for munitions production has been maintaining a steady need. 

    “Munitons have have typically been sort of a swing space, a bill payer, frankly. The year-over-year demand can swing up to 50 percent,” said Jerry McGinn, who leads CSIS’ industrial base policy center. 

    But atypical funding arrangements pushed by the second Trump administration and fashioned by a Republican-led Congress could help. 

    “One of the commitments coming out of Ukraine, and with the current administration too, was to really kind of fix munitions demand,” McGinn said. “So there's a clear commitment to invest. It is not as clean as it was, because you’ve got this ‘One Big, Beautiful Bill’ and, potentially, another one.”

    And new agreements, such as the one Lockheed inked with the Pentagon, can guide the internal company investments the administration is demanding. 

    “We like to see these kinds of defense budgets, because we know where we can sort of guide our investments,” Jim Leary, executive director of business development at Boeing, told Defense One. “A lot of the investments that we're putting in are to continue to increase capability and capacity in existing munitions and missiles.”

    That means putting more money into manufacturing—facilities and the workforce. 

    For example, in 2025, Boeing opened a factory extension for its PAC-3 missile seeker facility in Huntsville, Ala., to increase production by nearly a third.

    And L3Harris Technologies  recently reached a $1 billion deal with the U.S. government to increase solid rocket motor production—which it began working on last year. 

    “Construction began last year to expand capacity on large solid rocket motors and certain tactical rocket motor programs,”L3Harris Technologies CEO Christopher Kubasik said during Thursday’s earnings call. “The government invests now, allowing us to further increase capacity for critical interceptor programs such as THAAD, PAC-3 and standard missile. There is no waiting for contracts or acquisition funding. The investment gives us the confidence to build today while the long-term contracts are being negotiated and finalized. Capacity is now the most important capability.”

    Higher budgets could also translate into quicker deliveries, said L3Harris CFO Kenneth Bedingfield. 

    “If we do see a significantly increased defense budget in FY '27, our expectation certainly is that as we look at upside to growth, we would expect L3Harris to be able to deliver on that quicker, given our kind of agile nature and our ability to crank up production, given some of the investments that we've made in the business, whether that’s in space satellites related to missile defense for America, whether that's in communications or even as we scale the solid rocket motors,” he said. 

    A $1.5 trillion defense budget would be “unlike any we've seen before,” Northrop Grumman CEO Kathy Warden said during the company’s earnings call. “So it does have us thinking very differently…But at the same time, there is more for us to do, and we are focused on our engineering and operations talent, helping to design the right solutions so that we can be competitive.”

    Still, amid the talk of big defense budgets and ramping up production, there’s something unsaid: “concern that a big war is coming,” CSIS’ Karako suspects. 

    “This effort began before the 12-day war and the expenditure of a scary amount of THAADs and other munitions,” Karako said. “The reality is sinking in … I would say the Chinese may be planning a big war, and we are going to need a heck of a lot more than we have, even ignoring the fact we just expended a ton in defense of Israel. It's kind of scary, the discrepancy between what we have and what we need. And so that's why I think you're seeing this urgency, and I think it's entirely appropriate.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Russia-linked state-sponsored threat actor known as APT28 (aka UAC-0001) has been attributed to attacks exploiting a newly disclosed security flaw in Microsoft Office as part of a campaign codenamed Operation Neusploit. Zscaler ThreatLabz said it observed the hacking group weaponizing the shortcoming on January 29, 2026, in attacks targeting users in Ukraine, Slovakia, and Romania, three

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The HoneyMyte APT group, also known as Mustang Panda and Bronze President, continues expanding its cyber-espionage operations across Asia and Europe, with Southeast Asia being the most heavily targeted region. Recent investigations reveal that the group has significantly enhanced its malware arsenal during 2025, introducing new capabilities to the CoolClient backdoor and deploying multiple browser […]

    The post HoneyMyte Hacker Group Expands CoolClient Malware With New Advanced Toolset appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical XML External Entity (XXE) vulnerability has been disclosed in the Syncope identity management console.

    The flaw could allow administrators to expose sensitive user data and compromise session security inadvertently.

    The vulnerability, tracked as CVE-2026-23795, affects multiple versions of the platform and requires immediate patching.

    The improper restriction of XML External Entity references in Apache Syncope Console creates a pathway for XXE attacks when administrators create or edit Keymaster parameters.

    An attacker with sufficient administrative entitlements can craft malicious XML payloads to trigger unintended data exposure.

    CVE IDVulnerabilityCVSS ScoreAffected ComponentAffected VersionsAttack VectorImpact
    CVE-2026-23795XML External Entity (XXE) Injection6.5Apache Syncope Console3.0-3.0.15, 4.0-4.0.3NetworkData Exposure, Session Hijacking

    This attack vector bypasses normal security restrictions by exploiting the way the application processes XML input without proper validation and sanitization.

    XXE vulnerabilities are among the most dangerous attack vectors in identity management systems because they operate at the application layer and can provide direct access to sensitive configuration data, user credentials, and authentication tokens.

    In the context of Syncope’s role as a user identity and access management platform, the implications extend beyond individual sessions to potentially compromise the entire authentication infrastructure.

    The vulnerability impacts Apache Syncope versions spanning two major release branches:

    ComponentAffected VersionsFixed Version
    Syncope Client IdRepo Console (3.x)3.0 through 3.0.153.0.16
    Syncope Client IdRepo Console (4.x)4.0 through 4.0.34.0.4

    Organizations running these versions should prioritize upgrading immediately.

    The vulnerability requires administrator-level access to exploit, limiting direct external attack surface but creating significant insider threat risks.

    Attack Methodology

    The attack requires an administrator account with permissions to modify Keymaster parameters through the Syncope Console interface.

    Once authenticated, the attacker constructs specially formatted XML containing external entity declarations pointing to sensitive system files or internal network resources.

    When the application processes this malicious XML, it resolves the external entities and exposes their contents to the attacker.

    This technique enables attackers to read arbitrary files from the server, access internal network resources, and potentially extract user session tokens or authentication credentials.

    The issue is rated moderate because an attacker needs admin access first, but the possible impact is still large.

    Apache recommends immediate upgrades to version 3.0.16 for users on the 3.x branch and version 4.0.4 for those on the 4.x branch.

    Organizations unable to patch immediately should restrict administrative console access to trusted personnel and implement additional network monitoring to detect suspicious XML parsing activity.

    Organizations managing identity infrastructure should review their deployment status and prioritize this patch in their security update schedule to prevent potential session hijacking and data exposure incidents.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Apache Syncope Vulnerability Let Attackers Hijack User Sessions appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶