• Microsoft has officially confirmed that its August 2025 security update is causing significant performance problems for users of NDI (Network Device Interface) technology.

    Content creators, broadcasters, and IT professionals who installed the update are reporting severe lag, stuttering, and choppy audio/video when streaming between PCs, effectively disrupting production workflows that rely on the popular IP video protocol.

    The issue arises from the cumulative update KB5063878, released on August 12, 2025, for Windows 11 and Windows 10. According to Microsoft’s updated release health dashboard entry on August 21, the company has acknowledged the problem, which affects systems running OS Build 26100.4946 and other recent versions.

    The performance degradation is most prominent in streaming applications like OBS (Open Broadcast Software) and the official NDI Tools suite. Users have noted that the problem is especially triggered when using “Display Capture” on the source machine to send its screen output to another computer on the network.

    Critically, the issue persists even on networks with low bandwidth utilization, indicating the root cause is not network congestion but rather a processing or protocol-handling flaw introduced by the Windows update.

    In a statement on its health dashboard, Microsoft detailed the symptoms: “Severe stuttering, lag, and choppy audio/video might occur when using NDI (Network Device Interface) for streaming or transferring audio/video feeds between PCs after installing the August 2025 Windows security update.”

    The affected platforms include:

    • Client: Windows 11, version 24H2; Windows 10, version 22H2; Windows 10, version 21H2
    • Server: No Windows Server versions are currently listed as affected.

    Mitigations

    While Microsoft investigates a permanent solution, a temporary workaround has been identified and recommended by NDI. The issue appears to be related to NDI’s default transport protocol, RUDP (Reliable User Datagram Protocol), which is designed to offer a balance between the speed of UDP and the reliability of TCP.

    The KB5063878 update seems to interfere with how Windows handles these RUDP packets.

    To mitigate the problem, users are advised to manually change the NDI Receive Mode on the receiving client to use either TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) instead of the default setting.

    NDI has published guidance on its support site, titled “Traffic Drops After Windows Update,” which provides step-by-step instructions for making this change within the NDI Tools and other compatible applications.

    Microsoft has stated, “We are investigating this issue and will provide more information when it is available.” This confirmation suggests that a fix will likely be delivered through a future cumulative update or a possible out-of-band (OOB) patch.

    Until then, professionals who rely on NDI for live streaming, remote production, or corporate AV presentations should either apply the TCP/UDP workaround or consider pausing the deployment of the KB5063878 update in their production environments to avoid service disruption.

    Bugs Following August Update

    1. Windows 11 24H2 Security Update Causes SSD/HDD Failures and Potential Data Corruption
    2. Microsoft Releases Emergency Updates to Fix Windows Reset and Recovery Error

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Microsoft Confirms August 2025 Update Causes Severe Lag in Windows 11 24H2, and Windows 10 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers are calling attention to multiple campaigns that leverage known security vulnerabilities and expose Redis servers to various malicious activities, including leveraging the compromised devices as IoT botnets, residential proxies, or cryptocurrency mining infrastructure. The first set of attacks entails the exploitation of CVE-2024-36401 (CVSS score: 9.8), a critical

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has announced significant restrictions on email sending capabilities for organizations using default onmicrosoft.com domains, implementing a throttling system that limits external email delivery to 100 recipients per organization every 24 hours. 

    The policy change, announced through the Exchange Team Blog, aims to prevent spam abuse while encouraging organizations to migrate to custom domains for improved email deliverability and brand representation.

    Key Takeaways
    1. Microsoft limits onmicrosoft.com domains to 100 external emails daily.
    2. Targets cybercriminals exploiting new tenants, protecting shared domain reputation.
    3. Organizations must purchase custom domains, rollout phases through June 2026.

    Email Throttling Imposed

    Microsoft’s new policy specifically targets MOERA (Microsoft Online Email Routing Address) domains, which are automatically assigned when organizations create new Microsoft 365 tenants. 

    These default domains, such as contoso.onmicrosoft.com, have become attractive targets for cybercriminals who exploit newly created tenants to send spam bursts before detection systems can intervene.

    The throttling mechanism will trigger NDR (Non-Delivery Report) messages with error code 550 5.7.236 when organizations exceed the 100 external recipient limit within the rolling 24-hour window. 

    Internal messaging remains unaffected, and the restriction applies only to external recipients after any distribution list expansions are calculated. 

    This technical implementation ensures that legitimate testing and internal communications continue uninterrupted while preventing large-scale spam operations.

    The shared reputation model of onmicrosoft domains has created significant deliverability challenges for legitimate users. 

    Because all organizations share variations of the same domain namespace, malicious activity from one tenant can negatively impact email deliverability for all other users on the platform.

    Phased Rollout Timeline 

    Microsoft has established a structured rollout schedule beginning with trial tenants on October 15, 2025, and progressing through different organization sizes based on Exchange seat counts. 

    The implementation will conclude with tenants having over 10,001 seats by June 1, 2026. Organizations with fewer than three seats will face restrictions starting December 1, 2025, followed by progressively larger organizations through the first half of 2026.

    Technical migration involves several critical steps including purchasing custom domains through authorized registrars, configuring DNS validation, and updating primary SMTP addresses on all mailboxes. 

    Organizations must also address specific scenarios where MOERA domains might be inadvertently used, including Sender Rewriting Scheme (SRS) configurations, Microsoft Bookings notifications, and various Microsoft 365 service integrations.

    Administrators can analyze current MOERA email traffic using the Message Trace feature in Exchange Admin Center with wildcard sender addresses to identify potential impacts before the restrictions take effect. 

    Organizations are strongly advised to begin migration planning immediately, as the throttling limits will significantly impact any business operations currently dependent on MOERA domains for external communications.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Microsoft to Limit Onmicrosoft Domain Usage for Sending Emails appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A method to silently exfiltrate Windows secrets and credentials, evading detection from most Endpoint Detection and Response (EDR) solutions.

    This technique allows attackers who have gained an initial foothold on a Windows machine to harvest credentials for lateral movement across a network without triggering common security alerts.

    How Windows Manages Secrets

    The Local Security Authority (LSA), running within the lsass.exe process, is the core Windows component responsible for managing sensitive information. The LSA uses two in-memory databases that correspond to on-disk registry hives:

    • SAM database: Manages user, group, and alias objects and corresponds to the SAM registry hive. It stores user credentials, but there is no direct API to retrieve them in plaintext.
    • Security database: Manages policy, trusted-domain, account, and secret objects, corresponding to the SECURITY registry hive. This database holds LSA secrets, such as cached domain credentials and machine keys.

    While these databases can be managed through RPC interfaces (MS-SAMR and MS-LSAD), they do not offer a simple way to decrypt stored secrets. To access the credentials and secrets, direct interaction with the SAM and SECURITY registry hives is necessary.

    These hives are protected by Discretionary Access Control Lists (DACLs) that restrict access to accounts with SYSTEM privileges. The sensitive data within them, such as user credentials and machine keys, is encrypted.

    Decrypting this information requires additional values from the SYSTEM hive to reconstruct the decryption key.

    Attackers commonly use various local and remote techniques to harvest credentials, but modern security tools detect most well-known methods.

    Interacting with the lsass.exe process memory, for example, is a high-risk activity that is heavily monitored by EDRs and Windows Defender, often resulting in immediate alerts.

    EDR solutions primarily rely on kernel-mode callback routines to monitor system activity. By using functions like CmRegisterCallbackEx, an EDR’s driver can register to be notified by the Windows kernel of specific events, such as registry access.

    When a process attempts to read a sensitive key, like HKLM\SAM or HKLM\SECURITY, the kernel notifies the EDR, which can then block the operation or raise an alert. To manage performance, EDRs typically monitor a select list of high-risk API calls and registry paths, rather than every single system operation.

    A New Method for Silent Exfiltration

    According to researcher Sud0Ru, who uncovered this technique, a new, two-pronged approach allows attackers to bypass these defenses by leveraging lesser-known Windows internals.

    This method avoids creating on-disk backups of registry hives and does not require SYSTEM-level privileges, operating within the context of a local administrator.

    Exfiltrate Windows Secrets and Credentials
    secret data Exfiltration (Source : Sud0Ru)
    1. Bypassing Access Controls with NtOpenKeyEx: The first step involves using the undocumented native API NtOpenKeyEx. By calling this function with the REG_OPTION_BACKUP_RESTORE flag and enabling the SeBackupPrivilege (available to administrators), an attacker can bypass the standard ACL checks on protected registry keys. This provides direct read access to the SAM and SECURITY hives without needing to be the SYSTEM user.
    2. Evading Detection with RegQueryMultipleValuesW: Once access is gained, the next challenge is to read the data without triggering EDR alerts. Most EDRs monitor common API calls used for reading registry values, such as RegQueryValueExW. This new technique instead uses RegQueryMultipleValuesW, an API that retrieves data for a list of value names associated with a registry key. Because this function is used less frequently, many EDR vendors have not included it in their monitoring rules. By using this API to read a single value at a time, attackers can extract the encrypted secrets from the SAM and SECURITY hives without being detected.

    This combined strategy allows the entire operation to occur in memory, leaving no on-disk artifacts and avoiding API calls that would typically flag malicious activity.

    The result is a silent and effective method for harvesting credentials. While decrypting the exfiltrated data is a separate process, this collection technique demonstrates that even mature defensive systems can be circumvented by leveraging overlooked, legitimate functionalities within the operating system itself.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Hackers Can Exfiltrate Windows Secrets and Credentials Silently by Evading EDR Detection appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • By now, you’ve heard the hype. Agentic AI; self-directed and goal-oriented. Supposedly, the next big thing in security automation. If you’re working in a Security Operations Center (SOC), it might sound like déjà vu.  Agentic AI brings autonomous, decision-making security agents that learn, adapt, and act across environments, while SOAR focuses on orchestrating and automating predefined […]

    The post Agentic AI vs SOAR: What’s the Real Difference? appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Virtual Private Servers (VPS) have long served as versatile tools for developers and businesses, offering dedicated resources on shared physical hardware with enhanced control and scalability. However, threat actors are increasingly exploiting these platforms to orchestrate stealthy attacks against Software-as-a-Service (SaaS) environments. Rising Abuse of VPS Infrastructure By leveraging VPS providers, attackers can mimic legitimate […]

    The post Hackers Hijack VPS Servers to Breach Software-as-a-Service Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • GoDaddy Security researchers have unveiled a detailed analysis of Help TDS, a sophisticated Traffic Direction System operational since at least 2017, which exploits compromised websites to funnel traffic toward malicious scams. This operation supplies affiliates with PHP code templates that are injected into legitimate sites, primarily WordPress installations, to redirect visitors to fraudulent pages mimicking […]

    The post Help TDS Hacks Legitimate Websites, Using PHP Templates to Display Fake Microsoft Security Alerts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated China-nexus threat actor designated MURKY PANDA has emerged as a significant cybersecurity concern, conducting extensive cyberespionage operations against government, technology, academic, legal, and professional services entities across North America since late 2024.

    This advanced persistent threat group demonstrates exceptional capabilities in cloud environment exploitation and trusted-relationship compromises, marking a concerning evolution in state-sponsored cyber activities.

    The adversary has established itself as a formidable force through its ability to rapidly weaponize both n-day and zero-day vulnerabilities, frequently achieving initial access by exploiting internet-facing appliances.

    MURKY PANDA’s operations are characterized by their focus on intelligence collection objectives, with documented cases of email exfiltration and sensitive document theft from high-profile targets.

    CrowdStrike researchers identified MURKY PANDA’s activity as particularly notable for its cloud-conscious approach and advanced operational security measures.

    The threat group’s sophisticated tradecraft includes modifying timestamps and systematically deleting indicators of compromise to evade detection and complicate attribution efforts.

    Their operations align with broader China-nexus targeted intrusion activities tracked by industry sources as Silk Typhoon.

    The group’s arsenal includes deployment of web shells such as Neo-reGeorg, commonly utilized by Chinese adversaries, and access to a low-prevalence custom malware family designated CloudedHope.

    Additionally, MURKY PANDA has demonstrated proficiency in leveraging compromised small office/home office devices as operational infrastructure, mirroring tactics employed by other Chinese threat actors like VANGUARD PANDA.

    Trusted-Relationship Cloud Exploitation Techniques

    MURKY PANDA’s most distinctive capability lies in conducting trusted-relationship compromises within cloud environments, representing a relatively rare and undermonitored attack vector.

    The group has successfully exploited zero-day vulnerabilities to compromise software-as-a-service providers, subsequently leveraging their access to move laterally to downstream customers.

    In documented cases, the adversary obtained application registration secrets from compromised SaaS providers using Entra ID for customer access management.

    By authenticating as service principals, MURKY PANDA gained unauthorized access to downstream customer environments, enabling email access and data exfiltration.

    This sophisticated technique demonstrates their deep understanding of cloud architecture and identity management systems.

    The threat actor has also targeted Microsoft cloud solution providers, exploiting delegated administrative privileges to achieve Global Administrator access across multiple downstream customer tenants, establishing persistent backdoors through newly created user accounts and modified service principal configurations.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Chinese MURKY PANDA Attacking Government and Professional Services Entities appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals are increasingly leveraging Virtual Private Server (VPS) infrastructure to orchestrate sophisticated attacks against Software-as-a-Service (SaaS) platforms, exploiting the anonymity and clean reputation of these hosting services to bypass traditional security controls.

    A coordinated campaign identified in early 2025 demonstrated how threat actors systematically abuse VPS providers like Hyonix, Host Universal, Mevspace, and Hivelocity to compromise enterprise email accounts and establish persistent access to organizational systems.

    The attack methodology centers on session hijacking techniques, where attackers utilize compromised credentials to log into SaaS accounts from VPS-hosted infrastructure.

    Timeline of activity for Case 1 – Unusual VPS logins and deletion of phishing emails (Source – Darktrace)

    This approach allows malicious actors to circumvent geolocation-based security measures by appearing as legitimate traffic from trusted hosting providers.

    The clean IP reputation associated with newly provisioned VPS instances enables attackers to evade conventional blacklist-based detection systems, making their activities blend seamlessly with normal business operations.

    Timeline of activity for Case 2 – Coordinated inbox rule creation and outbound phishing campaign (Source – Darktrace)

    Recent investigations spanning March through May 2025 revealed a surge in anomalous login activities originating from Hyonix’s Autonomous System Number (ASN AS931), with threat actors demonstrating remarkable consistency in their attack patterns across multiple victim environments.

    Darktrace analysts identified suspicious activities including improbable travel scenarios where users appeared to access accounts simultaneously from distant geographical locations, indicating clear signs of credential compromise and session hijacking.

    The campaign’s sophistication extends beyond initial access, incorporating Multi-Factor Authentication (MFA) bypass techniques through token manipulation and the systematic creation of obfuscated email rules designed to maintain stealth.

    Attackers established persistence by creating inbox rules with minimal or generic names to avoid detection during routine security audits, automatically redirecting or deleting incoming emails to conceal their malicious activities.

    Advanced Persistence and Evasion Mechanisms

    The threat actors demonstrated advanced understanding of email security systems by implementing targeted inbox rule manipulation techniques that operate below the threshold of typical security monitoring.

    The malicious rules specifically targeted emails containing sensitive organizational information, including communications from VIP personnel and financial documents.

    Technical analysis revealed the use of MITRE ATT&CK technique T1098.002 (Exchange Email Rules) combined with T1071.001 (Web Protocols) for command and control operations.

    Key indicators of compromise include IP addresses 38.240.42[.]160 and 194.49.68[.]244 associated with Hyonix infrastructure, alongside 91.223.3[.]147 from Mevspace Poland.

    The attackers employed domain fluxing techniques for infrastructure resilience while maintaining operational security through carefully timed activities that coincided with legitimate user sessions, effectively masking their presence within normal business communications.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Hackers Abuse VPS Servers To Compromise Software-as-a-service (SaaS) Accounts appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Inside the Pentagon plan to Americanize drone warfare. Years of talk about rapidly scaling up drone forces have produced interesting prototypes and lively experiments with relatively small numbers of drones—but no clear sense of how the United States would conduct the kind of sustained drone warfare pioneered in Ukraine. A combination of recent developments, tech breakthroughs, and policy changes suggests that could soon change.

    The T-REX event in Indiana brought together drone makers, AI, data, and communications software companies to show off not just how well new autonomous drones can hit targets, but also next steps for mass, coordinated drone warfare. Defense One’s Patrick Tucker was there, and pulls the strings together in this report.

    The Army is equipping its Black Hawks to launch drones. Helo maker Sikorsky will make software and hardware upgrades under a $43 million contract that will also give the venerable rotorcraft a “more powerful engine, airframe enhancements and a main fuel upgrade,” reports Defense One’s Meghann Myers.

    Black Hawk crew will be able to launch and operate drones in flight, part of a larger push toward so-called “launched effects,” one of the cornerstones of the Army Transformation Initiative.

    But how long will the UH-60 be central to the Army’s operations? Myers wraps up the signs of a decline in importance, here.

    Developing: The U.S. military is “preparing target sets” for strikes against alleged drug cartels in Mexico, independent investigative journalist Ken Klippenstein reported Thursday. 

    “The strikes were discussed at a July meeting at NORTHCOM HQ in Colorado Springs led by Colby Jenkins, Acting Assistant Secretary of Defense for Special Operations,” he writes. “Within days, Gen. Gregory M. Guillot, commander of NORTHCOM, hosted the two highest ranking Mexican military officials: Gen. Ricardo Trevilla Trejo, Secretary of National Defense, and Adm. Raymundo Pedro Morales Ángeles, Secretary of the Navy.”

    Targets allegedly include the Sinaloa Cartel and the Jalisco New Generation Cartel. “Direct attacks could also involve air and drone strikes,” Klippenstein writes. 

    It’s unclear just yet how Mexican President Claudia Sheinbaum would respond. She’s said recently she’s flatly opposed to U.S. troops on the ground inside Mexico. However, “Trump, military sources also tell me, is focused on results, willing to ignore law, rules, and even policy recommendations in his zeal to have ‘progress’ towards his goals with regard to national security,” Klippenstein says. More, here

    • ICYMI: We discussed strikes against cartels in a recent podcast conversation with special operations author Kevin Maurer. Find that discussion, here

    Also: Drug traffickers in Colombia allegedly used a drone to shoot down a Black Hawk helicopter carrying a dozen police Thursday morning, the Wall Street Journal reports. All 12 passengers perished in the attack. 

    Notable uptick: “Since the first attack by drone in Colombia in April of last year, the military here says there have been 301 strikes with unmanned aerial vehicles,” the Journal’s Juan Forero reports from Bogota. “At least 22 soldiers and police officers have died in the attacks.”

    The U.S. military says it killed an ISIS official during a raid in northern Syria on Tuesday. Neither militant was named, but Central Command officials described them as “a senior ISIS member and key financier who planned attacks in Syria and Iraq.” 

    The Middle East Institute’s Charles Lister says the man killed was Saleh Nouman, who was allegedly spotted by Syrian forces “in al-Dana, but he fled to Atmeh—where a joint US airborne raid was planned.” Tiny bit more from CENTCOM, here

    Additional reading: 

    Insider POV: Allvin’s surprise exit signals a pivot for the Air Force, not Hegseth pressure, sources say. On Monday, Allvin announced his plans to retire after serving just two years as the service’s highest-ranking officer, typically a four-year job. No reason was given in the Air Force press release that contained his announcement. Allvin’s abrupt retirement wasn’t driven by Defense Secretary Pete Hegseth, but by growing frustration with the service’s priorities, multiple people familiar with the decision told Defense One’s Audrey Decker. 


    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1844, U.S. Navy officer George Francis De Long was born in New York City. In the fall of 1879, De Long led an expedition searching for a way to the North Pole via the Bering Strait. Nearly two years into the quest, his ship was crushed in an ice pack in the East Siberian Sea. De Long, 37, died of starvation about four months later.  

    Deportation nation

    The Pentagon is offering its civilians a chance to work for ICE. “Volunteers will serve in critical support roles up to 180 days at an [Immigration and Customs Enforcement] or [Customs and Border Protection] facility,” the online alert reads. The offer extends to civilians of “any grade,” and notes, “Travel, lodging, and per diem may be reimbursed by the receiving agency.” 

    Work includes: “Data Entry” and “Operational Planning Support,” as well as various processing tasks such as helping agents with the “physical flow of detained illegal aliens from arrest to deportation,” and other logistical considerations “to improve efficiencies and the effectiveness of operations.”

    There are no education requirements, and applicants must have worked at “their current agency for more than 90 days and are no longer in a probationary period.” 

    Note: “Conditions at some locations could be austere,” and “Deployment locations are based on need and are not negotiable,” according to the bulletin. More, here

    New: A judge has ordered Florida to stop expanding its “Alligator Alcatraz” detention center because “state officials never sufficiently explained why the facility needed to be in the middle of the Florida Everglades,” the Associated Press reports. “What is apparent, however, is that in their haste to construct the detention camp, the State did not consider alternative locations,” District Judge Kathleen Williams of the Southern District of Florida said in her 82-page order. 

    “Every Florida governor, every Florida senator, and countless local and national political figures, including presidents, have publicly pledged their unequivocal support for the restoration, conservation, and protection of the Everglades,” Williams wrote. “This Order does nothing more than uphold the basic requirements of legislation designed to fulfill those promises.” More, here

    Related: AP also takes readers “Inside the facility where ICE is training recruits to take on Trump's deportation goals” at the Federal Law Enforcement Training Center in Brunswick, Georgia.

    Developing: ICE wants to spend millions of dollars on “custom, gold-detailed vehicle wraps” (see here) for its SUVs patrolling the nation’s capital, the Washington Post reported Wednesday. Critics call it excessive and unnecessary. More, here

    Big picture consideration: Republican lawmakers’ “Big Beautiful Bill” funds an unprecedented surge in federal law enforcement. But is that even possible? Eric Katz of GovExec tallied up many of the planned personnel changes and stacked those against past pledges to boost hiring. Consulting history, he found that “Even when some agencies previously received authorization and funding to hire, they failed to do so in significant numbers.”

    “Potential bottlenecks include background checks and training capacity,” Katz writes. On the other hand, “Early returns show some positive signs for the administration. ICE recently boasted it has received 100,000 job applications. CBP has seen a surge in applicants. The rate at which applicants are onboarded, however, has barely moved.” Continue reading, here

    One way to add more federal agents: Lower recruiting standards, as the F.B.I. has done in a change that is “alarming agents,” according to the New York Times, reporting Thursday. 

    Trump 2.0

    ODNI to shrink further under new reorganization plan. The Office of the Director of National Intelligence, which has already shrunk its workforce by about one-quarter this year, will lose another 200 workers in coming weeks under an “ODNI 2.0” restructuring, the U.S. spy chief said Wednesday.

    The office had slightly less than 2,000 employees at the start of the Trump administration and now has around 1,500. The additional cut would bring the year's total reduction to about 35 percent. In a press release this week, Director of National Intelligence Tulsi Gabbard claimed the changes would “reduce ODNI by over 40%” by Sept. 30 and “save taxpayers over $700 million per year.” More, here

    Also: On July 20, Gabbard ordered U.S. intelligence agencies to stop sharing information with the so-called Five Eyes allies, which includes the U.K., Canada, Australia and New Zealand, CBS News reported Thursday. “The memo also limited distribution of material regarding peace talks to within the agencies that created or originated the intelligence,” Jim LaPorta writes for CBS. 

    Reminder: President Donald Trump and his Republican allies have long criticized the U.S. intelligence community, particularly after it concluded that Russia interfered in the 2016 presidential election on behalf of Trump. And just last month, Gabbard issued a report that she said showed a contradiction between the IC's internal assessments and public statements about Russian interference. But in fact, the public statement matched the internal assessments.

    Related commentary: Former CIA Director Bill Burns wrote “A Letter to America’s Discarded Public Servants” this week in The Atlantic. In short, “You all deserved better” than to be downsized under the current administration.

    One week ago, Trump met with Russia’s Vladimir Putin to find an end to Putin’s Ukraine invasion. Seven days later, nothing has changed. But Trump’s effort stalled out in a mere four days, according to the Wall Street Journal, reporting Friday. 

    What’s going on: “The failure to reach a diplomatic breakthrough stems in part from sharp differences in negotiating style between Putin and Trump,” the Journal writes. “The U.S. president, former aides said, has an improvisational approach that is heavily dependent on personal relationships.” However, “Putin is playing a longer game, calculating that Russia can gradually improve its position on the battlefield while the diplomats talk, even if it is at the expense of thousands of casualties on both sides.”

    Expert reax: “We are where we were two weeks ago, we are where we were six months ago,” said Kurt Volker, who was Trump’s representative for Ukraine negotiations during his first term. “There’s never going to be an agreement. Putin will never agree.” 

    Read more: 

    Lastly this week: “The Trump White House has launched an official TikTok account, despite [Congress’] TikTok sale-or-ban law and another looming deadline,” CNN’s Brian Stelter reported this week. 

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶