• Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft’s most-dire “critical” rating, and the company warns that attackers are already exploiting one of the bugs fixed today.

    January’s Microsoft zero-day flaw — CVE-2026-20805 — is brought to us by a flaw in the Desktop Window Manager (DWM), a key component of Windows that organizes windows on a user’s screen. Kev Breen, senior director of cyber threat research at Immersive, said despite awarding CVE-2026-20805 a middling CVSS score of 5.5, Microsoft has confirmed its active exploitation in the wild, indicating that threat actors are already leveraging this flaw against organizations.

    Breen said vulnerabilities of this kind are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits.

    “By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack,” Breen said. “Microsoft has not disclosed which additional components may be involved in such an exploit chain, significantly limiting defenders’ ability to proactively threat hunt for related activity. As a result, rapid patching currently remains the only effective mitigation.”

    Chris Goettl, vice president of product management at Ivanti, observed that CVE-2026-20805 affects all currently supported and extended security update supported versions of the Windows OS. Goettl said it would be a mistake to dismiss the severity of this flaw based on its “Important” rating and relatively low CVSS score.

    “A risk-based prioritization methodology warrants treating this vulnerability as a higher severity than the vendor rating or CVSS score assigned,” he said.

    Among the critical flaws patched this month are two Microsoft Office remote code execution bugs (CVE-2026-20952 and CVE-2026-20953) that can be triggered just by viewing a booby-trapped message in the Preview Pane.

    Our October 2025 Patch Tuesday “End of 10” roundup noted that Microsoft had removed a modem driver from all versions after it was discovered that hackers were abusing a vulnerability in it to hack into systems. Adam Barnett at Rapid7 said Microsoft today removed another couple of modem drivers from Windows for a broadly similar reason: Microsoft is aware of functional exploit code for an elevation of privilege vulnerability in a very similar modem driver, tracked as CVE-2023-31096.

    “That’s not a typo; this vulnerability was originally published via MITRE over two years ago, along with a credible public writeup by the original researcher,” Barnett said. “Today’s Windows patches remove agrsm64.sys and agrsm.sys. All three modem drivers were originally developed by the same now-defunct third party, and have been included in Windows for decades. These driver removals will pass unnoticed for most people, but you might find active modems still in a few contexts, including some industrial control systems.”

    According to Barnett, two questions remain: How many more legacy modem drivers are still present on a fully-patched Windows asset; and how many more elevation-to-SYSTEM vulnerabilities will emerge from them before Microsoft cuts off attackers who have been enjoying “living off the land[line] by exploiting an entire class of dusty old device drivers?”

    “Although Microsoft doesn’t claim evidence of exploitation for CVE-2023-31096, the relevant 2023 write-up and the 2025 removal of the other Agere modem driver have provided two strong signals for anyone looking for Windows exploits in the meantime,” Barnett said. “In case you were wondering, there is no need to have a modem connected; the mere presence of the driver is enough to render an asset vulnerable.”

    Immersive, Ivanti and Rapid7 all called attention to CVE-2026-21265, which is a critical Security Feature Bypass vulnerability affecting Windows Secure Boot. This security feature is designed to protect against threats like rootkits and bootkits, and it relies on a set of certificates that are set to expire in June 2026 and October 2026. Once these 2011 certificates expire, Windows devices that do not have the new 2023 certificates can no longer receive Secure Boot security fixes.

    Barnett cautioned that when updating the bootloader and BIOS, it is essential to prepare fully ahead of time for the specific OS and BIOS combination you’re working with, since incorrect remediation steps can lead to an unbootable system.

    “Fifteen years is a very long time indeed in information security, but the clock is running out on the Microsoft root certificates which have been signing essentially everything in the Secure Boot ecosystem since the days of Stuxnet,” Barnett said. “Microsoft issued replacement certificates back in 2023, alongside CVE-2023-24932 which covered relevant Windows patches as well as subsequent steps to remediate the Secure Boot bypass exploited by the BlackLotus bootkit.”

    Goettl noted that Mozilla has released updates for Firefox and Firefox ESR resolving a total of 34 vulnerabilities, two of which are suspected to be exploited (CVE-2026-0891 and CVE-2026-0892). Both are resolved in Firefox 147 (MFSA2026-01) and CVE-2026-0891 is resolved in Firefox ESR 140.7 (MFSA2026-03).

    “Expect Google Chrome and Microsoft Edge updates this week in addition to a high severity vulnerability in Chrome WebView that was resolved in the January 6 Chrome update (CVE-2026-0628),” Goettl said.

    As ever, the SANS Internet Storm Center has a per-patch breakdown by severity and urgency. Windows admins should keep an eye on askwoody.com for any news about patches that don’t quite play nice with everything. If you experience any issues related installing January’s patches, please drop a line in the comments below.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • HONOLULU—Five years ago, when then-Adm. Phil Davidson told senators that China would attempt to seize Taiwan as early as 2027, “it seemed like it was a good long way out,” Adm. Sam Paparo said Monday.

    “And the danger in that was that we thought that it was some holiday that we had until 2027 for ourselves. But there could be a war of, quote, necessity, anytime between now and Aug. 1 of 2027, and there can be a war of choice anytime after August of 2027,” the leader of U.S. Indo-Pacom Command told a standing-room-only audience at the Honolulu Defense Forum, referring to the 100th anniversary of the founding of the People’s Liberation Army.

    “We have to be ready now, we have to be ready in 2027, we have to be ready in 2028.”

    One way the command will prepare is by incorporating information operations into “every plan, every investment, every operation,” Paparo said. “We don’t bolt information operations on the end. We integrate and suffuse it from the very start.”

    Information operations, cognitive operations, and cyber operations as a “salient form of warfare” is one of three “meta trends” Paparo said are reshaping modern conflict.

    “Entities can exploit the information environment where perceptions can outpace facts and disrupt decision making—often without firing a shot,” he said.

    At the forum, Palauan President Surangel Whipps described Chinese efforts to sour his country’s populace on its relationship with the United States and its decision to recognize Taiwan as a sovereign nation. 

    “The narrative that’s being taught [is] that the U.S. militarization of Palau has put a target on Palau, and really that’s a false narrative,” Whipps said. “Because whether the U.S. is helping improve ports, helping improve airports, building over-the-horizon radar, the opportunity is to ensure that we are protected.”

    China also reminds Palau that “2027 is coming soon, and soon you won’t have a partner,” Whipps said. “They basically tell us, ‘If you don’t denounce [Taiwan] and join us now, you’ll be left out in the cold.’”

    But unlike China, which invests billions of dollars globally on messaging and information operations, in the United States that has “always been something that was sprinkled on top of an existing policy, rather than conceived of… a really central domain of competition, which it is, and Beijing absolutely sees it that way,” Ely Ratner, the former assistant defense secretary for Indo-Pacific security affairs, told Defense One.

    Ratner praised Paparo’s decision to prioritize information operations, though he pointed out that the entire United States government needs a strategy.

    “China’s ability to shape the narrative really does have an enormous effect on the behavior of other countries,” he said, but noted that unlike China, which has built a false image of itself and maligned the United States in its messaging, the United States does not need to engage in disinformation.

    “It’s just about really being clear about the kinds of things that China is doing around the world, and doing it in an effective way, such that it resonates with governments and populations in key regions,” he said. 

    And the messaging must be backed up by real policy. But the Trump administration has been moving in the opposite direction, shuttering the State Department office responsible for countering false narratives and gutting the U.S. Agency for Global Media.

    Paparo also advocated for a whole-of-government approach.

    “The military has a significant role in this, but frankly, it is the elected civilian leaders. It is our diplomats. It’s our other instruments of national power that have an even greater role,” he said. “We’ve got to attack this.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Pentagon’s third AI-acceleration strategy in four years sets up seven “pace-setting projects” that will “unlock critical foundational enablers” for other U.S. military efforts, the department announced Monday. 

    The six-page document also directs the department’s many components to fulfil a four-year goal to make their data centrally available for AI training and analysis. It omits any mention of ethical use of AI and casts suspicion on the concept of AI responsibility while banning the use of models that incorporate DEI-related “ideological ‘tuning.’”

    Also on Monday, Secretary Pete Hegseth announced that Pentagon networks, including classified ones, would enable access to Grok, the Elon Musk-owned, Saudi– and Qatari-backed AI chatbot noted for its partisan, even Nazi, slant and its willingness to create sexually explicit images of children

    In some key respects, the new strategy bears much in common with its 2023 Biden-administration predecessor, which also emphasized the rapid adoption of commercially available AI frontier models across the military.

    The new strategy, however, offers far more specific pathways for that adoption across various military activities. A project called “Swarm Forge” will “iteratively discover, test, and scale” new ways of using AI in combat. Another project aims to rapidly incorporate agentic AI—foundation models that can complete specific tasks autonomously—for “enabled battle management and decision support, from campaign planning to kill chain execution,” and a third aims to promote AI in scenario planning.

    One intelligence-related project aims to “turn intel into weapons in hours not years;” another, to make posture planning more “dynamic.”

    Another project aims to make AI tools—including Grok and Google’s Gemini—available to department personnel at “Information Level (IL-5) and above classification levels.” 

    Perhaps most significantly, the new strategy lays out a mandate to eliminate “blockers” to data sharing within the Department and institute open-architecture systems, a move generally seen as favorable to startups and faster innovation.

    Among these are “responsible AI,” ethical considerations, and DEI. Under a section titled “Clarifying ‘Responsible AI’ at the [Department of War] – Out with Utopian Idealism, In with Hard-Nosed Realism,” the strategy declares: “Diversity, Equity, and Inclusion and social ideology have no place in the DoW, so we must not employ AI models which incorporate ideological ‘tuning’ that interferes with their ability to provide objectively truthful responses to user prompts.”

    The strategy also mandates that the defense undersecretary for research and engineering must “incorporate standard ‘any lawful use’ language into any DoW contract through which AI services are procured within 180 days,” meaning that any use of AI need only meet the legal standard the Department uses for force in general, human or not, as opposed to a special higher standard that which requires “meaningful human control” for the use of autonomy in war. But the strategy does not explicitly rescind the long-stated preference for meaningful human control either, which could lead to confusion as different commanders interpret meaningful and control in different ways, or, potentially, choose to ignore it. 

    It’s exactly the sort of discrepancy that the Department’s conspicuously absent AI ethics principles are meant to address. (The strategy also fails to acknowledge the growing chorus of lawmakers voicing concern about the administration’s ability to understand or follow the law, whether in attacking unarmed boats or taking lethal action against civilians on U.S. streets.)

    The Pentagon is launching the strategy at a time when Russia and China are accelerating their own AI adoption, but also when public trust in AI is collapsing across the U.S. political spectrum. It also arrives as many European allies are turning away from U.S. tech companies due to the administration’s aggression toward democracies.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • L3Harris Technologies’ plan to create a new publicly traded solid rocket motor company in the second half of this year includes the U.S. government, which will become a significant stockholder in that post-IPO entity.

    Their transaction announced Tuesday has multiple moving parts to it, starting with the Defense Department’s agreement to invest $1 billion in L3Harris’ rocket motor business. That stake is initially starting as a convertible preferred security, which will then automatically switch to common equity upon the IPO.

    DOD and L3Harris are touting this pact as a starting point for negotiating future multi-year procurement framework agreements for solid rocket motors, pending congressional authorization and appropriations.

     “We are fundamentally shifting our approach to securing our munitions supply chain,” Michael Duffey, defense undersecretary for acquisition and sustainment, said in a DOD release. “By investing directly in suppliers, we are building the resilient industrial ⁠base needed for the Arsenal of Freedom.”

    For DOD, this is the first direct-to-supplier partnership of this kind and stems from both the department’s acquisition transformation strategy and its “Go Direct-to-Supplier” initiative. The department is pushing to more directly negotiate with and invest in suppliers of key products such as motors, munitions and others that are part of larger systems.

    Recall as well that the U.S. government owns a 10% stake in chipmaker Intel and is investing in several mineral suppliers.

    Capital Alpha analyst Byron Callan has questions about the deal, including: Why is public money flowing to L3Harris, not other missile and rocket suppliers, including Anduril, Northrop Grumman, and Ursa Major? Why not to Lockheed Martin or RTX, the primary buyers of rocket motors? And: “If a return to taxpayers via DoD is to be realized from this deal, how will conflicts of interest be avoided?”

    And what does L3Harris get out of this arrangement?

    During a conference call with investors Tuesday, L3Harris’ chief executive Chris Kubasik said the company is staying in place as majority owner and controller of the business it calls Missile Solutions.

    “They have no board seats, they have no influence with management or the day-to-day operations, it's just an economic investment,” Kubasik said.

    Missile Solutions employs roughly 7,000 employees and posted $3.6 billion-to-$3.8 billion in revenue during 2025, according to an investor presentation. Missile Solutions also makes the RS-25 engine used by NASA for deep space missions.

    The IPO plan has Missile Solutions’ leadership team remaining in place including its president Ken Bedingfield, who works in that role alongside his chief financial officer duties.

    Then there is the go-forward plan for Missile Solutions as it takes in this investment and prepares to become a public company. Bedingfield told investors that Missile Solutions has been in the process of changing how it makes rocket motors over multiple years.

    Historically, much of that manufacturing activity has taken place on a very program-specific model. Bedingfield said the unit is transitioning to a new approach of “more common production across motors” from new facilities it is constructing.

    “We'll be able to reconfigure. We'll be able to put new motors to Monday or Tuesday, be pouring and casting for one program, and Wednesday and Thursday for another,” Bedingfield said. “We think it enables us to not only produce for the current demand and current programs, but have that flexibility to be able to surge across programs or bring in new as we see dynamics change.”

    As L3Harris sees things, that transition also requires a different approach for investing in the business to align with the demand landscape. Kubasik said “we need billions of dollars” in order to accomplish that, which led the company to view the public markets and DOD becoming an anchor investor as a “creative solution.”

    The government’s new equity position does mean it will have an ownership stake in a business, and soon-to-be company, that bids on contracts. Kubasik said “there will be competition, and it will be fair in arm’s length.”

    In 2023, L3Harris acquired the solid rocket motor maker Aerojet Rocketdyne as a way to enter the munitions market and get more visibility into supply chains. Aerojet and the legacy Orbital ATK business, which Northrop Grumman acquired in 2017, have long been the two dominant suppliers of solid rocket motors to the U.S. military and other defense hardware companies.

    Several other largely venture-backed startups have emerged in the landscape this decade with the goal of breaking up that duopoly.

    L3Harris is in the process of selling a majority stake in the Aerojet space propulsion and power systems business to AE Industrial Partners, which plans to revive the Rocketdyne name after that transaction’s closure.

    Kubasik views the Missile Solutions IPO and space propulsion business divestiture as potentially starting a deconsolidation of the defense industry, which would reverse course from the consolidation that began in the 1990s.

    “The best thing for the nation is we have more prime companies and public companies in the defense industrial base to move faster and provide more competition, which is good for the Department of War, good for the taxpayers, and I believe ultimately good for the shareholders,” Kubasik said.

    JP Morgan Securities is acting as financial adviser to L3Harris on the transaction with DOD, while Vinson & Elkins LLP is the company's legal adviser.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Telegram will add a warning for proxy links after reports showed they can expose user IP addresses with a single click, bypassing VPN or privacy settings.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have discovered a major web skimming campaign that has been active since January 2022, targeting several major payment networks like American Express, Diners Club, Discover, JCB Co., Ltd., Mastercard, and UnionPay. “Enterprise organizations that are clients of these payment providers are the most likely to be impacted,” Silent Push said in a report published today.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed details of a malicious Google Chrome extension that’s capable of stealing API keys associated with MEXC, a centralized cryptocurrency exchange (CEX) available in over 170 countries, while masquerading as a tool to automate trading on the platform. The extension, named MEXC API Automator (ID: pppdfgkfdemgfknfnhpkibbkabhghhfh), has 29 downloads and is still

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Flowable has launched version 2025.2 of its enterprise work orchestration platform, adding support for governed multi-agent AI, impact…

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Are you fascinated by the world of cybersecurity? If so, then keep on reading. We are going to be listing five facts about the cybersecurity world, and explaining them. Are you interested in a degree in cybersecurity? You can learn more about degrees or read on here to find out about cyber-careers and trends. Kevin […]

    The post 5 Facts You Should Know About Cybersecurity appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Did Trump’s attacks on boats off Latin America involve a second type of war crime? The Defense Department is accused of killing shipwrecked survivors after a strike on an alleged drug-running boat on Sept. 2 in the Caribbean Sea near Trinidad and Tobago. But the New York Times reported Monday that the attack may also have involved a second war crime: “perfidy”—that is, disguising military equipment as civilian in order to sneak up and kill someone. 

    The Pentagon’s first strike that day used a secret plane disguised to look like a civilian aircraft, officials briefed on the matter told the Times. The exact aircraft has not been revealed, though Reddit users reportedly spotted one such apparently-modified 737 at an airport in the U.S. Virgin Islands in September. 

    In search of a precedent, “the United States considers perfidy to be a crime in noninternational armed conflicts,” one legal expert told the Times. To this end, “It charged a Guantánamo detainee before a military commission with that offense over Al Qaeda’s 2000 attack on the U.S.S. Cole, in which militants in a small boat floated a hidden bomb up to the side of the warship while waving in a friendly manner,” said Geoffrey Corn, a retired Army lieutenant colonel and former judge advocate general officer. Several other legal experts and JAG officials offered additional insight. Continue reading (gift link), here

    The U.S. military’s last known strike on alleged drug-trafficking boats occurred on New Year’s Eve. Those strikes, 35 reported in total, have killed at least 123 people, according to the Defense Department. Mutilated bodies and broken boats have washed ashore in Colombia and Trinidad and Tobago, along with traces of what appear to be marijuana, the Times reported in October and December

    We have new insight into one lingering post-invasion question: How did the U.S. military get so close to Venezuelan leader Nicholas Maduro without losing any troops during its surprise attack and abduction on Jan. 3? The Russians had supplied Maduro with air-defense equipment, but they appeared to have been almost entirely ineffective on the morning of the attack. American officials now allege “Venezuela was unable to maintain and operate the S-300” Russian system, “as well as the Buk defense systems, leaving its airspace vulnerable,” the New York Times reported separately on Monday. 

    What’s more, “photos, videos and satellite imagery found that some air defense components were still in storage, rather than operational, at the time of the attack,” the Times reports. Read more—including video clips and annotated post-attack photos—here (gift link).

    Venezuelan blockade analysis: After the U.S. seized a Russian-flagged oil tanker in the North Atlantic on Jan. 7, the incident raises several questions for international observers and U.S. allies, Kevin Rowlands and Caroline Tuckett wrote Monday in a commentary for the London-based Royal United Services Institute. They write, “Legally, it will all come down to a simple question: was the ship Russian or not?” And “Geopolitically, it will come down to a simple statement: might is right.”

    “Sanctions are not just paper declarations; they need to be enforced and how this incident is eventually legally assessed will affect how other states justify similar action,” Rowlands and Tuckett advise. However,” If that assessment takes place in an international tribunal, will the losing party honour the outcome? If it is settled ‘out of court’ then others will take note.” Read the rest, here

    See also: What the Bella-1 Teaches Us About Targeting Shadow Fleets,” via Jose Macias of the Washington-based Center for Strategic and International Studies, writing Thursday. 

    And for what it’s worth, “We are now 25 days beyond the statutory deadline for the full release of the Epstein files,” justice reporter Scott MacFarlane observed Tuesday on social media. To date, less than 1% of those files have been released by the Justice Department, in apparent contravention of bipartisan Epstein Files Transparency Act. The day of Maduro’s capture, January 3, was the statutory deadline for the Department of Justice to provide Congress with a written justification for any redactions in the Epstein files, as required by the law. The Trump administration has missed both deadlines without consequence. 


    Welcome to this Tuesday edition of The D Brief, a newsletter focused on developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so we’d like to take a moment to thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 2021, President Trump was impeached for a second time, this time on charges of inciting insurrection during the Jan. 6 riot at the U.S. Capitol. 

    Around the Defense Department

    The Pentagon says it has a new artificial-intelligence implementation plan intended to “unleash experimentation, eliminate bureaucratic barriers, [and] focus our investments,” Defense Secretary Pete Hegseth announced Monday. 

    During a visit to SpaceX in Texas, Hegseth said Elon Musk's xAI platform, Grok, will be added into Pentagon networks as part of the military’s new AI strategy—though this has been known publicly since at least July. “Very soon we will have the world's leading AI models on every unclassified and classified network throughout our department,” Hegseth said Monday. Reuters has a bit more.

    The Defense Department also announced a $1 billion investment in L3Harris' Missile Solutions business as part of new “multi-year procurement framework agreements for solid rocket motors.” The idea is to bolster the Pentagon’s “critical missile programs, such as PAC-3, THAAD, Tomahawk, and Standard Missile,” according to a statement Monday. More, here

    Update: Sen. Kelly sues Hegseth for seeking to demote him over “illegal orders” video. In a 46-page lawsuit filed in federal district court in Washington, D.C., Sen. Mark Kelly, D-Ariz., alleges that efforts by the Trump administration to punish him for a video (in which he and others tell troops that they need not follow illegal orders) violate the First Amendment, the separation of powers, due-process protections, and the Speech and Debate clause of the Constitution. Read on, from States Newsroom.

    In a separate statement, Kelly said Hegseth’s “unconstitutional crusade against me sends a chilling message to every retired member of the military: if you speak out and say something that the President or Secretary of Defense doesn’t like, you will be censured, threatened with demotion, or even prosecuted.”

    Additional reading: In case you missed it, “GSA’s procurement chief is attending negotiations for Ukraine and Gaza,” Nextgov’s Natalie Alms reported Friday. 

    Etc.

    Quantum cameras could remake space-based intelligence. In a month or two, a Boston-based startup Diffraqtion will test a “quantum camera” for space-based imaging. If it works, it could slash the cost of missile defenses and give smaller NATO allies and partners spy-satellite capabilities that were once exclusive to major powers, Defense One’s Patrick Tucker reported Monday. 

    One of Diffraqtion’s cameras is the size of a small suitcase, and is launchable for just half a million dollars. That just might be the key to shooting down highly maneuverable hypersonic missiles, as envisioned by the White House’s Golden Dome effort. The method proposed by Diffraqtion might lower the cost of the imaging systems on space-based interceptors, or even reduce the number needed to do the job. Continue reading, here

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶