1010.cx

  • Carnival Cruise Breach Leaks Sensitive Customer Information

    ·

    , ,

    Carnival Corporation has disclosed a significant data breach impacting approximately 5.99 million individuals, raising serious concerns about data security within the global travel and hospitality sector. The incident, officially reported to the Maine Attorney General’s office, involved unauthorized access to sensitive customer information for 9,746 Maine residents. Carnival Cruise Breach According to regulatory filings, the […]

    The post Carnival Cruise Breach Leaks Sensitive Customer Information appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Malicious RVTools Installer Uses Sectigo Cert to Evade SmartScreen

    ·

    ,

    A malicious fake RVTools installer is abusing a legitimately issued Sectigo code‑signing certificate to slip past Microsoft Defender SmartScreen and many endpoint controls, ultimately deploying a multi‑stage Python‑based RAT with deep AD reconnaissance and persistent C2 access. For VMware‑heavy environments, compromise of an administrator via this vector can effectively hand over domain‑level control to the […]

    The post Malicious RVTools Installer Uses Sectigo Cert to Evade SmartScreen appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Gogs 0-Day Flaw Enables Remote Code Execution on Servers

    ·

    , , , ,

    A new 0-day vulnerability in Gogs, a popular self-hosted Git service, allows authenticated users to run arbitrary commands on the server and potentially take full control of the system. The flaw was discovered by Rapid7 Labs and is rated Critical with a CVSS v4 score of 9.4. At the time of publication, there is no […]

    The post New Gogs 0-Day Flaw Enables Remote Code Execution on Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The CISO Whisperer’s Watch List For The Gartner Security & Risk Management Summit 2026

    ·

    New York, USA, May 28th, 2026, CyberNewswire TVC Analyst Group has released its list of twelve cybersecurity companies identified for their activity and positioning ahead of the Gartner Security & Risk Management Summit 2026, where participating vendors are expected to present product updates, strategic initiatives, and technology developments. The annual Gartner Security & Risk Management […]

    The post The CISO Whisperer’s Watch List For The Gartner Security & Risk Management Summit 2026 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Army’s data-merging cell needs a few years to untangle the mess

    ·

    ABERDEEN PROVING GROUND, Maryland—Much has been made of the new systems the Army is bringing online as part of its Continuous Transformation efforts, but getting old systems into shape is also part of the effort. In a small office space at Combat Capabilities Development Command, a group of 25 soldiers and civilian engineers, on loan from local units, is fielding requests from across the service to make its many data systems talk to each other.

    The pilot Army Data Operations Center, launched on April 3, is to run until the end of September, when the Army will decide whether and how it will continue. To date, the team has fielded 68 tickets—from next-generation command-and-control testing, to radios for a deploying unit, to behavioral health data for soldiers and families at home.

    Maj. Becky Boorbach, a data officer with the 25th Infantry Division, vouched for the ADOC’s work. Part of her job includes prepping for Exercise Balikatan in the Philippines by pulling Air Force-compiled international weather data into soldiers’ C2 screens.

    “We made a similar connection last year, predating the ADOC. That connection took us three months to make,” Boorbach told reporters Wednesday. 

    It went much more smoothly at this year’s Balikatan, she said: “So being able to do this during the exercise and having that connection come online was really critical to be able to work with our joint partners and complete that exercise.”

    Fulfilling some requests takes just a few hours, according to ADOC’s dashboard, while the average is about two to three weeks. Most of those delays are caused by waiting on managers to sign off on the administrative permissions to send the data through new channels, the ADOC boss said.

    “We do know some of these are long-term Army challenges that we're tackling now, that will take weeks,” said Brig. Gen. Mike Kaloostian, whose main job is leading the Command and Control Future Capability Directorate at Army Transformation and Training Command.

    More urgent requests are fielded through a 24-hour Warrior Engagement Cell, like a request for organizing 82nd Airborne Division radio data as they prepared to deploy for Operation Epic Fury.

    So far, ADOC hasn’t had any tickets from troops in combat, Kaloostian said, but they are prepared to field them. 

    The ADOC is one of several ways the service is trying to open all of its information silos. Right now at Fort Carson, Colo., engineers from a range of defense contractors are in the midst of a “hackathon sprint” to enable data-sharing among their varying systems. 

    Kaloostian’s team is thinking longer-term. 

    “I think we can get to that point in our Army's future, or in the joint force’s future, where you don't need an organization that's really doing this, because you're going to have the automation…that's going to be doing these connections for us and helping solve, and we won't need as much human interaction,” he said.

    Eventually there may be AI applications that can grant permissions and deconflict data channels, but for now, it requires human beings to straighten out.

    “We're not going to get to that level in the next two to three years,” he said. “So I think this capability is absolutely necessary…and we'll see—maybe beyond two, three years—where we are at that point.”

    Ultimately, ADOC’s goal is to put itself out of business, while NGC2 comes online integrating data to begin with. In the meantime, they’re looking for the funding and permanent staffing to keep the mission going. 

    “Come 30 September, that's the last day—then the Army needs to make a decision whether they're going to pay for the people side of this,” Kaloostian said. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Iran war needs an inspector general, senator notes

    ·

    A Democratic senator on Thursday requested that an inspector general oversight body designate one of the agency watchdogs to spearhead reviews of the ongoing war in Iran, citing a requirement in federal statute. 

    In her letter, Sen. Tammy Duckworth, D-Ill., pointed to a provision in the U.S. Code mandating that the chair of the Council of Inspectors General on Integrity and Efficiency tap an IG to head oversight of a military “overseas contingency operation that exceeds 60 days.” 

    The U.S. and Israel launched airstrikes against Iran on Feb. 28. 

    “IG quarterly reporting, audits, inspections and investigations related to OCOs have promoted valuable transparency and accountability across presidential administrations and enable federal agencies to be better stewards of taxpayer dollars,” Duckworth wrote. “The need for you to appoint a lead IG to advance these aims and conduct joint, comprehensive and independent oversight of contingency operations against Iran has never been greater, as the Trump administration’s explanations of the president’s purported mission, lines of effort and desired end states with respect to Iran are constantly shifting, and often contradict themselves.”

    Defense Department officials have testified that the war has cost an estimated $29 billion. 

    The CIGIE chair is limited to selecting the IG for the Defense Department, State Department or U.S. Agency for International Development. While the Trump administration folded USAID into State in 2025, the USAID IG office is still active. 

    The designated IG would be responsible for developing a strategy for oversight of the military operation, reviewing the accuracy of associated spending information provided by federal agencies and resolving any jurisdictional crossovers. They also would be required to issue regular public reports on their activities. 

    In her letter, Duckworth argued that the war in Iran meets the definition of an OCO because Operation Epic Fury is identified  as one in the DOD’s casualty database and because members of the National Guard have been deployed to the region. Under federal statute, if a military action includes ordering a member of the National Guard to active duty, that qualifies it as a “contingency operation.” 

    Duckworth requested that CIGIE Chair Cheryl Mason provide her selection for the IG by June 5. Mason also is the IG for the Veterans Affairs Department. 

    Andrew Cannarsa, CIGIE's executive director, said in a statement to Government Executive that the council has "received the letter from Senator Duckworth and is working to address the senator’s inquiry."

    The senator has criticized Mason’s confirmation as VA IG and election to CIGIE chair because she previously served as a senior adviser to VA Secretary Doug Collins. As such, Duckworth and good government groups have contended that Mason cannot provide independent oversight.

    [[Related Posts]]

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • When Your SOC Analyst is Also a Bot: AI Agents, MCP, and Many Automation Opportunities in Your Security Operations

    ·

    From AI Experiments to Autonomous Operations

    – Christophe Briguet, Sr. Director of Product Management – AI & Security Analytics, Stellar Cyber

    San Jose, Calif. – Apr. 28, 2026

    Something shifted in early 2026. Not gradually — more like flipping a switch.

    For years, we talked about AI in the SOC the way we talked about self-driving cars: always five years away, always needing “just a bit more data.” Then MCP (Model Context Protocol) happened. Then agentic frameworks stopped being demos and started being tools. And suddenly the question wasn’t “can AI help security teams?” but “what should we let it do first?“

    I know because I’ve been running one.

    The Agentic Breakthrough Nobody Saw Coming

    Here’s what changed: AI agents stopped being chatbots with API access and started being actual coworkers, ones that remember yesterday, know how to use your tools, and can make calls on their own.

    MCP, originally created by Anthropic and now under the Linux Foundation, gave us something we didn’t have before: a universal way for AI agents to connect to real systems. Not through brittle integrations or custom code. Through a standardized protocol that lets any AI agent talk to any tool, any API, any platform. Think of it as USB for AI: plug in a new capability, and the agent just uses it.

    At Stellar Cyber, we shipped MCP support in our platform. An AI agent can now connect to a Stellar Cyber instance and immediately access case management: listing cases, pulling full investigation details with MITRE mappings and observables, updating status, assigning analysts. One API call returns what used to take eight clicks and three tabs.

    But MCP is just the connector. The real breakthrough is what sits on top of it: agentic AI that remembers context, plans multi-step workflows, and acts on your behalf between sessions.

    What I Learned Running an AI Agent for a Week

    I didn’t just theorize about this. I built an AI agent that connects to my actual work systems (email, calendar, project management, documentation tools, and Stellar Cyber’s MCP server). I put it to work on real security operations tasks.

    Here’s what it did in a single day:

    • Wrote two customer emails about feature capabilities. Pulled context from a 10-message email thread, cross-referenced the KB, got the technical details right
    • Filed a Jira ticket. Got the required fields wrong twice, figured out the API, nailed it on the third try
    • Scheduled a meeting across four people by checking everyone’s calendar. Found the one open slot on Wednesday morning
    • Reviewed a process doc on Confluence and the matching Figma board. Found five gaps nobody had noticed
    • Pulled 30,000 cases from our Stellar Cyber MCP server in one call. Full MITRE mappings, observables, the works
    • Set up a cron job to watch a Google Form for new submissions, auto-create tickets, and ping me when something comes in. No code. It took about ten minutes.

    That’s not a demo. That’s a Tuesday.

    The Other Side of This

    Here’s where it gets uncomfortable. Everything I just described? Adversaries can do it too.

    If an AI agent can connect to your ticketing system, read your escalation tickets, cross-reference your knowledge base, and understand your detection gaps? That’s a free roadmap to everything you’re bad at defending. The same agentic capabilities that make defenders faster also make attackers more systematic.

    MCP is a double-edged sword. CrowdStrike already published research on securing agentic AI deployments against prompt injection and privilege escalation. The attack surface isn’t theoretical. It’s the exact same integration points that make agents useful.

    The threat landscape shift is this: the speed advantage that SOC teams had over scripted attacks is disappearing. Adversaries with agentic tools can now:

    • Enumerate your environment faster than your analysts can triage alerts
    • Generate social engineering content that’s contextually aware of your organization
    • Automate lateral movement decisions the way we automate triage decisions
    • Adapt tactics in real-time based on what’s working

    So what do you do? You make your defensive automation faster, smarter, and more connected than their offensive automation. Which brings us to the opportunities.

     Many Automation Opportunities

    After running an AI agent against real security operations workflows, six clear automation opportunities emerged. These aren’t aspirational. They’re things I watched an agent do (or nearly do) this week.

    1. Alert and Case Triage at Machine Speed

    This is the obvious one, and it’s where Stellar Cyber’s Alert Auto-Triage already operates. The agent runs Verdict Signal Checks against every critical case: IP reputation, behavioral anomalies, entity relationships, and device vulnerability. Then it delivers a verdict: True Positive, Benign, False Positive, or Inconclusive.

    What’s new is the feedback loop. When an analyst overrides a verdict, that override becomes a training signal. Not in the vague “we’ll retrain the model someday” sense. In the “the next time this pattern appears, the system weighs your judgment” sense. Tesla FSD learns from human takeovers. So does this.

    The agentic unlock: An MCP-connected agent can now pull case details, correlate with external threat intel, check historical verdicts on similar patterns, and deliver a triage decision with full explainability, without a human clicking through five tabs.

    2. Intake and Onboarding Automation

    Requests come through a form. Historically, someone reads the submission, creates a tracking ticket, checks prerequisites, and sends a confirmation email. Four systems, three context switches, one person doing manual data entry.

    An agent monitors the intake source on a schedule. When a new entry appears, it creates the ticket with the full structured description, writes the reference back to the source, and sends a notification with a summary. Zero manual steps.

    The agentic unlock: This pattern generalizes to any intake process. Trial requests. Compliance inquiries. Vulnerability disclosures. Customer escalation routing. Any workflow that involves “read from source A, create in system B, notify via channel C” is a candidate.

    3. Detection Quality Feedback Loop

    This is the one that excites me most. Security vendors accumulate enormous backlogs of “this detection doesn’t work right” tickets. The descriptions are often cryptic. The context is buried in email threads and support tickets. The person triaging needs deep product knowledge to even understand the ask.

    An AI agent with access to your ticketing system, knowledge base, and security platform can read a detection feedback ticket, pull the actual alert data, cross-reference with documentation, and produce a clear summary: “This is a false positive caused by substring matching in rule X. The reporter provided a fix. Here’s the corrected query.”

    The agentic unlock: Connect the agent to the reporting environment (with permission) via MCP, and it can validate the reported issue against live data. No more “can you send a screenshot?” No more three-week back-and-forth. The agent sees what the reporter sees.

    4. Connecting the Dots Across Tools

    A security operations leader’s job is connecting dots across systems. An email thread about a partner engagement, a ticket about a detection gap, a wiki page about process, a design board about workflow, pricing in a sales thread. These live in different tools with no automatic correlation.

    An AI agent traverses all of these. Ask it “what’s the status of this partner’s trial?” and it pulls the email thread, checks the tracking ticket, reads the intake form, and synthesizes a single answer. No tab switching. No “let me check.”

    The agentic unlock: This is where MCP shines. Each system is an MCP server. The agent doesn’t care if the data is in email, Jira, or Stellar Cyber. It speaks the same protocol to all of them.

    5. Proactive Monitoring Without Alert Fatigue

    The traditional approach to monitoring is either “check everything constantly” (expensive, noisy) or “wait for someone to notice” (slow, risky). AI agents offer a third path: scheduled, intelligent checks with human-level judgment about what’s worth escalating.

    My agent checks communication channels periodically, but it doesn’t just report “you have 15 unread messages.” It categorizes by urgency, identifies action items, filters noise, and only alerts me when something actually needs attention. The same pattern applies to security monitoring: check case queues, flag anomalies in detection coverage, monitor SLA breaches. And stay quiet when everything’s normal.

    The agentic unlock: Scheduled agent runs with model-tier optimization. Use a lighter model for routine checks, escalate to a more capable model when the situation requires judgment. Cost-aware automation.

    6. Documentation and Knowledge Capture

    Security teams generate enormous amounts of institutional knowledge that never gets documented. The analyst who knows that a specific firewall vendor’s log entries behave differently than expected? That knowledge lives in their head until they leave.

    AI agents can capture and structure this knowledge in real-time. Every ticket triage, every interaction, every decision becomes a structured entry in a persistent knowledge base. The agent maintains daily notes, updates its long-term memory with distilled insights, and cross-references new information against what it already knows.

    The agentic unlock: The more the agent works, the more it knows. The agent that triaged a batch of detection tickets now understands vendor-specific log quirks, integration edge cases, and identity correlation gaps. Next time a related ticket comes in, it starts from that base — not from zero.

    What This Means for Security Teams

    The security industry has spent the last decade building detection. The next decade is about decisions. Who decides what’s real? Who decides what to do about it? And how fast can those decisions happen?

    Agentic AI doesn’t replace the analyst. It gives the analyst leverage. The same analyst who manually triaged 20 cases a day can now review 200 agent-triaged cases, focusing their expertise where it matters: the edge cases, the novel attacks, the judgment calls that machines can’t make yet.

    The vendors still hiding behind closed APIs and one-shot AI summaries are going to get left behind. The platforms that win will be the ones that open their APIs through protocols like MCP, build feedback loops that actually learn from human decisions, and treat AI automation as a product, with accuracy metrics, cost controls, and governance rails.

    We’re building that at Stellar Cyber. The MCP server is live. Alert Auto-Triage is in production. And I have an AI agent that just drafted this blog post.

    Well, most of it.

    Christophe Briguet is Sr. Director of Product Management – AI & Security Analytics at Stellar Cyber, where he leads the Autonomous SOC product direction. He’s still figuring out where the line is between helpful and creepy.

    About Stellar Cyber

    Stellar Cyber’s Open XDR Platform delivers comprehensive, unified security without complexity, empowering lean security teams of any skill level to secure their environments successfully. With Stellar Cyber, organizations reduce risk with early and precise identification and remediation of threats while slashing costs, retaining investments in existing tools, and improving analyst productivity, delivering an 8X improvement in MTTD and a 20X improvement in MTTR. The company is based in Silicon Valley. For more information, visit https://stellarcyber.ai.

    The post When Your SOC Analyst is Also a Bot: AI Agents, MCP, and Many Automation Opportunities in Your Security Operations appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code

    ·

    A critical security vulnerability has been disclosed in Gogs, a popular open-source self-hosted Git service, that allows an authenticated user to execute arbitrary code under certain conditions. The security flaw, per Rapid7, is rated 9.4 on the CVSS scoring system. It does not have a CVE identifier. “The vulnerability allows any authenticated user to achieve remote code execution (RCE) on

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Navy used drones to sink a retired warship

    ·

    A U.S. warship used aerial and maritime drones to help sink a decommissioned frigate last fall, Fourth Fleet officials have confirmed, adding that the experience is now shaping how the Navy will go into future battles.

    On or about Sept. 28, somewhere in the Fourth Fleet’s slice of the Atlantic Ocean, the littoral combat ship Cooperstown launched four unmanned aerial vehicles and one unmanned surface vessel against the former USS Simpson, a Perry-class guided missile frigate that was until recently the last modern U.S. Navy vessel to have sunk an enemy warship. 

    The robot formation executed three kinetic strikes against the Simpson as part of live-fire attacks that put the hull on the bottom and capped the weekslong, multinational UNITAS 2026 exercise.

    Neither the drones’ participation in the SINKEX nor the identity of the warship that went to its watery grave appear to have been previously confirmed.

    The drone attack was largely coordinated by personnel ashore, not aboard the relatively lightly crewed Cooperstown, a Fourth Fleet spokesperson said.

    “The exercise was primarily commanded from the Maritime Operations Center, MOC, ashore, with some senior staff elements afloat. The Robotics Operations Coordinator was part of the element ashore at the MOC, monitoring the status of each [automated unmanned system] and event serials in which they participated,” the spokesperson said via email. “We also conducted coordinated anti-submarine warfare against a diesel submarine using long-dwell USVs with acoustic capability.” 

    The Navy is refining its approach to assessing and buying unmanned surface vessels as it works to integrate drones across domains into its fighting structure.  

    Could data centers at sea set drones free?

    Situational awareness experiments were also conducted aboard Cooperstown, such as using flying drones to collect targeting data. These were underpinned by a “deployable data center” transported from Mayport, Florida, set up in Norfolk, Virginia, and ultimately put aboard the littoral combat ship. The data center, provided by Armada, was equipped with AI and machine-learning tech, including computer vision and tested maritime domain awareness technologies. It was the first time the company’s product was tested at sea. 

    Logistics delays, including a hurricane, kept the devices from processing much of the exercise data, but nevertheless provided “an excellent proof of concept,” the Navy spokesperson said. “The team engineered electrical and data connectivity in record time, and the ship transported the DDC on the next leg of its deployment, providing edge computing power at sea.”

    Lawmakers have proposed to spend $10 million for “deployable data centers that deliver remote and resilient edge computing” under Navy experiments and demonstrations in a draft 2027 defense policy bill. 

    During the exercise, the Cooperstown launched four aerial drones, including a medium-sized Group 3 UAV whose collection could be used to train AI targeting models in a crowded maritime environment. 

    “The UAV launched from the [robotic and autonomous systems] mothership and captured imagery of [more than 20] naval vessels during the multinational exercise,” the Fourth Fleet spokesperson said. “With very few global opportunities to capture data on dozens of different classes of ship in close formation, the traffic density helped train and improve the AI model significantly more quickly than multiple individual flights in less complex environments.”

    Each aerial drone flew at least once and flights were planned around known and weather-related limitations—an incoming hurricane shortened the exercise. But the hope is to increase that in the future. 

    “There were limitations on when UAVs could fly in order to maintain safety of flight. Exercise event schedules, ship maneuvering, manned aircraft flights, gunnery exercises, and competing demands for flight deck space all impacted planned UAV operations,” the spokesperson said, noting that some flights were cut short for safety reasons revolving around drones operating near manned aircraft. 

    “The commander prioritized safety and successful exercise execution and temporarily paused most UAV flights for a few days, pending engineering analysis of a particular suspected communications interference issue.”

    Overall, the Navy said, the robot mothership was a success, particularly with the pre-planning for how the systems would be used and the infrastructure, such as battery power and hangar space. 

    But there’s always room for improvement, including more ship connectivity and someone to lead the robots. There wasn’t an onboard robotics specialist during the exercise—something that could change.

    “For future mothership deployments, a dedicated robotics officer in charge or liaison could be beneficial,” the spokesperson said. “Although each team knew their individual [tasks], we will mandate more comprehensive mission briefs with the ship’s operations staff.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The CISO Whisperer’s Watch List For The Gartner Security & Risk Management Summit 2026

    ·

    New York, USA, 28th May 2026, CyberNewswire

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶