• The Cybersecurity and Infrastructure Security Agency (CISA) released four critical Industrial Control Systems (ICS) advisories on August 19, 2025, alerting organizations to current security vulnerabilities and potential exploits affecting critical infrastructure systems. These advisories provide essential information for administrators and security professionals managing industrial control environments. Critical Systems Under Advisory The four newly released advisories […]

    The post CISA Issues Four ICS Advisories on Vulnerabilities and Exploits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A 20-year-old member of the notorious cybercrime gang known as Scattered Spider has been sentenced to ten years in prison in the U.S. in connection with a series of major hacks and cryptocurrency thefts. Noah Michael Urban pleaded guilty to charges related to wire fraud and aggravated identity theft back in April 2025. News of Urban’s sentencing was reported by Bloomberg and Jacksonville news

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apple has issued an emergency security update for iOS 18.6.2 and iPadOS 18.6.2 to address a critical zero-day vulnerability that the company confirms is being actively exploited in sophisticated attacks against targeted individuals. The update, released on August 20, 2025, patches a severe flaw in the ImageIO component that could allow attackers to execute malicious […]

    The post Apple Confirms Critical 0-Day Under Active Attack – Immediate Update Urged appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical XML External Entity (XXE) vulnerability has been discovered in Apache Tika’s PDF parser module, potentially allowing attackers to access sensitive data and compromise internal systems. The flaw, tracked as CVE-2025-54988, affects a wide range of Apache Tika deployments and has prompted immediate security advisories from the Apache Software Foundation. Field Value CVE ID […]

    The post Critical Flaw in Apache Tika PDF Parser Exposes Sensitive Data to Attackers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apple has released security updates to address a security flaw impacting iOS, iPadOS, and macOS that it said has come under active exploitation in the wild. The zero-day out-of-bounds write vulnerability, tracked as CVE-2025-43300, resides in the ImageIO framework that could result in memory corruption when processing a malicious image. “Apple is aware of a report that this issue may have been

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Air Force wants industry to make an identical copy of the Shahed-136 drone, used by Russia in relentless attacks on Ukraine, to develop and test defenses against the Iranian-designed system.

    The service wants to buy 16 of these Shahed look-alikes, with an option to buy 20 more later, as it pursues the “next generation” of counter-drone programs, according to a request for information posted last week.

    “To support weapons development and integration of these weapon systems, the [U.S. government] requires that the Class 3 unmanned aerial target system be a 1:1 copy (form, fit and function) of a reverse engineered Shahed-136 suicide drone,” the solicitation said. 

    The drone must be an “exact replica” of the Iranian bird with the same profile, shape, payload capacity—about 70 to 100 pounds—and must be able to fly at least 50 miles, according to the solicitation. That’s far less than the Shahed’s range of over a thousand miles, but sufficient for testing purposes.

    Designed in Iran, modified and mass-produced under license by Russia, the Shahed-136 has emerged as a favorite weapon of the invading forces inside Ukraine. Their price tag is estimated at $30,000 to $40,000 apiece, a fraction of the cost of the U.S. and European missiles used to take them down. That imbalance, plus depleted stockpiles of interceptors, has Ukraine and its supporters hunting for cheaper defenses.

    Several U.S. firms have already started designing Shahed-esque offerings for the Pentagon. During a drone demo event at the Pentagon last month, SpektreWorks, an Arizona-based drone manufacturer, showed off its new Low-Cost Uncrewed Combat Attack System, dubbed LUCAS, that can emulate a Shahed. Another firm, Alabama-based Griffon Aerospace, recently unveiled the MQM-172 Arrowhead, marketed as both an attack and target drone.

    While the Air Force provided some guidelines in the solicitation, the government said it won’t provide a technical data package for this requirement, so companies must be able to design and develop their own copy. 

    The solicitation notes that the drone will be sent to the service’s armament directorate, which develops weapons at Eglin Air Force Base in Florida.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Personnel cuts are crippling progress on Advana, a Pentagon data platform that has been widely used in recent years to accelerate functions from logistics to finance to readiness—and which is key to the department’s AI plans, current and former defense and military officials say.

    “You tell this organization to do ‘A.’ Then you cut contracted staff by 80 percent and you have a turnover of close to what, 60 percent? Things are going to break. Things are going to get delayed. We’re in both places,” said one defense official who asked for anonymity to speak freely.

    In 2021, the Defense Department comptroller launched the “Advancing Analytics” platform—soon shortened to Advana—as an accounting tool that could help keep track of what the Pentagon was buying and where it was sending it. DOD leaders pushed commanders and offices “hard,” in the words of one official, to adopt it. Within months, Advana had some 20,000 users across 42 organizations, and Booz Allen Hamilton had a five-year, $674 million contract to help expand and maintain it.

    In less than a year, Advana was helping U.S. troops coordinate with European partners to track and deliver munitions and other supplies to wartorn Ukraine. The system proved so useful that in July 2022, DOD’s inspector general chided elements of the military for not adopting it fast enough.

    As more DOD offices and agencies connected their systems to Advana, users across the Pentagon could coordinate their work—logistics, contracting, finance, and more—far more easily and accurately. By 2023, Advana had more than 72,000 users and far more data than initially expected.

    This unexpected success strained the Advana system, so in June 2024, the Pentagon’s Chief Digital and Artificial Intelligence Office—which had taken over the Advana program—put development on hold so that its user interface could be improved and its underlying architecture could be strengthened. 

    CDAO leaders also decided to split Advana into two parts: one to handle the urgent, often classified needs of warfighters, and another to handle slower, less dynamic business records, according to current and former officials. Among other things, this was intended to smooth the introduction of AI tools onto the platform. Yet the two parts would remain connected so that, for example, acquisition officials could make decisions based on battlefield data, while commanders could bring supply-and-contract data into their own war planning.  

    One month after pausing Advana development, CDAO unveiled plans for a 10-year, $15 billion Advancing AI Multiple Award Contract, or AAMAC. This vehicle was intended to bring in other software makers and cloud providers to help Booz Allen Hamilton split up Advana, give it a better front end for users, and update its back end for performance and growth. CDAO officials formally announced the plan in September and opened a process for contractors to submit proposals. 

    Cuts and cancellations

    The election of Donald Trump brought a new team to the Pentagon. In February, a senior defense official described a desire to convert the Advana project into a program of record, ensuring consistent budgeting. In April, the Defense Department axed what it called “duplicative” consulting contracts, including at least one to Booz Allen. Two current officials we spoke to said the action reduced the amount of contractor support the company was able to provide to Advana. But a former senior official said that the point of AAMAC was to bring in additional contractors to work alongside the company. Booz Allen remains under contract to support Advana through early 2027. A company spokesperson said, “Decisions regarding current Advana contracts were made before the memo, and any staff reductions made earlier this year were due to normal contract transitions rather than the memo or DOGE reviews.” 

    Contracts are reduced or changed all the time. Defense officials assured the public that the program was still on track and the upgrade was in the works.

    But the Trump administration took aim not just at excess consultants, but what they deemed excess staff as well. On Feb. 20, Defense Secretary Pete Hegseth announced plans to cut 5 to 8 percent of his department’s roughly 760,000-person civilian workforce, an effort aided by White House executive orders and its Department of Government Efficiency, run by Pentagon contractor Elon Musk. 

    The cuts hit the effort to modernize Advana hard. The CDAO lost two top architects as well as supporting staff, nearly 60 percent of its workers. Current and former officials said the cuts hollowed out the technical workforce needed to implement the upgrades. 

    The schedule began to slip. Promised upgrades were repeatedly delayed. Users across the department continued to wait. Last month, the entire AAMAC was put on hold.

    Why did the loss of a few staffers, following a plan to expand the program, have such a big effect? Standing up a highly automated data environment works differently for the Defense Department than it would for a Fortune 500 company, which could call a vendor and easily purchase an out-of-the-box solution. The department has to verify the security and reliability of software, hardware, and even data according to specific standards. Even if some of the bureaucratic obstacles are unnecessary, many still exist in law and can’t just be ignored. Simply bringing in a data source to help train an AI platform can take months of review and security verification, according to one source. Then there is the issue of actually understanding Defense Department data, including where to find it across departments, offices, commands, and agencies. In short, no matter what the Defense Department decides to purchase as part of a new Advana effort, expert staff, now absent, will be necessary to make it work. 

    “Literally, there’s no one else to do it,” said one defense official.

    Far-reaching effects 

    An indefinite delay to a data platform update may not sound like the sort of thing that could have far-reaching effects for the largest military in the world. But aside from its role in accounting—core to the stated goal of enabling the Defense Department to pass an audit— Advana has become the key data platform for many of its activities, including operational logistics and Joint Staff planning for large-scale conflict.

    In future wars, defense planners anticipate “contested logistics,” making resupplying troops and other administrative functions more important, complex, and difficult. For more than a year, units have been incorporating Advana into key wargames and exercises. These experiments have demonstrated the value of easy access to as much information as possible about supply, logistics, and other “business” matters. One former senior defense official described it as essential to the goal of “getting ahead” of adversary efforts to thwart resupply and material support. 

    But unless the Advana platform gets the upgrades needed to keep it from buckling under the load, it will suffer a type of collapse, current and former officials said. Already, the current architecture does not meet demand and it’s difficult to run advanced analytic tools on it. Data, they said, is returning to “silos,” meaning officers and commanders are holding it rather than incorporating it into a central repository. They worry that simple requests will go back to an analog system of phone calls and emails, exchanges that could take days or weeks as opposed to instantaneous. Some officials said this is already happening in isolated instances. 

    A larger concern is that individual services, commands, and offices may build their own data analysis tools but won’t have the benefit of all available Defense Department data. And exchanging data between entities will return to phone calls and email exchanges. That will sever the connections built up over the past few years, plunging the Pentagon back into a world of separate systems, figuring out orders and drafting plans through the exchange of PDFs, and Excel spreadsheets.

    It’s “a little back in the future,” said one official.

    The picture is of a Defense Department moving away from faster, better, joint, all-domain command and control, getting slower as adversaries get faster.

    Coming changes

    Changes are already underway—for CDAO, at least. 

    The office is being moved under the office of the defense undersecretary for research and engineering, according to an Aug. 14 memo. The memo gives Undersecretary Emil Michael and his fellow defense undersecretary for acquisition and sustainment 120 days to deliver a plan for Advana and the Maven Smart Systems program, another CDAO AI effort. Defense One reviewed a copy of the memo, which was first reported by DefenseScoop.

    Current and former officials were cautiously optimistic that the change could provide high-level attention to the program to get it fixed— most importantly, by restoring cut staff. 

    “Putting CDAO under R&E should help focus resources to do the upgrades necessary to make Advana an available platform for Fourth Estate use,” said one current official.

    However, another current defense official expressed concern that the move might shift data-centralization efforts away from AI-development programs, just when the two should be more closely integrated.

    A second former senior defense official said putting CDAO under the R&E undersecretary might turn AI efforts that are close to deployability into a “science project.”

    “Everyone is focused on moving projects out of R&E faster and fielding faster, which is a good thing. But this puts even more on their plate in a way that seems unnecessary. It could work out just fine, but there’s a lot of risk,” they said.

    Asked for comment on Advana and the merger memo, a defense official sent a statement. 

    “The OUSD(A&S) has completed an assessment and delivered a recommendation on Advana, which is under review by Senior Department leadership. The Department of Defense is continuing to take decisive action to implement AI across enterprise functions and workflows, including instituting directives from President Trump’s AI Executive Order and the White House AI Action Plan. 

    “Claims of dysfunction are unfounded; our efforts are focused on accelerating AI adoption to ensure the Department remains at the forefront of this new technological frontier.”

    One month ago, a banner was added to the CDAO website: “More information on the Advana way ahead coming soon.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • When Defense Secretary Pete Hegseth stood on the Pentagon’s parade field last month to announce a memo meant to accelerate the U.S. military’s ability to stock up on cheap drones, the sheet of paper he signed was delivered by a member of the Marine Corps Attack Drone Team, a Quantico, Va.-based unit that just got its start in January.

    Since then, the team’s primary work has been to develop the service’s tactics, techniques and procedures for operating armed first-person viewer drones, as infantry units are integrating the use of drones. Their first pamphlet is expected this month, Col. Scott Cuomo, who commands Weapons Training Battalion, Quantico, told reporters in July.

    “This is an area where we are not at where we need to be,” he said. “So we need to create an organization to … be the expert on what's going on on the modern battlefield, specifically in Ukraine.” 

    The idea for a team came from discussion amongst leadership about the use of drones in Ukraine, Gaza, and the Red Sea over the past few years, he said, and their rising dominance over more complex weapons systems.

    The team of 12 is nested under Weapons Training Battalion, Quantico, Cuomo said, in the same spirit of the Marine Corps Shooting Team, where the service’s top marksmen compete. Their job is to experiment with drone technology and operation, then push out best practices to the fleet. 

    “Once you understand it, all facets of it, make sure that you can train the rest of the Corps to do it,” Cuomo said.

    The team started out with radio frequency-capable drones in February, then added fiber-optic drones in July, which are thought to be impervious to jamming technologies that take down drones communicating over radio waves. 

    They have a range of about 15 miles versus the RF’s handful of miles, Cuomo said, and they’re much cheaper as well. Paired with Sky Node, a command and control software used by the Ukrainians, the drones can lock onto a target and fire on it similar to the way the Javelin shoulder-fired missile system works. 

    The team is also exploring options outside the ubiquitous quadcopter drone, he said, including what are known as “dropper” drones, which are like self-propelled mortar tubes that can be loaded with a variety of munitions.

    “So as we get these capabilities, we'll work them into the manual, and as you're seeing in Ukraine, these things change back and forth,” he said.

    The MCADT will test their skills this fall at the inaugural U.S. Military Drone Crucible Championship in Florida, hosted by the U.S. National Drone Association. 

    Then, they’ll travel around the fleet through the winter, holding local competitions for FPV and small unmanned aerial systems operators, first at Quantico, then Okinawa, then Marine Corps Base Hawaii, Camp Pendleton, Calif., and finally Camp Lejeune, N.C.

    Top drone operators from those competitions will meet up at Quantico in April for a championship, the winners of which will be invited to join MCADT when it competes in the future. 

    “Who am I sending to these competitions? I'm sending to the competitions the individuals in each of my squads and sections that are going to be the experts, and they're going to compete to see who's the best,” Cuomo said.

    Hegseth’s push to ramp up drone procurement is a huge boon to the team, he added, as the Defense Department moves from buying drones at $200,000 apiece to more like $2,000 for small, single-use drones. 

    “So you're going to see these capabilities down into our infantry squads, and then you're also going to see them inside of the new Force Design battalion, inside of the organic precision fires section, within the fires and reconnaissance company, and you will very likely see them inside the scout platoon as well,” he said. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Popular password manager plugins for web browsers have been found susceptible to clickjacking security vulnerabilities that could be exploited to steal account credentials, two-factor authentication (2FA) codes, and credit card details under certain conditions. The technique has been dubbed Document Object Model (DOM)-based extension clickjacking by independent security researcher Marek Tóth,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Trump administration asked a federal appeals court on Tuesday to toss rulings that found its mass firings of recently hired and promoted federal employees unlawful, arguing that the judicial orders are hurting its management of the civil service. 

    The Supreme Court in April already overturned a California district judge’s injunction that prevented the firings of employees in their probationary periods, but that order has not yet been formally revoked. After the high court’s ruling, the district judge ordered federal agencies, including the Departments of Defense and Energy, to send letters to dismissed workers attesting that they were let go as part of an effort to shrink government and not because of their individual performances. Much of the argument at an appeals court on Tuesday focused on that second order. 

    While agencies cited "performance" in the termination letters that they sent to probationary employees in February, they generally did not conduct individual assessments of the workers before firing them; instead, they followed guidance from the Office of Personnel Management to dismiss recently hired staff. Due to the initial injunctions, most of those probationers have since been hired back. Most of them remain on the job, though agencies such as the departments of Commerce, Health and Human Services and Housing and Urban Development have re-fired their “trial period” staff

    Attorneys for the Trump administration on Tuesday argued before the U.S. Court of Appeals for the Ninth Circuit that the district judge’s orders must be formally dismissed. While the letters stating the firings were not for performance were delivered months ago, the attorneys said, the injunction is still having an impact. 

    “The government continues to be bound to those letters that it was required to send out to those employees,” a Justice Department lawyer said. “And so the government is not able to, for example, send a subsequent letter saying we disagree with that letter, we never wished to send it.” 

    The district court’s injunction, the attorney added, is precluding agencies from potentially sending follow-up letters "clarifying the reasons for termination.” 

    Danielle Leonard, an attorney for the plaintiffs on the case, made up of federal employee unions and advocacy groups, argued the appeals court should dismiss the government’s appeal as moot rather than formally rescind the injunctions. The Supreme Court has already stayed the ban on firings and the letters stating the terminations were not for cause cannot be unsent, Leonard said. 

    The argument before the appeals court took place as the Internal Revenue Service’s inspector general issued a new report that found 99.5% of the 7,300 probationary employees the agency fired had either received at least “fully successful” performance reviews or had not been rated at all. More than half of the workers had not been given a performance review and of those who had, just 43 received a “below fully successful” rating. 

    IRS still suggested in the termination letters that the employees were fired for performance. 

    The district judge that had found the firings to be unlawful said OPM had illegally directed agencies to terminate the staff, rather than the agencies making their own decisions. The impacted employees were “terminated through a lie,” the judge said, and the justifications they were initially provided were “a total sham.” 

    The Supreme Court, however, found that the Trump administration was likely to win its case on the merits and struck down the injunction. It did not suggest federal court was an inappropriate venue for the case, though the administration again made that argument on Tuesday. The plaintiffs should instead take their case to the Federal Labor Relations Authority, the Justice official said. 

    A majority of the panel that heard the case, made up of Judge Morgan Christen, a President Obama appointee, and Judges Lawrence Vandyke and Daniel Bress, both President Trump appointees, appeared to favor the administration’s argument that the unions should take their case elsewhere. 

    Vandyke and Bress both suggested employees should challenge their employing agency rather than OPM, with the former judge likening the situation to an Instagram influencer calling for a federal employee be fired, the agency firing the employee and the individual suing the influencer instead of the agency. The administration’s attorneys noted probationary employees are severely restricted in their appeal rights, but the case was brought by unions and advocacy groups and not any individual workers.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶