• CIA cyber operatives provided intelligence that helped U.S. forces locate and capture deposed Venezuelan leader Nicolás Maduro within four minutes of landing on the ground in January this year, agency Deputy Director Michael Ellis said Tuesday.

    Ellis credited the agency’s Center for Cyber Intelligence with building what he called a “flawless intelligence picture” for Operation Absolute Resolve, the U.S. operation that seized Maduro.

    “If you look at [Absolute Resolve], you know that operation was only made possible by a flawless intelligence picture, and that flawless intelligence picture was built on cyber operations enabled by our CCI team,” Ellis said, speaking at the Billington Cybersecurity Conference in Washington, D.C. Without that intelligence, he said, the agency could not have helped U.S. forces locate and apprehend Maduro as quickly as they did.

    The remarks offer a more detailed public picture of how CIA cyber prowess helped U.S. forces locate and capture Maduro, expanding on earlier accounts from officials that acknowledged support without explaining the agency’s entire contribution.

    Joint Chiefs Chairman Gen. Dan Caine previously acknowledged Cyber Command’s participation in the efforts and credited the CIA, National Security Agency and National Geospatial-Intelligence Agency with supporting the Venezuela mission. He described months of intelligence collection on Maduro’s movements and daily routines, but did not directly identify the CIA cyber role Ellis outlined.

    During the capture mission, multiple intelligence agencies established crisis action teams to support Special Operations Command and Southern Command. A U.S. official familiar with the operation previously said the NSA provided geolocation support and monitored communications and signals that could reveal troop movements or plans to activate radar.

    Ellis discussed the operation in explaining the CIA’s recent decision to elevate CCI to a mission center, a change he said gave their cyber operators greater priority and helped align resources around intelligence needs.

    The change has helped the agency “bring cyber operations to bear to solve these tough intelligence problems,” Ellis said. He did not specifically identify the systems targeted or explain how the cyber operations revealed Maduro’s location.

    The CIA primarily executes and coordinates human intelligence gathering overseas, often done undercover. Officers recruit and manage foreign assets to clandestinely gather intelligence on areas like economics and terrorism threats. Much of that work has often involved the use of technology, including computer intrusions.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • China is trying to glean the secrets of U.S. artificial-intelligence models by using simpler AI models to query more advanced American ones, national-security and intelligence agencies warned on Tuesday.

    In a joint advisory, the National Security Agency, Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation said that Chinese companies DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI used “aggressive, malicious, and targeted distillation” tactics to extract billions of tokens from the exchanges within U.S. frontier AI models since 2024, likely with Chinese government awareness.

    Distillation is used to reduce the time and money needed to create a new model.

    “China-based AI companies route distillation requests through multiple pathways to gain unauthorized access, consequently violating U.S. AI companies’ terms of use,” the advisory said. “These pathways include native application programming interfaces (APIs), remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection.”

    It said the distillation campaigns targeted variants of Anthropic’s Claude, OpenAI’s ChatGPT, Google’s Gemini, and SpaceXAI’s Grok.  

    “China-based AI companies deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection,” the advisory said. “They also attempt to distill the best capabilities and proprietary features of each U.S. frontier model to train their China-based AI models. This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership.”

    The agencies recommended three steps for U.S. AI developers: implement comprehensive detection and mitigation, deploy targeted response changes, and establish cross-organization intelligence sharing. 

    White House Office of Science and Technology Director Michael Kratsios in July said Chinese distillation efforts — specifically ones by Moonshot AI — have sought to steal proprietary functions from Anthropic’s advanced Fable model. Anthropic made the same accusations in February.

    Advocacy groups have also requested the White House take stronger action to keep Chinese companies from importing advanced semiconductor chips. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month.

    Image: Shutterstock.com, Kirill Makarov.

    This month’s patch bundle obliterates the software giant’s previous record set in July, when it released updates for at least 570 security vulnerabilities. September’s Patch Tuesday brings this year’s total to more than 2,600, more than twice Microsoft’s previous record-setting patch year in 2020 (1,245) and with three more months to go.

    There are two “zero-day” flaws fixed this month that are being actively exploited: both CVE-2026-81963 and CVE-2026-85880 allow an attacker to elevate their privileges on Windows system.

    Fully 113 of the bugs addressed today earned Microsoft’s “critical” rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable Windows machine with little or no help from the user.

    Among the more serious critical flaws this month is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10. Microsoft warns that an unauthenticated attacker could leverage this weakness simply by sending a specially crafted packet to an affected system, and that it is likely to be exploited.

    Also scary is CVE-2026-69829, a critical, remote code execution flaw in the Windows Shell. This vulnerability has a CVSS base score of 9.8 (10 is the most severe), and can be exploited with low attack complexity, no privileges, and no user interaction.

    Microsoft’s summary of the security updates released today. Image: msrc.microsoft.com.

    Microsoft is hardly alone in shipping monster patch bundles lately. Many other large software companies, including Adobe, Cisco, Google, Mozilla and Oracle, all have recently credited AI-assisted research with increasing their patch cadence and volume (Google said today it is now going to ship security updates every two weeks).

    Tyler Reguly, associate director of security research and development at Fortra, said one core challenge with deploying Windows updates is that they need to be tested before being installed across an organization because not all third-party software works seamlessly in the face of changes to the underlying operating system.

    “It’s time to put our CISOs and CSOs on notice,” Reguly said. “How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.”

    Satnam Narang is senior staff research engineer Tenable. Narang said it’s important to recognize that while the number of vulnerabilities being patched by Microsoft is rising, the number of flaws that can and will affect most organizations remains quite low.

    “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” he said. “It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.”

    Of course, regular Windows users don’t need to test patches before deploying them, but they still need to open Windows Update periodically or else assent to the program’s nag notices about pending updates. And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month.

    Enterprise Windows admins will want to keep an eye on askwoody.com for news of any updates that appear to be causing problems. As always, the SANS Internet Storm Center has a per-patch breakdown ordered by severity and urgency.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The loss of dozens of MQ-9 Reapers to Iranian air defenses is speeding up the U.S. Air Force effort to replace its venerable strike-and-sensor remotely piloted aircraft with something cheaper yet better, service leaders say.

    “As we get to the end of the MQ-9 life, there was some early talk of where do we want to go afterwards, and candidly, as a result of some of the losses that we've experienced in combat operations, that discussion sort of got accelerated,” said Lt. Gen. Christopher J. Niemi, the Air Force’s chief modernization officer, at a Thursday roundtable with reporters.

    The service has lost at least 45 MQ-9s during Donald Trump’s war on Iran, roughly one-quarter of its fleet, the Washington Post reported in August. It’s not clear just how much that fleet cost, but an Air Force fact sheet puts the unit cost of one MQ-9 variant at $51 million in 2011 dollars—or nearly $82 million today.

    Niemi said the service wants to buy at least 180 MQ-9 replacements, dubbed Massed Modular Aircraft, or MMA, and at a much cheaper price point. He said the price of one MMA should be about half of the $20 million Collaborative Combat Aircraft, whose first production contracts were awarded in June, four months ahead of schedule.

    But those rough price goals—$20 million for a CCA, $10 million for an MMA—are for bare airframes, not the pricey sensors and systems that enable the drones to do their jobs. 

    As a service spokesperson put it later, the numbers “do not refer to total missionized costs.”

    Niemi said this reflects lessons from past and ongoing wars.

    “What we're seeing, in part based on our assessment of the threats around the world, and in part based on our real-world experience, is that you're going to lose more military hardware in future conflicts than you have historically, and that's what's driving us to this sort of fundamental principle that we need things that are easier to produce, cheaper to buy, and that we can afford to lose more of them,” he said. “Right now, we don't have a whole lot of that, so we're sort of trying to move the needle by bringing on things like MMA, so we have more options for the warfighter in the future.”

    For that $10 million price tag, the service also wants an increased payload of 2,800 pounds and an unfueled combat radius of 2,300 nautical miles and 8,000 nautical miles for a one-way mission, according to a July Defense Innovation Unit solicitation. General Atomics, the Reaper’s manufacturer, has a souped-up version of the MQ-9, the SkyGuardian, which boasts a larger wingspan, range, and endurance. But top service officials don’t seem as likely to bet on it.

    “One of the options that would be considered would be something like an MQ-9B, which is basically an updated and improved MQ-9A, but there are some reasons that we don't think that's the direction that we want to go as an Air Force,” Niemi said. “The main reason is, and and we're seeing this in our experience in the Middle East and as we look at threats around the world, that you need to have a portfolio of assets that's more attritable than the ones we've historically had.”

    General Atomics spokesperson C. Mark Brinkley defended the Reaper’s service record and pointed out that the Air Force’s top uniformed leader has praised the aircraft’s use during Operation Epic Fury. He also said the company has worked with the Air Force “to hit cost targets for three decades” and that it would continue with other programs.

    “The MQ-9’s unique combination of endurance, payload, range, sensors, weapons, connectivity, adaptability and reliability is precisely what enables mission effects that others struggle to replicate,” Brinkley said. “Today’s Reaper isn’t the same Reaper that rolled out 25 years ago. It’s been enhanced and upgraded many, many times. It’s also been called the MVP of Epic Fury, for good reason. We can debate many things, but at least we all agree that it’s a special aircraft that gets the job done.”

    The Senate Armed Services Committee is backing the platform in its version of the 2027 National Defense Authorization Act by placing limits on how many can be retired and calls for more to be purchased by 2028.

    General Atomics has also reportedly teased a new MMA offering with a 10,000-nautical-mile ferry range and claims that it can carry four Long Range Anti-Ship Missiles. Brinkely, while still defending the Reaper, also boosted its next-generation aircraft.

    “Our new Wildfire aircraft addresses all of the concerns posed by the MMA solicitation. We can deliver years earlier and maintain the same high quality,” Brinkley said. “You can have everything that makes Reaper special, plus more, at a price that doesn’t break the bank. Reaper is special. Wildfire is special, too.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. “The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin’s public record shows. About 598.5 bitcoin has not come back. Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is still paused, so holders cannot turn that token back into bitcoin. The 3,400 bitcoin was sent to a&

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Check Point Research said in a report published today that a single instruction planted in a ChatGPT conversation could cause ChatGPT to quietly work for an attacker while answering the user’s question as usual. In the company’s proof of concept, that hidden work read data from the user’s connected Gmail account and passed it to a second ChatGPT account through a hidden channel

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Boston, MA, USA, September 8th, 2026, CyberNewswire Specialized team of AI agents that discover, attack, and validate web vulnerabilities, leveraging pre-existing site context to eliminate noise and speed remediation.  Reflectiz, the continuous web exposure management company, today launched a multi-agent penetration testing platform for websites. Multiple specialized AI agents discover, attack, and validate vulnerabilities across […]

    The post Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat actors are continuing to leverage artificial intelligence (AI) to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat Intelligence Group (GTIG) said it has observed attackers with diverse motivations targeting proprietary AI

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The campaign does not exploit a Microsoft Teams vulnerability. Instead, it weaponizes trust in familiar support workflows, combining Teams chats […]

    The post Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶