• Google released Chrome version 153 to the Stable channel for Windows, macOS, and Linux, including 230 security fixes and addressing CVE-2026-87491, a zero-day vulnerability currently being exploited in the wild. Because of the unusually large number of fixes, consumers and enterprise defenders should update their browsers promptly. The desktop releases are version 153.0.8010.36 for Linux […]

    The post Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A large-scale Redis cryptojacking operation targets thousands of exposed Linux servers by abusing unauthenticated Redis deployments to install XMRig cryptocurrency miners and establish durable, cron-based persistence. The campaign scans IPv4 address ranges for Redis services exposed to the internet, typically on TCP port 6379, then attempts to interact with instances that allow connections without authentication. […]

    The post Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft’s September 2026 Patch Tuesday security update addresses 973 vulnerabilities across various products, including Windows, Microsoft Office, Azure components, Exchange Server, developer tools, and others. Among these vulnerabilities are two zero-day flaws reported as actively exploited. Given the scale of this update, enterprise security teams must triage vulnerabilities quickly, especially for internet-facing Windows systems, privileged […]

    The post Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild. These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Of these, over 110 shortcomings have been assigned a critical severity rating.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026. The vulnerability in question is CVE-2026-86218 (CVSS score: 10.0), which has been described as a

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The National Security Agency is leaning into artificial intelligence tools to process the mass volumes of data it collects, allowing analysts to sort through tasks and find anomalies faster, a top official said Tuesday.

    “I think right now we’re looking at how to use an AI where we could triage so much more,” David Imbordino, the head of the agency’s cybersecurity directorate, said on a panel with officials from the “Five Eyes” intelligence alliance at the Billington Cybersecurity Summit in Washington, D.C.

    The agency ingests vast amounts of data every day, including intercepted foreign communications and electronic signals from radar and weapons systems. Imbordino’s directorate, in particular, focuses on both intelligence collection and cyberdefense.

    “Volume has always been a problem,” he said, but AI has raised the prospect of getting “to the nuggets” faster than before. In the near future, analysts will likely use AI tools to look at disparate pieces of information and evaluate them “much more quickly” than current methods that can take days or weeks, Imbordino added.

    His remarks highlight one of many ways the nation’s cyber and intelligence agencies are putting AI to work and show the omnipresent role such systems will play in day-to-day work in spy offices.

    NSA has also taken a leading role in the Trump administration’s AI policy efforts as increasingly powerful tools promise to help defenders find and fix software flaws while giving hackers new ways to break into networks. Late last month, NSA deputy director Tim Kosiba said that the agency wants access to a wide range of models and is engaging heavily with frontier AI companies. 

    The agency is helping to implement a sweeping June executive order directing national security agencies to create classified tests for determining when AI systems have developed sufficiently advanced hacking capabilities to warrant additional scrutiny. The order calls, in part, for a voluntary arrangement through which developers can give the federal government access to qualifying models for as many as 30 days before releasing them to other trusted partners.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CIA cyber operatives provided intelligence that helped U.S. forces locate and capture deposed Venezuelan leader Nicolás Maduro within four minutes of landing on the ground in January this year, agency Deputy Director Michael Ellis said Tuesday.

    Ellis credited the agency’s Center for Cyber Intelligence with building what he called a “flawless intelligence picture” for Operation Absolute Resolve, the U.S. operation that seized Maduro.

    “If you look at [Absolute Resolve], you know that operation was only made possible by a flawless intelligence picture, and that flawless intelligence picture was built on cyber operations enabled by our CCI team,” Ellis said, speaking at the Billington Cybersecurity Conference in Washington, D.C. Without that intelligence, he said, the agency could not have helped U.S. forces locate and apprehend Maduro as quickly as they did.

    The remarks offer a more detailed public picture of how CIA cyber prowess helped U.S. forces locate and capture Maduro, expanding on earlier accounts from officials that acknowledged support without explaining the agency’s entire contribution.

    Joint Chiefs Chairman Gen. Dan Caine previously acknowledged Cyber Command’s participation in the efforts and credited the CIA, National Security Agency and National Geospatial-Intelligence Agency with supporting the Venezuela mission. He described months of intelligence collection on Maduro’s movements and daily routines, but did not directly identify the CIA cyber role Ellis outlined.

    During the capture mission, multiple intelligence agencies established crisis action teams to support Special Operations Command and Southern Command. A U.S. official familiar with the operation previously said the NSA provided geolocation support and monitored communications and signals that could reveal troop movements or plans to activate radar.

    Ellis discussed the operation in explaining the CIA’s recent decision to elevate CCI to a mission center, a change he said gave their cyber operators greater priority and helped align resources around intelligence needs.

    The change has helped the agency “bring cyber operations to bear to solve these tough intelligence problems,” Ellis said. He did not specifically identify the systems targeted or explain how the cyber operations revealed Maduro’s location.

    The CIA primarily executes and coordinates human intelligence gathering overseas, often done undercover. Officers recruit and manage foreign assets to clandestinely gather intelligence on areas like economics and terrorism threats. Much of that work has often involved the use of technology, including computer intrusions.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • China is trying to glean the secrets of U.S. artificial-intelligence models by using simpler AI models to query more advanced American ones, national-security and intelligence agencies warned on Tuesday.

    In a joint advisory, the National Security Agency, Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation said that Chinese companies DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI used “aggressive, malicious, and targeted distillation” tactics to extract billions of tokens from the exchanges within U.S. frontier AI models since 2024, likely with Chinese government awareness.

    Distillation is used to reduce the time and money needed to create a new model.

    “China-based AI companies route distillation requests through multiple pathways to gain unauthorized access, consequently violating U.S. AI companies’ terms of use,” the advisory said. “These pathways include native application programming interfaces (APIs), remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection.”

    It said the distillation campaigns targeted variants of Anthropic’s Claude, OpenAI’s ChatGPT, Google’s Gemini, and SpaceXAI’s Grok.  

    “China-based AI companies deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection,” the advisory said. “They also attempt to distill the best capabilities and proprietary features of each U.S. frontier model to train their China-based AI models. This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership.”

    The agencies recommended three steps for U.S. AI developers: implement comprehensive detection and mitigation, deploy targeted response changes, and establish cross-organization intelligence sharing. 

    White House Office of Science and Technology Director Michael Kratsios in July said Chinese distillation efforts — specifically ones by Moonshot AI — have sought to steal proprietary functions from Anthropic’s advanced Fable model. Anthropic made the same accusations in February.

    Advocacy groups have also requested the White House take stronger action to keep Chinese companies from importing advanced semiconductor chips. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month.

    Image: Shutterstock.com, Kirill Makarov.

    This month’s patch bundle obliterates the software giant’s previous record set in July, when it released updates for at least 570 security vulnerabilities. September’s Patch Tuesday brings this year’s total to more than 2,600, more than twice Microsoft’s previous record-setting patch year in 2020 (1,245) and with three more months to go.

    There are two “zero-day” flaws fixed this month that are being actively exploited: both CVE-2026-81963 and CVE-2026-85880 allow an attacker to elevate their privileges on Windows system.

    Fully 113 of the bugs addressed today earned Microsoft’s “critical” rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable Windows machine with little or no help from the user.

    Among the more serious critical flaws this month is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10. Microsoft warns that an unauthenticated attacker could leverage this weakness simply by sending a specially crafted packet to an affected system, and that it is likely to be exploited.

    Also scary is CVE-2026-69829, a critical, remote code execution flaw in the Windows Shell. This vulnerability has a CVSS base score of 9.8 (10 is the most severe), and can be exploited with low attack complexity, no privileges, and no user interaction.

    Microsoft’s summary of the security updates released today. Image: msrc.microsoft.com.

    Microsoft is hardly alone in shipping monster patch bundles lately. Many other large software companies, including Adobe, Cisco, Google, Mozilla and Oracle, all have recently credited AI-assisted research with increasing their patch cadence and volume (Google said today it is now going to ship security updates every two weeks).

    Tyler Reguly, associate director of security research and development at Fortra, said one core challenge with deploying Windows updates is that they need to be tested before being installed across an organization because not all third-party software works seamlessly in the face of changes to the underlying operating system.

    “It’s time to put our CISOs and CSOs on notice,” Reguly said. “How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.”

    Satnam Narang is senior staff research engineer Tenable. Narang said it’s important to recognize that while the number of vulnerabilities being patched by Microsoft is rising, the number of flaws that can and will affect most organizations remains quite low.

    “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” he said. “It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.”

    Of course, regular Windows users don’t need to test patches before deploying them, but they still need to open Windows Update periodically or else assent to the program’s nag notices about pending updates. And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month.

    Enterprise Windows admins will want to keep an eye on askwoody.com for news of any updates that appear to be causing problems. As always, the SANS Internet Storm Center has a per-patch breakdown ordered by severity and urgency.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The loss of dozens of MQ-9 Reapers to Iranian air defenses is speeding up the U.S. Air Force effort to replace its venerable strike-and-sensor remotely piloted aircraft with something cheaper yet better, service leaders say.

    “As we get to the end of the MQ-9 life, there was some early talk of where do we want to go afterwards, and candidly, as a result of some of the losses that we've experienced in combat operations, that discussion sort of got accelerated,” said Lt. Gen. Christopher J. Niemi, the Air Force’s chief modernization officer, at a Thursday roundtable with reporters.

    The service has lost at least 45 MQ-9s during Donald Trump’s war on Iran, roughly one-quarter of its fleet, the Washington Post reported in August. It’s not clear just how much that fleet cost, but an Air Force fact sheet puts the unit cost of one MQ-9 variant at $51 million in 2011 dollars—or nearly $82 million today.

    Niemi said the service wants to buy at least 180 MQ-9 replacements, dubbed Massed Modular Aircraft, or MMA, and at a much cheaper price point. He said the price of one MMA should be about half of the $20 million Collaborative Combat Aircraft, whose first production contracts were awarded in June, four months ahead of schedule.

    But those rough price goals—$20 million for a CCA, $10 million for an MMA—are for bare airframes, not the pricey sensors and systems that enable the drones to do their jobs. 

    As a service spokesperson put it later, the numbers “do not refer to total missionized costs.”

    Niemi said this reflects lessons from past and ongoing wars.

    “What we're seeing, in part based on our assessment of the threats around the world, and in part based on our real-world experience, is that you're going to lose more military hardware in future conflicts than you have historically, and that's what's driving us to this sort of fundamental principle that we need things that are easier to produce, cheaper to buy, and that we can afford to lose more of them,” he said. “Right now, we don't have a whole lot of that, so we're sort of trying to move the needle by bringing on things like MMA, so we have more options for the warfighter in the future.”

    For that $10 million price tag, the service also wants an increased payload of 2,800 pounds and an unfueled combat radius of 2,300 nautical miles and 8,000 nautical miles for a one-way mission, according to a July Defense Innovation Unit solicitation. General Atomics, the Reaper’s manufacturer, has a souped-up version of the MQ-9, the SkyGuardian, which boasts a larger wingspan, range, and endurance. But top service officials don’t seem as likely to bet on it.

    “One of the options that would be considered would be something like an MQ-9B, which is basically an updated and improved MQ-9A, but there are some reasons that we don't think that's the direction that we want to go as an Air Force,” Niemi said. “The main reason is, and and we're seeing this in our experience in the Middle East and as we look at threats around the world, that you need to have a portfolio of assets that's more attritable than the ones we've historically had.”

    General Atomics spokesperson C. Mark Brinkley defended the Reaper’s service record and pointed out that the Air Force’s top uniformed leader has praised the aircraft’s use during Operation Epic Fury. He also said the company has worked with the Air Force “to hit cost targets for three decades” and that it would continue with other programs.

    “The MQ-9’s unique combination of endurance, payload, range, sensors, weapons, connectivity, adaptability and reliability is precisely what enables mission effects that others struggle to replicate,” Brinkley said. “Today’s Reaper isn’t the same Reaper that rolled out 25 years ago. It’s been enhanced and upgraded many, many times. It’s also been called the MVP of Epic Fury, for good reason. We can debate many things, but at least we all agree that it’s a special aircraft that gets the job done.”

    The Senate Armed Services Committee is backing the platform in its version of the 2027 National Defense Authorization Act by placing limits on how many can be retired and calls for more to be purchased by 2028.

    General Atomics has also reportedly teased a new MMA offering with a 10,000-nautical-mile ferry range and claims that it can carry four Long Range Anti-Ship Missiles. Brinkely, while still defending the Reaper, also boosted its next-generation aircraft.

    “Our new Wildfire aircraft addresses all of the concerns posed by the MMA solicitation. We can deliver years earlier and maintain the same high quality,” Brinkley said. “You can have everything that makes Reaper special, plus more, at a price that doesn’t break the bank. Reaper is special. Wildfire is special, too.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶