• TP-Link has revealed a critical vulnerability in Kasa smart home devices that could allow an attacker on the same local network to intercept, replay, or forge control messages, potentially manipulating affected products. This issue, tracked as CVE-2026-76784, arises from inadequate cryptographic protections in the protocol used for local communications among Kasa devices. TP-Link has assigned […]

    The post TP-Link Kasa Smart Home Flaw Lets Attackers Forge Control Messages and Take Control of Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PHILADELPHIA—The Trump administration is dialed in on increasing domestic production of critical minerals needed for military weapons. But getting private investment in the industry is tough because of how long it can take for companies to start making money.

    “We all know the critical minerals issue is front and center. It's the president's maybe No. 1 issue for the defense industrial base and for national security—and it takes a lot,” Kyle Bass, who leads Rochefort Asset Management, said during the Defense Industrial Base Accelerator conference here Wednesday. “The way that we have looked at it—and the reason we haven't done any critical mineral deals yet, and we've looked at a bunch of them—is that duration mismatch,” when the timeline to access liquid capital is constrained. 

    The firm has put about $450 million in the past 18 months into “companies that have products, customers, and some revenue,” Bass said. “They're right in that acceleration phase where they're still losing money, typically, but their revenues are growing and they're still staffing. That's where we plug in and help catalyze their growth.”

    But private investment can follow once the government puts in capital—or sends a strong demand signal. A recent Center for Strategic and International Studies report looked at how publicly traded companies increased their capital expenditures 31 percent in the second quarter year-over-year after signing long-term framework agreements with the government. 

    And the Pentagon has made several investments in critical minerals companies in recent years. 

    For example, last year, the Pentagon took a 40 percent stake in Korea Zinc as part of a $7.4 billion move to build a new critical mineral processing plant in Tennessee, part of a broader push to reduce U.S. foreign dependency on rare earth and critical minerals. That deal also included private investments. 

    “That capital was asked to come in by the offtakers and the U.S. government because of that duration mismatch, it's too long,” Bass said.

    The Pentagon has about $5 billion in reconciliation funds to invest in critical mineral supply chains through fiscal year 2029. And there’s no shortage of domestic critical minerals companies, but they’re destabilized by China’s much-cheaper market, Michael Cadenazzi, the Pentagon’s head of industrial base policy, said while onstage with Bass.

    “In putting our RFIs out constantly, we find there are lots and lots of companies that are in the space. They're just undercapitalized because people struggle with a market where our No. 1 strategic competitor undercuts us,” he said.  

    Bass agreed and said “predictability”, such as with orders or pricing, will be key to getting more private capital investment in critical minerals.

    “We have plenty of critical minerals in North America. We just need to build big processing facilities. And that Korea Zinc facility in Tennessee is going to be huge—but it won't be operational for another four years, or five years,” he said. “So that, again, that mismatch is the hard part because…it's a race at the moment, and we have to win that race.”

    Welcome

    You’ve reached the Defense Business Brief, where we dig into what the Pentagon buys, who they’re buying from, and why. Send along your tips, feedback, and song recommendations to lwilliams@defenseone.com. Check out the Defense Business Brief archive here, and tell your friends to subscribe!

    Hello from the city of brotherly love—and defense industry reinvigoration! This week, the Pentagon’s industrial policy shop kicked off its first Defense Industrial Base Accelerator event in Philadelphia’s city center. It was an easy Acela ride up for day two of a three-day conference where attendees seemed cheery! Eager to mingle and make new connections. I had great impromptu conversations about manufacturing—specifically forging!—quantum sensors, computing, and the changing dialogue around the field.

    Besides the vibes, here were my key takeaways:

    • Critical minerals was a major theme. 
    • The event drew about 2,500 registered attendees. And the sessions were packed, some with standing room only.
    • This was not a heavily government attended event—fewer than 400 registrants were from the government.
    • Attendees hailed from the aerospace and defense industries, consulting, engineering, software, manufacturing, and venture capital.
    • Cadenazzi told Defense One the aim was to “unify” all of the separate industry policy efforts into a singular “voice.” And they hope to do it again. 

    An easy button for financial documentation? The Energy Department is spearheading a pilot program that aims to streamline how businesses looking for financing submit their data. 

    • “From the financing perspective, one of the things we struggle with is you have borrowers, U.S. businesses, who are going to multiple agencies and sort of shopping their materials because they don't know a better front door,” Asad Akram, managing director of the Pentagon’s Office of Strategic Capital, said during a panel at the DIBX event. 
    • “So one of the things that DOE has started piloting—that's not fully live yet—is essentially the college common app version of financing.” The tool could cut down on red tape for businesses that want to work with the government.
    • “Roughly all the financing agencies are looking for the same info…So we're trying to make it better for borrowers, where they can upload it once all of us can have access to it, and then work off of that versus them having to repeat their pitch 12 times across DC.”

    And one last DIBX thing: The Pentagon awarded six out of nine companies a total of around $25 million during Wednesday’s event. Several tackle critical mineral harvesting and processing—5N+ Semiconductors, $7.3 million, Graystone Resources, $6.75 million, and Kunin Technologies, $1.9 million. Two winners immediately stood out: Senra Systems, $4.4 million, with their wire harness manufacturing in a box technology, and Neya Systems’ autonomous fuel transport offering that aims to use unmanned ground and maritime vehicles from AM General and Textron, respectively. Their award was for $5.9 million.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A Russian-speaking affiliate of the Aurora ransomware operation compromised more than 20 organizations across nine countries between April and July 2026, using the AI coding assistant Cursor to plan intrusion activity and Active Directory escalation. The exposed server offered an unusually complete view of a ransomware affiliate’s operational workflow. It contained victim-specific directories, shell history, […]

    The post Ransomware Hacker Uses AI to Plan Attacks and Compromises More Than 20 Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2019-1068, a remote code execution vulnerability affecting Microsoft SQL Server, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. This vulnerability allows an attacker to execute code in the security context of the SQL Server Database Engine service account. Microsoft SQL Server […]

    The post CISA Warns of Actively Exploited Microsoft SQL Server RCE Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Justice Department and the FBI have seized domains associated with two hacking platforms linked to China, QScan and QTRouter. This court-authorized operation aims to disrupt attacks against U.S. critical infrastructure and sensitive government networks. Unsealed court documents from the Southern District of California revealed that these platforms were operated by a state-sponsored group […]

    The post FBI Seizes China State-Sponsored Hacker Platforms Used to Target U.S. Critical Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Menlo Park, California, USA, August 27th, 2026, CyberNewswire AccuKnox today announced the launch of AgentZ, a platform for building, running, and governing AI agents across teams and workflows. AgentZ brings the agent, its execution environment, tools, workflows, permissions, and governance into a single platform, so organizations can move agents from experiment to production without assembling […]

    The post AccuKnox Launches AgentZ to Help Enterprises Build, Run, and Govern AI Agents at Scale appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Veeam has released security updates for a critical vulnerability in Veeam ONE that could allow an unauthenticated network attacker to coerce SMB authentication from the account running an affected service. Tracked as CVE-2026-65641, the vulnerability received a CVSS v4.0 severity score of 9.3. Veeam disclosed the issue through Knowledge Base article 4905, published on August […]

    The post Critical Veeam ONE Flaw Lets Unauthenticated Attackers Coerce SMB Authentication From Service Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • GitLab has released security updates for both its Community Edition and Enterprise Edition, addressing seven vulnerabilities, including a high-severity flaw in its Duo Claude AI agent. This vulnerability could allow authenticated developers to execute arbitrary commands within a CI (Continuous Integration) context. GitLab Duo Claude AI Agent Flaw The issue, tracked as CVE-2026-18252, arises from […]

    The post GitLab Duo Claude AI Agent Flaw Lets Attackers Execute Arbitrary Commands in CI Pipelines appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Academic researchers have disclosed a Rowhammer attack impacting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes (ECC), the mitigation NVIDIA recommends against GPU Rowhammer, and enables denial-of-service (DoS) and privilege escalation to a root shell. Dubbed GPUThor, the attack was developed by researchers at the University of Toronto, who hammered four DRAM

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶