• Notepad++ has released version 8.9.7, codenamed “Slava Ukraini.” This update addresses five security vulnerabilities related to session-file handling, environment-variable expansion, ZIP extraction, macro validation, and the Windows installation process. The release date was July 14, 2026, and includes three CVE-tracked vulnerabilities as well as two additional GitHub Security Advisories that have not yet received CVE […]

    The post Notepad++ v8.9.7 Security Update Fixes 5 Vulnerabilities, Including Stack Buffer Overflow and Zip Slip Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting Secure Mobile Access (SMA) 1000 series appliances, one of which could be exploited to achieve arbitrary command execution. The vulnerabilities are listed below – CVE-2026-15409 (CVSS score: 10.0) – A Server-side request forgery (SSRF) vulnerability that a remote unauthenticated attacker could exploit to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A threat campaign discovered in mid-July 2026 abused the compromised Artlist subdomain new-blog. artlist[.]io to distribute a Remote Access Trojan through a fake CAPTCHA prompt. The operation combined stolen WordPress credentials, blockchain-based EtherHiding infrastructure, ClickFix social engineering, DLL side-loading, and a Tor-backed command-and-control fallback. The incident affected a high-value web property. Similarweb data indicates that […]

    The post Artlist ClickFix Campaign Uses Infostealer-Stolen WordPress Credentials to Deploy RAT Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In July 2026, Microsoft addressed a record total of 570 vulnerabilities, including three zero-days, two of which were exploited in the wild and one that was publicly disclosed. The release includes 59 Critical vulnerabilities, with Remote Code Execution (RCE) flaws making up the majority of the Critical-rated issues. It is important to note that the […]

    The post Microsoft Patch Tuesday July 2026 – Record 570 Vulnerabilities Patched appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Following a bumpy NATO conference, air and space military leaders from the United States, United Kingdom, and 50 other countries will gather in London this week to discuss future military strategy as President Trump continues his push for allies to spend more on defense.

    Gen. Kenneth Wilsbach, the U.S. Air Force chief of staff; Gen. Chance Saltzman, the U.S. Space Force’s top uniformed leader; and top U.K. military and government leaders are the scheduled keynote speakers at the Global Air and Space Chiefs’ Conference in London on Wednesday and Thursday. U.K. military leaders plan to discuss strategies for its growing F-35 fleet, some of which will be nuclear-capable for the alliance’s deterrence mission, and will also examine the country’s role in NATO’s Integrated Air and Missile Defence mission.

    “The conference theme explores three key capability areas: space, nuclear, and integrated air and missile defense,” the conference's agenda reads. “These focus areas are critical to the UK and to key partner nations as we develop and deliver domination of the skies and beyond.”

    The meeting follows a NATO conference in Turkey last week where President Donald Trump criticized Spain and said Denmark’s pushback of a U.S. takeover of Greenland is “a big problem for us.” But during private conversations, he reportedly urged cooperation with allies and later said there was “a lot of unity” at the summit. Now, the U.K.’s military air and space leaders are publicly pushing for solidarity ahead of this week’s conference.

    “In 2026, the rate of change in the global strategic environment shows no signs of abating, if anything, the tempo is increasing,” U.K. Air Chief Marshal Sir Harv Smith, the Royal Air Force chief of staff, said in a statement on the conference’s website. “This is the ultimate team game; we cannot do this alone.”

    The U.K. last month unveiled a new defence investment strategy that pushes for major investments in the country’s own autonomous drone wingman program—like the U.S. Air Force—and bolstering its military space capabilities. 

    The strategy followed the resignation of the country’s defense secretary, who protested the U.K.’s initial military spending plan and said in a public letter the country is “unwilling” to support “resources that the nation needs to defend the country at this time of rising threats.” 

    Shortly after the resignation, the country unveiled a new $298 billion plan where U.K. leaders are “investing in UK Space Command to enhance space control” and want to integrate autonomous systems into their army, air, and naval forces.

    “We will build a Hybrid Navy with new autonomous vessels and uncrewed sub-surface vessels, an Army transformed by AI, armed autonomous vehicles and drones, and accelerate the development of a Next Generation Royal Air Force with new autonomous fighter jets capable of operating from land bases or our aircraft carriers,” the summary of the new defence investment plan reads.

    Though the U.S. and U.K. have a longstanding military relationship, the pursuit of those defense investments could signal some instability, said Victoria Samson, the Secure World Foundation’s chief director of space security and stability.

    “I think we've seen, on the continent of Europe, that their concern is that the U.S. is no longer seen as a reliable partner, and that perhaps they need to build their own indigenous capabilities or domestically-built capabilities, And I kind of get the sense from the U.K. there is starting to be some thinking about that. Now, they're much more tightly interwoven into the U.S. military structures,” Samson said. “But I think they're trying to shift to maybe looking for more niche capabilities that they could provide as opposed to being a partner that provides land, and people, and funding, but not actual military hardware.”

    Saltzman and Wilsbach have been meeting with airmen and allies in Europe ahead of the conference.

    The U.S. chief of space operations visited Poland’s Geospatial Intelligence and Satellite Services Agency headquarters in Warsaw and signed a statement of intent that reinforced the two countries “shared commitment to collaboration in the space domain,” he said in a social media post.

    During Saltzman’s remarks in Poland last week, he underscored “that the United States, particularly in the space domain, recognizes that it cannot go alone, it cannot perform the space missions by itself. It needs capable partners in order to accomplish our missions.”

    Prior to the Global Air and Space Chiefs’ Conference, Wilsbach visited troops at Aviano Air Base in Italy, and Royal Air Force Mildenhall and Fairford in the United Kingdom. Wilsbach, in a statement to Defense One, said he’s “really looking forward” to the event.

    “Gatherings like this are important because they give us the opportunity to learn from one another, challenge each other, and strengthen the relationships that bolster our collective security,” he said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already exploiting. The release covers 622 of Microsoft’s own CVEs by its Security Update Guide count, more than triple June’s previous high of around 200. Those two live bugs are the ones to grab first. Microsoft credits incident responders for both. Both are

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • One stubborn former Marine is changing how the Pentagon moves data to farflung troops—a change intended to enable them to use advanced AI tools, and one that just might reshape how lightweight models are developed.

    Some of these new workflows have already been used during the U.S. war on Iran.

    “If you look at what's happened with Operation Epic Fury, in particular, we were able to incorporate dozens of new feeds in real time that allow us to not only serve up that data in the right format, right structure, and everything else for those, for those applications to leverage, but also get data at the speed of conflict,” Cameron Stanley, the Pentagon’s Chief Digital and Artificial Intelligence Officer, said at the AWS Summit in Washington, D.C., last week.

    Stanley was talking specifically about the War Data Platform, a branch of the Pentagon’s Advana data system being developed to digest thousands of data feeds. The WDP is a key part of defense leaders’ plan to use AI to help commanders make decisions faster. 

    But another key to the plan is developing ways to get those tools and that data to troops in and around the battlefield, where connectivity is minimal or absent. Nowhere is the challenge more acute than in Indo-Pacom Command, with its vast distances and powerful potential adversary.

    That’s the main challenge picked up by Bala Selvam, an entrepreneur and a former Marine, when he stepped into the job of chief technical officer for Special Operations Command Pacific in early 2025. 

    A race judged in milliseconds

    When Selvam took the job, he found that the Defense Department’s data workflows were largely being developed in places with excellent networks and plenty of computing resources. That had produced a culture of shipping huge amounts of data with little concern for latency.

    In the continental United States, or even European or Central Command, “It didn't matter because you had all the compute you needed,” Selvam said at the AWS event.

    But that wouldn’t work at INDOPACOM.

    The distance from the command’s Hawaii headquarters to its second-largest data center is 9,000 miles—too far for efficient data transfer, even with low-earth-orbit satellites, Selvam said. 

    Analysis and bureaucracy might stretch the data’s journey by yet more thousands of miles before it gets to warfighters at the edge.

    “If you're SOCOM, it goes back to Tampa, or if you're any other service, back over here”—that is, Washington, D.C..

    All of that was limiting how quickly operators could merge top-secret data and open-source data, analyze it, send it to troops, and share it with partners. The deadline is a matter of milliseconds, with China working 83 percent as quickly. So staying ahead of that number is critical to moving information faster than the adversary. Losing that race just might mean losing a conflict.

    The problem only got harder as more data streams emerged. And it also meant that troops in or near conflicts would be unable to use advanced AI tools that require heavy use of enterprise compute resources.

    The approach

    Rather than try to solve each problem he discovered, Selvam decided to figure out just what everyone actually needed. It’s the kind of analysis that a big U.S. consultancy might require millions of dollars to complete. 

    Selvam started by going to INDOPACOM senior leadership. “‘Write down everything that you expect everyone to do,’” he told them. "I think a list is going to be in the hundreds. It was actually like 10 things.”

    Selvam took this list of “commandments” and worked his way down chains of command, asking everyone to lay out what they were using and how. He found many commanders buying software and tech tools that didn’t match up with what they needed to accomplish.

    One category, in particular, stood out.

    “They kept saying, ‘the AI.’ I got so mad that I said, ‘If you do it, I might, like, throw a wild dog in your house,” he said. “If you're gonna say AI, tell me what exactly you're doing…If you can’t tell me that, you're not using AI.”

    To force commanders to define their tasks, Selvam began to physically deprive them of their technology.

    “I actually almost got, like, fired. I took everyone's computer away, and then I hid it. Then I put whiteboards in everyone's rooms with their actual task. I forced everyone to walk into the [Joint Operations Center] to put in their inputs. When they said the words, ‘I wish I had this technology; I did this virtually,’ I gave them back the computer with only that thing. It was like an Excel sheet and a PowerPoint slide. And then when they said, ‘Man, I wish I could do this faster,’ then I gave them back Palantir and Databricks [a cloud-based data analysis and AI platform] and everything else.”

    For Selvam, this wasn’t about instilling tech discipline; it was implementing business best practices. The process yielded a record of what everyone actually needed to do their jobs. 

    “If you want to know what a good tech company looks like, look at their documentation. Same concept here,” he said. “So, for every bit of our work, we will write processes, procedure business rules, and we will build based on those process procedures or business rules.”

    A key meeting

    Armed with a much better understanding of what people actually needed to get done, Selvam turned his attention to the problem of getting data where it needed to go. For that, he needed help.

    Around January, he traveled to the Crystal City, Virginia, offices of AWS, which makes billions of dollars selling the Pentagon the sort of enterprise cloud capability that won’t be available at the edge of combat. There he met Joshua Hobgood, who leads AWS’ efforts to sell AI-related services to the world’s militaries.

    “I want to solve for AI at the edge,” Selvam told Hobgood, who described the meeting to the AWS Summit audience. Hobgood answered that it was a common problem, to which Selvam replied, “Yeah. But we're going to do it right.”

    Over the next two hours, they hammered out a new plan. First, they would build smaller cloud compute clusters, or nodes, that would require less power and infrastructure, and, hopefully, be harder to target in a conflict. These would be designed to support battalions—a few thousand troops—and would replace larger nodes meant to cover entire divisions of 20,000 or more, Hobgood said.

    He said that making this work will require commanders to follow Selvam’s procedures governing which tools people use and for what purpose. When SOF commanders “give out tasks, they will specifically say, ‘Humans, you will do these [six] out of these 10 tasks…These other four, here's how you're gonna let the [AI] agents take over that.’”

    The next step was to make sure those agents, or whatever other AI tools were running at the edge, were feeding data back to the cloud.

    “We based the solution on the idea that…up to the point of a conflict scenario, there will be connectivity. So we wanted to create a system that could continuously learn,” Hobgood said. “The core assumption to that was that the majority of your AI inference, your data analysis, would happen in the cloud, in the AWS cloud.” 

    But as they worked to flesh out the ideas over the next few months, Selvam and Hobgood realized that AI tools could be built to sip power and compute—and still deliver results to troops in the field.

    “We're at a point where we can use smaller and smaller models…to get, actually get, the best results,” he said.

    That’s going to be vital as the Pentagon works to integrate more and more information into the War Data Platform. In May, the Chief Digital and Artificial Intelligence Office said the WDP was drawing upon some 4,000 data sources from more than 55 organizations.

    “What we're trying to do is really create that single pane of our single repository of truth for a lot of data that was disaggregated and come together into a single platform that allows for very quick connection of data sources to different types of applications,” said Stanley, who leads the CDAO.

    It’s unclear how Selvam’s proposed brigade-sized compute clusters will relate to the platform.

    But, said Stanley, “That's going to become a program of record here pretty soon.”

    Selvam said the effort was supremely worth it.

    “I'm not gonna lie to you; my entire 18 months has been like, ‘If I don't solve the [cloud-defined storage] problem…my life would just be meaningless.’ But if I did solve it, I'm going to put it on my tombstone…It's going to say, ‘I solved the [Department of War] CDS problem.’ That's what it's going to say, I swear to God.”

    Nextgov’s Alexandra Kelly contributed to this story.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.

    A picture of a windows laptop in its updating stage, saying do not turn off the computer.

    Nearly 60 of the bugs quashed in July’s Patch Tuesday earned a “critical” severity rating, meaning miscreants or malware could use them to seize remote control over a Windows device with little or no help from the user. Microsoft also addressed three zero-day flaws that are already being exploited in the wild.

    Two of the zero-day weaknesses allow an attacker to elevate their user rights on a Windows system, as do approximately 250 other elevation of privilege flaws fixed this month; they include CVE-2026-56155 — an Active Directory Federation Services bug — and CVE-2026-56164, a Microsoft Sharepoint vulnerability.

    CVE-2026-50661 is a security feature bypass in Windows BitLocker that could allow attackers to gain access to encrypted data if they have physical access to the device. Microsoft said this bug has been detailed publicly, but that it is not aware of any active exploitation.

    In a blog post on July 9, Microsoft Executive Vice President Pavan Davuluri wrote that Windows users will notice “a higher volume of security updates included in each security release” as a result of AI aiding in the discovery of vulnerabilities.

    “The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis,” Davuluri wrote.

    Jack Bicer, director of vulnerability research at Action1, called attention to CVE-2026-48561, a remote code execution flaw in Microsoft Copilot (with a 9.6 CVSS threat score) that allows an unauthorized attacker to execute code over the network. Microsoft says an attacker could exploit this bug by hosting a malicious website that causes Microsoft Edge for Android to automatically send crafted prompts to Copilot when a user visits the site.

    As AI advances the state of vulnerability discovery and remediation, it is also making it easier for attackers to quickly devise working exploits for known software flaws. Microsoft has long labeled security bugs using its “exploitability index,” which is Redmond’s best guess as to how likely it is that attackers will be able to figure out a reliable way to exploit a given vulnerability.

    But Satnam Narang, senior staff research engineer at Tenable, argues that Microsoft’s exploitability index needs to do a better job of shifting with the machine speed of discovery. For example, Microsoft originally gave this month’s SharePoint zero-day an exploitability rating of “less likely,” although the flaw was added to CISA’s Known Exploited Vulnerabilities list on July 1.

    “Anthropic’s Red Team’s own findings for known vulnerabilities (n-days) revealed how fragile this system has become, with its Mythos Preview model being able to produce proof-of-concept exploits for 13 of 14 vulnerabilities that were rated ‘Exploitation Less Likely’ or ‘Exploitation Unlikely,’” Narang said. “What this means is that our way of looking at Patch Tuesday has changed, because the exploitability index is centered around humans, not AI tools, and as these tools continue to improve, defense needs to improve alongside it.”

    Chris Goettl at Ivanti observed that the record patch numbers from Microsoft come as a number of other major software makers are increasing their patch cadence, including Adobe which announced today it is moving to twice-monthly security bulletins published on the 2nd and 4th Tuesday of each month (Adobe also cited AI for accelerating their patch cycles). Cisco, Mozilla and Oracle also are shipping updates more frequently, while Google’s patch batches in June 2026 totaled more than 900 security fixes, Goettl noted.

    Backing up your Windows system and/or data is always a good idea before applying operating system updates. Given the volume of patches addressed this month it may be wise for end users to wait a few days before applying these fixes. It’s not uncommon for security patches to introduce system stability issues, and those chances probably increase quite a bit with the gigantic patch count released today.

    Further reading:

    Action1’s Patch Tuesday blog

    Automox’s rundown

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SAP has rolled out updates to address multiple vulnerabilities as part of its July 2026 security updates, including a critical flaw in SAP NetWeaver Application Server ABAP. The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Upwind links compromised AsyncAPI npm packages to a coordinated supply chain attack spanning repositories, publishing pipelines, and developer systems at risk.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶