• Hackers increasingly rely on vulnerable, legitimately signed Windows drivers to neutralize endpoint defenses, turning defense evasion into a decisive phase of modern ransomware attacks. Over the past three years the Bring Your Own Vulnerable Driver (BYOVD) technique has migrated from research proof-of-concept into a commoditized, routinely deployed capability in ransomware-as-a-service toolkits. By abusing signed kernel […]

    The post Hackers Use Vulnerable Windows Drivers to Kill EDR in Ransomware Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake “prove you’re human” pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise. The same research also turned up a new delivery method built to slip past Windows’ script scanning.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Department of Commerce has recently lifted export controls on Anthropic’s advanced AI models, Claude Fable 5 and Mythos 5, following a series of security and compliance commitments made by the company. This decision represents a significant shift in the regulatory landscape surrounding frontier artificial intelligence systems, particularly those that could be used for […]

    The post U.S. Commerce Withdraws Export Controls on Anthropic Claude Models After Security Commitments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Apache Software Foundation has disclosed two security vulnerabilities in Apache Tomcat that can lead to authentication bypass and improper enforcement of security constraints. These vulnerabilities impact various deployments across enterprise environments. They are tracked as CVE-2026-55957 (Important severity) and CVE-2026-55956 (Moderate severity) and affect multiple supported versions of Tomcat. If left unpatched, these issues […]

    The post Apache Tomcat Vulnerabilities Let Attackers Bypass Authentication and Security Constraints appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition. The vulnerabilities are listed below – CVE-2026-8451 (CVSS score: 8.8) – An insufficient input validation

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Amazon Web Services and Anduril are combining the tech giant’s on-site cloud computers and the defense contractor’s mobile data center to bring edge computing to the frontlines. Both have already been used during the Iran war.

    Anduril’s containerized command and data center, Menace-I, can now be outfitted with Amazon Web Services’s Outpost, the two companies announced Tuesday. With two people, the mobile data center “can stand up in under 10 minutes and moves by truck, rail, airlift, or helicopter sling load,” the company said in a press release.

    “Whether it's an intelligence analyst in the field or whether it's a flightline operator, someone who's literally trying to get information off of the system, the sensor, and making a meaningful decision about it. What's really different, and what we're seeing is this ruggedized edge,” said Liz Martin, AWS’ global defense managing director and general manager. “It takes very many shapes.”

    During a panel at the AWS Summit in Washington, D.C. on Tuesday, an Anduril company executive told reporters that Menace-I had been used during Operation Epic Fury and the containerized command center has been deployed with the Army, Air Force, Marines, and Navy. AWS Outpost has also been deployed in the region, but in protected structures, Martin said. Combining the two together would allow the U.S. military and other defense buyers to put cloud computing as close to the battlefield action as possible and cut down on the time it takes to transfer data in combat. 

    On Tuesday, AWS named the California-based contractor its “preferred edge provider” for defense customers.

    “We're bringing that cloud capability, we're bringing it down to the edge, and then we're enabling you to run applications that may exist in the cloud down at the edge to provide data down at the edge, or to send things from the edge up to the cloud, where they can be analyzed,” said Tom Keane, Anduril’s senior vice president of engineering. “What we're doing is we're providing capabilities for commanders that today they either don't have or are simply too expensive and too difficult for them to practically field and use in real world.”

    Anduril’s containerized command center was first launched in 2022. Last year, U.S. Marines strapped a Menace-I onto a CH-53K King Stallion helicopter for transport. 

    It’s not clear how survivable the shipping container data center would be on the battlefield. During Operation Epic Fury, six U.S. Army reservists were killed when a makeshift operations center fortified by concrete walls was hit in an Iranian attack.

    “I think part of what we're seeing in the world right now is a desire to be distributing many systems, as opposed to a singular, highly resilient system,” Keane said. “The idea of distribution as a mechanism for fault tolerance, having many, is becoming increasingly important, is what we're hearing from our customers, as opposed to having a singular thing that is immensely and infinitely robust.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Amazon Web Services on Tuesday announced a new cloud offering designed to run contractor-owned classified workloads, a first for the defense industrial base and select research institutions that historically have had to build and maintain costly on-premesis infrastructure to support classified programs.

    The AWS Secret Cloud for Industry, or ASCI, is designed to reduce the provision time for classified environments up to the Secret classification level from months to days, according to Dave Levy, vice president of AWS Public Sector. The cloud is designed for cleared U.S. defense contractors, research institutions, and other organizations in the National Industrial Security Program.

    "America's defense industrial base builds the capabilities that keep this nation safe, and it's time they have the tools to match the urgency of the mission," Levy said. "AWS Secret Cloud for Industry puts the full power of cloud computing and AI directly into the hands of the engineers and scientists working on our most sensitive programs. Now, the defense industrial base can innovate at the speed the moment demands, using the same classified infrastructure trusted by the Department of War.”

    AWS Secret Cloud for Industry now holds a provisional authorization at the Impact Level 6, or IL6—the standard for Secret-classified information—and leverages the Defense Counterintelligence and Security Agency compliance framework that cleared contractors and personnel already use for on-premesis classified systems to the cloud.

    Northrop Grumman is the first defense contractor to deploy classified workloads on ASCI. Without the purpose-built cloud, their initial workload in the AWS Secret-East Region would have taken months.

    “Migrating our critical classified programs to the AWS Secret Cloud for Industry solution fundamentally changes how we develop and scale sensitive programs at speed to deliver when it matters most,” Drew Barnes, vice president of IT infrastructure and operations at Northrop Grumman, said in a statement.

    In a press call with reporters in advance of the AWS Summit in Washington, D.C., Levy said there has been “a lot of demand for a solution like this for a long time.”

    "I’m excited that we, along with the government and the DIB, have been able to figure it out,” said Levy, crediting the Defense Information Systems Agency and DCSA for their partnership in the yearslong effort. 

    During a keynote speech at AWS Summit, Levy also announced the ASCI Accelerator Initiative, providing up to $20 million to qualified DIB contractors, federally funded research and development centers, independent software vendors and system integrators. Levy said the funding will help select organizations migrate classified workloads to the cloud and improve mission outcomes.

    That announcement follows a $50 billion investment the company made in November to improve AI and supercomputing infrastructure for U.S. federal agencies.

    “We're also investing up to $50 billion to expand AI and supercomputing infrastructure across all GovCloud, secret and top-secret regions,” Levy said. “The goal is to provide 1.3 gigawatts of AI capacity, making a generational commitment to the future of government that government runs on secure, intelligent cloud.”

    A 15-year focus on government

    AWS launched AWS GovCloud (US-West) — the first cloud infrastructure designed for government customers—in 2011, providing many federal agencies with their first opportunity to shift workloads to the cloud. In 2013, AWS inked a groundbreaking $600 million contract, C2S, with the CIA to supply commercial cloud services to all 18 intelligence agencies.

    The cloud provider later launched its first secret cloud region in 2017. It also operates multiple top-secret regions and has been awarded multiple major, multi-billion dollar contracts, including the C2E contract from the intelligence community, as well as the Joint Warfighting Cloud Capability contract for the Defense Department and the National Security Agency’s “Wild and Stormy” contract. Today, nearly all U.S. federal agencies are AWS customers in some capacity, along with some 15,000 government agencies across the globe. 

    Last August, AWS worked with the General Services Administration—through its OneGov program—to discount $1 billion worth of its software to customers across the federal government through December 2028. The discounts have provided dividends for AWS.

    “We’ve seen not just new agencies [coming to AWS], but agencies already doing business with us accelerate their modernization efforts through the OneGov agreement with GSA,” Levy said in an interview Tuesday.

    More investment in the U.S. intelligence community

    Following AWS’ OneGov deal, the company engaged the U.S. intelligence community by proposing a similar effort, according to Levy.AWS on Tuesday announced the result of that engagement: an investment of up to $1 billion in cloud credits to help the 18 agencies within the U.S. intelligence community through October 2030 to modernize their IT systems.

    “It’s like GSA OneGov, but for the IC,” Levy said. “The same $1 billion opportunity we put forth for OneGov, we wanted to do the same thing for the IC.”

    Called the Intelligence Community Accelerated Modernization Framework, or ICAMF, the program makes use of AWS’ existing C2E contract with the U.S. intelligence community to provide credits for qualified workloads “to accelerate cloud migration and modernization” across the IC, according to David Appel, vice president of global government at AWS.

    In a statement, Appel said “outcome-based credits based on post-migration value dramatically lower the financial barrier to moving to the cloud.” In addition, he said the investment would accelerate migration timelines, enable mission-critical capabilities and align investment with outcomes.

    “The ICAMF supports the Intelligence Community's strategic priorities to modernize IT infrastructure, improve data interoperability, and adopt advanced technologies at pace with evolving threats,” Appel said. “The program enables agencies to leverage the most advanced cloud capabilities while achieving meaningful cost efficiencies—delivering improved mission outcomes with the speed and agility that national security demands.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Microsoft research shows how attackers can hijack AI agents that act on a user’s behalf, using nothing more than a poisoned tool description to make the agent quietly hand over company data to an outsider. The trick is that the agent never breaks a rule. Every step looks routine, so in a default setup no alarm may fire. The work comes from Microsoft Incident Response and its

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at QiAnXin’s XLab have tracked it since February 2026, and say the real story is not how big it is today, but how fast it is changing. The end goal is a

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • EvilTokens phishing hides takeover clues until browser execution leaving SOC teams needing deeper visibility to validate threats faster and reduce account risk.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶