• Microsoft has announced that Visual Studio Code (VS Code) will apply a two-hour delay before extensions for the integrated development environment (IDE) are updated automatically to a newer version in an attempt to tackle software supply chain threats. “When automatic updates are enabled, new versions are auto-updated two hours after they are published, adding an extra layer of protection

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A newly disclosed red-team tool dubbed “EDRChoker” is drawing attention across the cybersecurity community for its novel approach to disrupting Endpoint Detection and Response (EDR) visibility by abusing Windows Policy-based Quality of Service (quality of service). Unlike traditional EDR evasion techniques that rely on firewall manipulation or Windows Filtering Platform (WFP) rule injection, EDRChoker operates […]

    The post EDRChoker Tool Abuses Windows QoS Policies to Disrupt Endpoint Security Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Anthropic’s Claude Code GitHub Action could unintentionally expose CI/CD workflow secrets when AI agents process untrusted GitHub content. The risk arises because certain tools the agent uses to read files were not sandboxed like subprocess execution paths such as Bash. In particular, the Read tool was able to access /proc/self/environ and returned environment variables, including […]

    The post Microsoft Warns Claude Code GitHub Action May Expose CI/CD Secrets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat researchers have uncovered a novel man-in-the-middle (MitM) attack chain targeting Anthropic’s Claude Code ecosystem, where adversaries hijack Model Context Protocol (MCP) traffic to steal OAuth authentication tokens and persist access to enterprise SaaS platforms. The technique, detailed by Mitiga, abuses weak protections around the local Claude Code configuration file (~/.claude.json), effectively turning it into […]

    The post Hackers Exploit Claude Code MCP Traffic to Hijack OAuth Authentication Tokens appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Free apps available on Samsung, LG, Roku, and other connected TV (CTV) platforms are quietly enrolling users’ smart televisions into a commercial residential proxy network operated by Bright Data, according to a technical investigation published June 5, 2026, by Include Security researcher Buchodi. The embedded SDK, embedded inside partner apps under the guise of a […]

    The post Free Samsung and LG Smart TV Apps Reportedly Exploit Devices for AI Proxy Traffic appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals are already turning the 2026 FIFA World Cup into a fraud opportunity, using phishing pages, fake online stores, and ticket scams to steal money and personal data. The risk is rising because the tournament will attract huge global demand, fast purchases, and buyers who may act quickly before checking whether a site is real. […]

    The post Hackers Exploit 2026 FIFA World Cup With Phishing and Ticket Scams appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OpenAI this week introduced Lockdown Mode, a security-focused setting for ChatGPT designed to reduce the risk of data exfiltration from prompt-injection attacks. The feature is rolling out to eligible personal accounts (Free, Go, Plus, Pro) and self-serve ChatGPT Business workspaces, and managed-workspace administrators can assign a Lockdown Mode role to members. Prompt injection is a […]

    The post New ChatGPT Lockdown Mode Aims to Block Prompt Injection and Data Exfiltration Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Navy would have to detail its plans to buy and use seagoing drones under a suite of provisions in the House Armed Services Committee’s draft 2027 defense policy bill. 

    The bill, which passed out of committee late Thursday, would require service leaders to devise a plan to buy, sustain, and operate small unmanned surface vessels—ones weighing less than 50 metric tons and no more than 50 feet long. 

    The plan would have to include a detailed inventory of each acquired USV, the types of missions the Navy would use USVs for, how they would work with crewed vessels, and how they would be integrated with current command and control, intelligence, surveillance, and reconnaissance, and logistics infrastructure.

    The bill would also require the Navy to develop plan to “accelerate procurement and integration of commercially available sUSVs.”

    The committee wrote in direct reporting language that buying more commercially available “technologies and platforms could enhance fleet readiness, reduce developmental timelines, and lower overall costs compared to government designs” especially amid “the increased demand from multiple geographic Combatant Commands for additional sUSVs to meet a variety of urgent mission needs.” 

    The provisions would also require the Navy to submit a report to identify obstacles to buying commercially available small USVs . 

    The proposals come just weeks after the Navy released its latest 30-year shipbuilding plan, which outlined its intentions to include hundreds of unmanned surface vessels in its hull count. They also come as the Pentagon prepares to spend more on unmanned vessels. 

    A separate requirement targets operational autonomy, tasking the Navy with certifying that procured drone boats can function “during periods in which communications capabilities are denied, degraded, intermittent, or limited; and (2) during periods in which positioning, navigation, and timing capabilities are degraded or unavailable,” according to the bill. 

    “The Secretary of the Navy would also be required to develop and implement a strategy for the integration of unmanned surface vessels naval force design and joint maritime operations. The Secretary of the Navy would be required to submit a report to the congressional defense committees not later than 210 days after the date of the enactment of this Act on the strategy for unmanned surface vessel integration and provide an annual brief on integration efforts thereafter.”

    Like the Navy’s shipbuilding plan, the HASC’s draft of the 2027 National Defense Authorization Act notes undersea drones’ usefulness in maritime operations and pushes the Navy to adopt and integrate the extra-large unmanned underwater drones that have already been tested. 

    “The Committee further encourages the Secretary of the Navy to accelerate adoption of the XLUUV platforms selected through the Combat Autonomous Maritime Platform program’s 2025 competitive process to transition these systems from experimentation to operational deployment and to equip priority commands with the capabilities required to meet Fleet demands,” lawmakers wrote. “Therefore, the committee directs the Secretary of the Navy to provide a briefing to the House Committee on Armed Services not later than March 1, 2027, outlining plans to accelerate the adoption and fielding of XLUUVs and associated payloads utilizing existing production contracts,” including fielding timelines. 

    The bill also includes a requirement for the head of Special Operations Command to brief Congress by Dec. 1 on the need for a “hybrid-electric amphibious seaplane” which could “provide a viable solution by enabling fixed-wing aircraft to operate from waterways, runways, and unimproved surfaces with increased combat radius, reduced fuel consumption, and lower acoustic and thermal signatures.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Organizations representing federal workers and good government advocates were quick to decry President Trump’s move this week to formally strip around 8,000 federal workers of their civil service protections, making them at-will employees, though the exact contours of the initiative’s scope remain unclear.

    Wednesday’s executive order implements Schedule Policy/Career, a new job category within the excepted service — formerly known as Schedule F — designed for career employees in “policy-related” positions who lack the removal protections in Title 5 of the U.S. Code and of the right to appeal adverse personnel actions. Under Office of Personnel Management regulations that took effect in March, whistleblower complaints from Schedule Policy/Career employees would no longer go to the U.S. Office of Special Counsel, instead being referred internally to the employing agency’s general counsel for review.

    The edict tasks agencies with reclassifying the roughly 8,000 federal workers into Schedule Policy/Career within seven days — by June 10 — as well as set up a separate bonus pool for those workers to recognize “outstanding work.” And OPM is expected to propose new regulations setting up a new governmentwide presidential award program for the job category.

    Has the return of Schedule Policy/Career affected you or your work? Reach out to Erich Wagner at ewagner@govexec.com or ewagner.47 on Signal to share your story.

    A 200-page appendix accompanying the executive order lists the various positions slated for conversion, subdivided by agency and subcomponent and accompanied by position codes used on an internal basis. As such, the veracity of administration officials’ claims regarding the precise number of impacted employees, or that 97% of them occupy GS-15 or Senior Leader pay grades, remains murky.

    The State Department told employees in an email Thursday that Trump placed 100 positions into Schedule Policy/Career with Wednesday’s order but did not specify how many employees would be affected.

    “Employees encumbering these crucially important positions will be notified by the Bureau of Human Resources within seven work days,” the email stated. “These changes will allow the department to reward high performance and ensure that we are well equipped to promptly and effectively address poor performance and misconduct. These roles remain career positions and will continue to be filled through merit-based hiring procedures.”

    The nonprofit Protect Democracy on Thursday solicited federal employees whose jobs appear in the executive order’s appendix to provide information about their position and duties to better ascertain its scope.

    A Defense Department employee, who declined to be named for fear of retaliation, told Government Executive that while they were not personally set for reclassification into Schedule Policy/Career, each of their supervisors are. None of them influence policy, they said.

    “First line supervisors are responsible for the oversight of their employees’ projects and the successful execution of those,” the employee said. “They hire and evaluate their direct reports annually and handle execution of disciplinary actions as needed. They have ZERO authority to establish policy. All of that is dictated down to them from their senior leadership.”

    Federal employee unions have filed multiple lawsuits challenging the legality of Schedule Policy/Career, filed last year but effectively held dormant until the policy was set for implementation. In statements Thursday, their leaders vowed to block it in court.

    “The administration continues to focus on trying to strip federal workers of the rights that Congress gave them instead of letting them do the jobs that the American people count on them to do,” said National Treasury Employees Union National President Doreen Greenwald. “Now that the administration has officially ordered the transfer of an untold number of employees to Schedule Policy/Career—so that they are, in the administration's view, easier to fire—the litigation surrounding this initiative will resume. NTEU looks forward to aggressively pursuing that litigation and fighting to ensure the American people have their government services delivered by federal employees who were hired based on merit and skill, not partisan affiliation.”

    “The practical implications of this action are clear,” said Everett Kelley, national president of the American Federation of Government Employees. “Workers who once felt comfortable reporting waste, fraud, abuse and mismanagement at their place of employment because they were protected from retaliation will now be afraid for their jobs if they speak out. That is a disservice to them and to the millions of Americans who rely on the federal government every day.”

    And while it appears those legal challenges are set to finally kick off, Stephanie Rapp-Tully, partner at federal employment law firm Tully Rinckey, PLLC, while some may try to challenge their reclassification before the Merit Systems Protection Board, it could take some time before individual employees can file litigation of their own.

    “For an individual to bring an action, they have to have suffered a harm,” she said. “You could be reclassified as Schedule F and maintain your employment, never face an adverse action and retire as planned. That could be your trajectory—you don’t know. It’s not until they pursue an adverse action that someone has suffered a damage.”

    A perhaps overlooked change for Schedule Policy/Career employees is the inability to respond to a proposed adverse personnel action before it takes effect.

    “Agencies are not required to provide advanced notice or ally for a written reply on any disciplinary or adverse actions,” Rapp-Tully said. “[They’re] also not entitled to see the evidence against them, which is a huge component . . . and they couldn’t appeal agency decisions to the MSPB. It’s the true definition of at-will.”

    NextGov/FCW reporter David DiMolfetta contributed to this report. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The complexity of modern software development requires security to be deeply embedded within the engineering pipeline rather than treated as an afterthought. With modern applications consisting of over 80% open-source components, the attack surface has shifted drastically. Whether you are managing extensive codebases or integrating third-party APIs, catching flaws before code is compiled is crucial. […]

    The post Top 10 Best Software Composition Analysis (SCA) Tools for Security Teams in 2026 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶