ADMIN.FOUNDATION

  • Charity-Themed Malware Used by Threat Actors to Target Ukraine’s Defense Forces

    ·

    , ,

    Ukrainian cybersecurity authorities have uncovered a sustained, targeted campaign against Ukraine’s defense forces, orchestrated by Russian-affiliated threat actors that disguise malware distribution as charitable donation requests. Between October and December 2025, the National Cyber Incident Response Team of Ukraine (CERT-UA) and the Armed Forces Cyber Incident Response Team documented multiple coordinated attacks leveraging a Python-based […]

    The post Charity-Themed Malware Used by Threat Actors to Target Ukraine’s Defense Forces appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Desktop Window Manager Zero-Day Exploited in Active Attacks

    ·

    , , ,

    Microsoft has disclosed a critical information disclosure vulnerability in the Desktop Window Manager that threat actors are actively exploiting. The vulnerability, tracked as CVE-2026-20805, was publicly released on January 13, 2026, and allows authenticated local attackers to access sensitive information without user interaction. The vulnerability exists in Microsoft’s Desktop Window Manager, a core system service […]

    The post Microsoft Desktop Window Manager Zero-Day Exploited in Active Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Node.js Security Release Fixes 7 Vulnerabilities Across All Supported Versions

    ·

    , , , ,

    The Node.js project has released critical security updates addressing multiple vulnerabilities affecting all active release lines. On January 13, 2026, the Node.js team announced patches for versions 20.x, 22.x, 24.x, and 25.x, tackling three high-severity issues, four medium-severity issues, and one low-severity vulnerability. These updates include dependency patches for c-ares and undici, resolving public vulnerabilities […]

    The post Node.js Security Release Fixes 7 Vulnerabilities Across All Supported Versions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • An AI-Driven Game-Theoretic Approach to Attack and Defense

    ·

    , ,

    A new research effort from Alias Robotics and Johannes Kepler University Linz proposes a game-theoretic “brain” for cybersecurity AI, aiming to push automated penetration testing and defense planning beyond human-level performance. The work introduces Generative Cut-the-Rope (G-CTR), a guidance layer that sits on top of Large Language Model (LLM)-driven agents and tells them which attack […]

    The post An AI-Driven Game-Theoretic Approach to Attack and Defense appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces

    ·

    The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between October and December 2025. The activity has been attributed with medium confidence to a Russian hacking group tracked as Void Blizzard (aka Laundry Bear or UAC-0190). The threat actor is believed to be active since at least

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • FortiOS and FortiSwitchManager Flaw Allows Remote Code Execution

    ·

    , , ,

    A high heap-based buffer overflow vulnerability in the cw_acd daemon component of Fortinet’s FortiOS and FortiSwitchManager has been disclosed, enabling remote unauthenticated attackers to execute arbitrary code on affected systems. The vulnerability, tracked as CVE-2025-25249, carries a high CVSS v3.1 score of 7.4 and poses significant risk to enterprise network infrastructure. Vulnerability Details The flaw […]

    The post FortiOS and FortiSwitchManager Flaw Allows Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Magecart Campaign Steals Credit Card Details During Online Checkouts

    ·

    ,

    Cybersecurity researchers at Silent Push Preemptive Cyber Defense have uncovered an extensive and sophisticated web-skimming campaign that has been actively stealing credit card data from e-commerce websites since at least January 2022. The ongoing operation, operating under the umbrella term “Magecart,” targets multiple major payment networks including American Express, Diners Club, Discover, Mastercard, JCB Co., […]

    The post New Magecart Campaign Steals Credit Card Details During Online Checkouts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft January 2026 Patch Tuesday Fixes 114 Flaws, Including 3 Zero-Days

    ·

    , , , ,

    Microsoft has released its January 2026 Patch Tuesday security updates, addressing 114 vulnerabilities across Windows, Office, and other products. The update includes three actively exploited zero-day vulnerabilities and 12 critical-severity flaws that require immediate attention from system administrators. The January 2026 release addresses a diverse range of security issues, with elevation of privilege vulnerabilities representing […]

    The post Microsoft January 2026 Patch Tuesday Fixes 114 Flaws, Including 3 Zero-Days appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Patch Tuesday, January 2026 Edition

    ·

    , , , , , , , , , , , , , , , , , , ,

    Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft’s most-dire “critical” rating, and the company warns that attackers are already exploiting one of the bugs fixed today.

    January’s Microsoft zero-day flaw — CVE-2026-20805 — is brought to us by a flaw in the Desktop Window Manager (DWM), a key component of Windows that organizes windows on a user’s screen. Kev Breen, senior director of cyber threat research at Immersive, said despite awarding CVE-2026-20805 a middling CVSS score of 5.5, Microsoft has confirmed its active exploitation in the wild, indicating that threat actors are already leveraging this flaw against organizations.

    Breen said vulnerabilities of this kind are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits.

    “By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack,” Breen said. “Microsoft has not disclosed which additional components may be involved in such an exploit chain, significantly limiting defenders’ ability to proactively threat hunt for related activity. As a result, rapid patching currently remains the only effective mitigation.”

    Chris Goettl, vice president of product management at Ivanti, observed that CVE-2026-20805 affects all currently supported and extended security update supported versions of the Windows OS. Goettl said it would be a mistake to dismiss the severity of this flaw based on its “Important” rating and relatively low CVSS score.

    “A risk-based prioritization methodology warrants treating this vulnerability as a higher severity than the vendor rating or CVSS score assigned,” he said.

    Among the critical flaws patched this month are two Microsoft Office remote code execution bugs (CVE-2026-20952 and CVE-2026-20953) that can be triggered just by viewing a booby-trapped message in the Preview Pane.

    Our October 2025 Patch Tuesday “End of 10” roundup noted that Microsoft had removed a modem driver from all versions after it was discovered that hackers were abusing a vulnerability in it to hack into systems. Adam Barnett at Rapid7 said Microsoft today removed another couple of modem drivers from Windows for a broadly similar reason: Microsoft is aware of functional exploit code for an elevation of privilege vulnerability in a very similar modem driver, tracked as CVE-2023-31096.

    “That’s not a typo; this vulnerability was originally published via MITRE over two years ago, along with a credible public writeup by the original researcher,” Barnett said. “Today’s Windows patches remove agrsm64.sys and agrsm.sys. All three modem drivers were originally developed by the same now-defunct third party, and have been included in Windows for decades. These driver removals will pass unnoticed for most people, but you might find active modems still in a few contexts, including some industrial control systems.”

    According to Barnett, two questions remain: How many more legacy modem drivers are still present on a fully-patched Windows asset; and how many more elevation-to-SYSTEM vulnerabilities will emerge from them before Microsoft cuts off attackers who have been enjoying “living off the land[line] by exploiting an entire class of dusty old device drivers?”

    “Although Microsoft doesn’t claim evidence of exploitation for CVE-2023-31096, the relevant 2023 write-up and the 2025 removal of the other Agere modem driver have provided two strong signals for anyone looking for Windows exploits in the meantime,” Barnett said. “In case you were wondering, there is no need to have a modem connected; the mere presence of the driver is enough to render an asset vulnerable.”

    Immersive, Ivanti and Rapid7 all called attention to CVE-2026-21265, which is a critical Security Feature Bypass vulnerability affecting Windows Secure Boot. This security feature is designed to protect against threats like rootkits and bootkits, and it relies on a set of certificates that are set to expire in June 2026 and October 2026. Once these 2011 certificates expire, Windows devices that do not have the new 2023 certificates can no longer receive Secure Boot security fixes.

    Barnett cautioned that when updating the bootloader and BIOS, it is essential to prepare fully ahead of time for the specific OS and BIOS combination you’re working with, since incorrect remediation steps can lead to an unbootable system.

    “Fifteen years is a very long time indeed in information security, but the clock is running out on the Microsoft root certificates which have been signing essentially everything in the Secure Boot ecosystem since the days of Stuxnet,” Barnett said. “Microsoft issued replacement certificates back in 2023, alongside CVE-2023-24932 which covered relevant Windows patches as well as subsequent steps to remediate the Secure Boot bypass exploited by the BlackLotus bootkit.”

    Goettl noted that Mozilla has released updates for Firefox and Firefox ESR resolving a total of 34 vulnerabilities, two of which are suspected to be exploited (CVE-2026-0891 and CVE-2026-0892). Both are resolved in Firefox 147 (MFSA2026-01) and CVE-2026-0891 is resolved in Firefox ESR 140.7 (MFSA2026-03).

    “Expect Google Chrome and Microsoft Edge updates this week in addition to a high severity vulnerability in Chrome WebView that was resolved in the January 6 Chrome update (CVE-2026-0628),” Goettl said.

    As ever, the SANS Internet Storm Center has a per-patch breakdown by severity and urgency. Windows admins should keep an eye on askwoody.com for any news about patches that don’t quite play nice with everything. If you experience any issues related installing January’s patches, please drop a line in the comments below.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Three ‘meta trends’ are reshaping warfare, INDOPACOM commander says

    ·

    HONOLULU—Five years ago, when then-Adm. Phil Davidson told senators that China would attempt to seize Taiwan as early as 2027, “it seemed like it was a good long way out,” Adm. Sam Paparo said Monday.

    “And the danger in that was that we thought that it was some holiday that we had until 2027 for ourselves. But there could be a war of, quote, necessity, anytime between now and Aug. 1 of 2027, and there can be a war of choice anytime after August of 2027,” the leader of U.S. Indo-Pacom Command told a standing-room-only audience at the Honolulu Defense Forum, referring to the 100th anniversary of the founding of the People’s Liberation Army.

    “We have to be ready now, we have to be ready in 2027, we have to be ready in 2028.”

    One way the command will prepare is by incorporating information operations into “every plan, every investment, every operation,” Paparo said. “We don’t bolt information operations on the end. We integrate and suffuse it from the very start.”

    Information operations, cognitive operations, and cyber operations as a “salient form of warfare” is one of three “meta trends” Paparo said are reshaping modern conflict.

    “Entities can exploit the information environment where perceptions can outpace facts and disrupt decision making—often without firing a shot,” he said.

    [[Related Posts]]

    At the forum, Palauan President Surangel Whipps described Chinese efforts to sour his country’s populace on its relationship with the United States and its decision to recognize Taiwan as a sovereign nation. 

    “The narrative that’s being taught [is] that the U.S. militarization of Palau has put a target on Palau, and really that’s a false narrative,” Whipps said. “Because whether the U.S. is helping improve ports, helping improve airports, building over-the-horizon radar, the opportunity is to ensure that we are protected.”

    China also reminds Palau that “2027 is coming soon, and soon you won’t have a partner,” Whipps said. “They basically tell us, ‘If you don’t denounce [Taiwan] and join us now, you’ll be left out in the cold.’”

    But unlike China, which invests billions of dollars globally on messaging and information operations, in the United States that has “always been something that was sprinkled on top of an existing policy, rather than conceived of… a really central domain of competition, which it is, and Beijing absolutely sees it that way,” Ely Ratner, the former assistant defense secretary for Indo-Pacific security affairs, told Defense One.

    Ratner praised Paparo’s decision to prioritize information operations, though he pointed out that the entire United States government needs a strategy.

    “China’s ability to shape the narrative really does have an enormous effect on the behavior of other countries,” he said, but noted that unlike China, which has built a false image of itself and maligned the United States in its messaging, the United States does not need to engage in disinformation.

    “It’s just about really being clear about the kinds of things that China is doing around the world, and doing it in an effective way, such that it resonates with governments and populations in key regions,” he said. 

    And the messaging must be backed up by real policy. But the Trump administration has been moving in the opposite direction, shuttering the State Department office responsible for countering false narratives and gutting the U.S. Agency for Global Media.

    Paparo also advocated for a whole-of-government approach.

    “The military has a significant role in this, but frankly, it is the elected civilian leaders. It is our diplomats. It’s our other instruments of national power that have an even greater role,” he said. “We’ve got to attack this.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶