-
Google-owned Mandiant on Friday said it identified an “expansion in threat activity” that uses tradecraft consistent with extortion-themed attacks orchestrated by a financially motivated hacking group known as ShinyHunters. The attacks leverage advanced voice phishing (aka vishing) and bogus credential harvesting sites mimicking targeted companies to gain unauthorized access to victim
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A vulnerability affecting the Mitsubishi Electric Iconics Suite, a widely deployed supervisory control and data acquisition (SCADA) system used across industrial sectors, including automotive, energy, and manufacturing. The flaw, tracked as CVE-2025-0921, carries a CVSS score of 6.5 (Medium severity) and enables attackers to trigger denial-of-service (DoS) conditions on affected systems, compromising operational availability. Vulnerability […]
The post SCADA Flaw Enables DoS Condition, Impacting Availability of Affected Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
CERT Polska, the Polish computer emergency response team, revealed that coordinated cyber attacks targeted more than 30 wind and photovoltaic farms, a private company from the manufacturing sector, and a large combined heat and power plant (CHP) supplying heat to almost half a million customers in the country. The incident took place on December 29, 2025. The agency has attributed the attacks to
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A significant Metasploit Framework update (version 6.4.111) featuring seven new exploit modules that target critical vulnerabilities across widely deployed enterprise systems. This release demonstrates the increasing sophistication of attack chains leveraging authentication bypass vulnerabilities chained with subsequent code execution techniques. FreePBX Vulnerability Chain Takes Center Stage Rapid7 introduces three specialized modules targeting FreePBX, a popular […]
The post Metasploit Update Introduces 7 Exploit Modules Affecting Popular Enterprise Platforms appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Senate on Friday evening approved a spending package that ensures nearly all agencies are funding through fiscal 2026, but the agreement came too late to stave off an appropriations lapse.
Parts of the government are poised to shut down at midnight and the White House said it must go through the formal procedures that accompany that outcome, despite a resolution appearing imminent. The House is still in recess and will not return until Monday, meaning funding cannot be restored until that afternoon at the earliest.
“We have been sending guidance to agencies this week, including today, on the likely lapse in funding,” an Office of Management and Budget spokesperson said on Friday. They added that OMB was following the “normal shutdown process” and would send a memorandum later on Friday instructing them to kick off shutdown procedures. Agencies would then notify employees who will be deemed excepted—and would therefore have to work during the shutdown—and who will be furloughed.
OMB Director Russ Vought issued the memo late Friday instructing agencies to "execute plans for an orderly shutdown," adding it was the administration's hope "that this lapse will be short."
Senate Democrats and the White House came to an agreement late Thursday to fund the vast majority of federal agencies, while providing a two-week stopgap continuing resolution to the Homeland Security Department. Passage of that bill was delayed Thursday night and into Friday as lawmakers negotiated over which amendments to attach the package. Senators reached such a deal late in the afternoon on Friday and passed the bill that evening, allowing the House to vote as soon as it returns next week.
The deal came hours after eight Republicans joined all Democrats in defeating a previous measure, which the House had approved with broad bipartisan support. It was set to coast to President Trump’s desk until Border Patrol agents fatally shot Alex Pretti on Jan. 24, leading to demands from Senate Democrats that more restrictions be placed on the Homeland Security Department’s immigration enforcement efforts as part of the agency’s funding bill.
The bill would fully fund the departments of Defense, Labor, Health and Human Services, Education, Transportation, Housing and Urban Development, State and Treasury, as well as other related agencies. The remaining federal agencies previously received their full-year appropriations and are not at risk of shutting down.
Current funding for those agencies subject to the new bill is set to expire at the end of the day Friday. Those agencies will see their appropriations lapse at midnight, though the impact of the shutdown could depend on when the House acts. OMB stressed on Friday it does not have the authority to stave off the impacts of a shutdown simply because a vote is expected to occur.
In 2018, funding briefly expired for agencies and OMB declared the impasse was merely a “short, technical lapse.” It provided agencies flexibility in implementing shutdown procedures due to the imminence of a resolution, though the situation created widespread confusion across the government.
All federal employees who would normally report to work on Feb. 2 would be expected to do so anyway, as is standard practice on the first working day after a funding lapse to initiate “orderly shutdown activities.” Depending on when the House acts, OMB could advise furloughed employees to remain at work or to go home and await an update.
Senate Minority Leader Chuck Schumer, D-N.Y., has laid out his caucus’ demands for DHS reforms, including the removal of masks by DHS law enforcement personnel, mandated use of body cameras, a requirement for third-party warrants to enter homes, the end of roving patrols in metropolitan areas by Immigration and Customs Enforcement and more uniform restrictions on use of force by federal agents. Democrats plan to negotiate over those items with the White House while the two-week DHS CR is in effect.
This story has been updated with new information on the status of appropriations.
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A 38 year old was convicted on seven counts of economic espionage and seven counts of theft of trade secrets following an 11 day trial.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
– Subo Guha, Senior Vice President, Product Management, Stellar Cyber

San Jose, Calif. – Jan. 30, 2026
Agentic AI as applied to the cybersecurity market is expected to grow from $738.2 million in 2024 to an estimated $1.73 billion in 2034, reflecting a CAGR of 39.70%. This kind of massive transformation will happen gradually, as 59% of CISOs say their agentic AI initiatives are still a “work in progress.”
Beyond that, what’s next? Here are six predictions for the future of the AI-powered security operations center, starting in 2026 and continuing through 2028.
1. Rise of Human-Augmented SOCs
In the coming year, the enterprise security landscape will be defined by the transition from a primarily human-led response to a human-augmented, AI-driven security operations center (SOC). A human-augmented SOC is built on the foundation of agentic AI tools, designed to address one of the most significant pain points facing human security analysts today: security alert fatigue. Throughout 2026, security teams will transition from costly, inefficient manual triage to human-supervised AI systems. AI agents in the SOC will monitor and detect security anomalies, flag and investigate them. In the human-augmented SOC, AI handles repetitive, time-intensive tasks, while humans focus on high-value decisions. This model only works properly if the AI has a balanced data foundation. Extracting data from multiple sources, such as SIEM logs, network traffic, and endpoint activity, is essential to a well-trained AI assistant in the SOC. It gives AI a three-dimensional view into the environment and eliminates any potential bias towards one source.
2. Foundational AI Integration for Context and Correlation
There’s been a lot of talk in 2025 about Agentic AI vs. other types of AI. However, in 2026, multiple types of AI will come together to achieve specific goals. Machine learning, correlation AI, and agentic AI systems will become the standard for performing context-aware triage and correlation. The primary role of these unified, multiple layers of AI will be to enrich data across diverse telemetry sources (endpoints, networks, and cloud) and build a clear picture of attack patterns. This will take a great deal of the heavy lifting off the human security analysts, who currently spend hours on investigation. With more comprehensive data and context around security alerts and other incidents, human analysts and AI agents alike will be able to make better informed decisions about what steps to take to thwart potential attacks. Agentic triage agents will continuously evaluate new alerts as they arrive in the SOC, not just on rule severity, but on context: entity criticality, blast radius, past behavior, current campaigns, and ATT&CK technique combinations. Using context-based criteria, low context alerts about low-value assets may get auto-closed after quick checks. High-risk combinations, such as a privileged account signing in from a new geography while creating new cloud keys, will receive instant promotion and a full investigation.
3. Deeper Integration of Open XDR Platforms into Cloud-Native Ecosystems
In 2026, Open XDR platforms will achieve deeper integration into cloud-native environments, helping the autonomous SOC to gain greater visibility across the attack surface, working with any endpoint system. Security teams are already realizing that proprietary, closed XDR is too restrictive and requires vendor lock-in. The Open XDR approach utilizes adaptive connectors (APIs) and AI-driven enrichment to unify data from hybrid cloud architectures, establishing the necessary data foundation for automated defense. This will allow enterprises and SMEs to maximize the value of existing tools and facilitate greater interoperability. This “better together” concept will require more security vendors to cooperate rather than compete.
4. Security Analysts as AI Supervisors
Here’s the truth about agentic AI: you can’t automate everything unless the automation is learning from someone. In the case of cybersecurity, that “someone” is still the analyst. And their job is not just to babysit the machine, but to influence it in meaningful ways. In the autonomous SOC of the future, the professional role of the security analyst will evolve from an incident responder to an AI supervisor. Analysts’ core function will be to oversee autonomous actions, validate automated responses (such as quarantines), tune AI rules, and rely on human judgment for final escalation decisions. In 2026, this will become the hot new job role in security operations.
5. Human-Augmented SOC Shifts to an Autonomous, Intelligent System
What’s beyond 2026? AI, through LLMs, behavioral analysis, and autonomous agent design, bring the capacity to remove the human operator from the loop entirely. Today’s AI-based platforms already outperform humans in detecting and classifying malicious activity. The mistake is assuming that SOC processing tasks will always require a human interface. Autonomous decision-making is already happening at the endpoint. The SOC is next. Fighting this trend is a losing game. But, there will be massive opportunities for humans to participate – but at a higher-level context, including governance, curation, and monitoring of progress in day-to-day operations. They will select the vendors, swap out automated tools, diagnose problems, and generally ensure that the defensive AI is working as expected.
The SOC will fundamentally change from a collection of disconnected, siloed tools into a single, cohesive, intelligent system supervised by human experts. While not yet fully autonomous, this system will actively learn, experiment, and establish the trust mechanisms required for future autonomous “bot versus bot” defense capabilities. By the end of 2026, the SOC will no longer be a collection of tools; it will be an intelligent system supervised by skilled humans. It won’t yet fight back autonomously, but it will be able to learn and experiment, much like the early phases of training a defensive AI to distinguish between friends, foes, and false positives.
6. Next-Generation Honeypots
By 2028, the security ecosystem will be fully adaptive and autonomous. AI-driven agents will defend digital assets at machine speed without waiting for human approval. This is the phase where we’ll see “defender” bots begin fighting “attacker” bots. Attackers are already using AI to create highly convincing deepfakes. Within the next three years, defenders will be able to fight fire with fire. Static honeypots will be replaced in the autonomous SOC by dynamic, data-driven decoys and digital twins. These intelligent decoys will use reinforcement learning to mimic user behavior and actively learn threat intent, providing analysts with proactive, real-time insights into adversary strategies.
Prepare Now
The evolution of the SOC from a human-centric response team to a human-augmented and eventually autonomous, intelligent system is not just a technological shift but a strategic imperative. The predictions outlined here-from the rise of human-augmented SOCs and foundational AI integration to the deep embedding of Open XDR and the emergence of next-generation honeypots-all point toward a cybersecurity environment defined by speed, context, and coordinated action. By 2028, the enterprise defense posture will rely heavily on autonomous learning systems that transform the role of the security analyst into a high-level supervisor, ensuring the integrity and effectiveness of the defensive AI. For organizations planning their strategy today, the focus must be on building the unified data foundation and embracing the Open XDR architecture necessary to support these powerful, contextual, and ultimately autonomous defensive capabilities. The future of security is intelligent, and the time to adapt is now.
– Subo Guha serves as Senior Vice President of Product Management at Stellar Cyber, where he spearheads the development of their award-winning AI-driven Open XDR solutions. With more than 25 years of experience, Subo has held senior leadership roles at industry-leading companies like SolarWinds, Dell, N-able, and CA Technologies.
About Stellar CyberStellar Cyber’s Open XDR Platform delivers comprehensive, unified security without complexity, empowering lean security teams of any skill level to secure their environments successfully. With Stellar Cyber, organizations reduce risk with early and precise identification and remediation of threats while slashing costs, retaining investments in existing tools, and improving analyst productivity, delivering an 8X improvement in MTTD and a 20X improvement in MTTR. The company is based in Silicon Valley. For more information, visit https://stellarcyber.ai.
The post Cybersecurity Predictions for 2026 appeared first on Cybercrime Magazine.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
The U.S. may be headed for another government shutdown. Lawmakers are tussling over terms to keep the government open ahead of a funding deadline this evening at midnight. A bipartisan deal had been reached Thursday afternoon after the White House and Senate Democrats announced an agreement to separate Homeland Security funds from a five-bill package the full Senate could take up on Friday.“Republicans and Democrats in Congress have come together to get the vast majority of the Government funded until September, while at the same time providing an extension to the Department of Homeland Security,” President Trump said on social media just after 6 p.m. ET.
But shortly before midnight, Sen. Lindsey Graham, R-S.C., torpedoed the compromise because it would repeal a provision allowing lawmakers like Graham to sue for $500,000 if their phone records were collected as part of former special counsel Jack Smith’s probe into interference in the 2020 general election. He also told reporters he didn’t want DHS funded only through Feb. 13, as the compromise plan instructed, while bipartisan negotiations continued over possible reforms affecting immigration agents—including “an end to roving patrols, a ban on face masks and a requirement to wear body cameras,” Reuters reports.
Senate leader John Thune’s forecast: “Tomorrow’s another day and hopefully people will be in a spirit to try to get this done,” he said as he left the Capitol Thursday night, according to The Hill. Senators are expected to return beginning at 11 a.m. ET. “Hopefully by sometime tomorrow we’ll be in a better spot,” Thune said.
Another hiccup: House Speaker Mike Johnson said his chamber won’t act any earlier than Monday, which he said Thursday night means, “We may inevitably be in a short shutdown situation,” the New York Times reports.
Welcome to this Friday edition of The D Brief, a newsletter focused on developments affecting the future of U.S. national security, brought to you by Ben Watson. It’s more important than ever to stay informed, so we’d like to take a moment to thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1933, Adolf Hitler took office as the Chancellor of Germany.
Deportation nation
Dozens of military lawyers have been temporarily assigned as federal prosecutors to support law-enforcement surges in Minneapolis and other cities, Defense One’s Tom Novelly reported Thursday.
This month alone, the Justice Department requested about 40 lawyers, a U.S. official said. It’s a novel arrangement that’s stretching an overworked judge advocate general corps and drawing concern from legal experts.
Expert reax: “The government has used JAGs to help prosecute offenses unrelated to military bases in a handful of cases over the years, but we've never seen JAGs used at this scale in civilian criminal cases with no military connection,” said Steve Vladeck, a Georgetown University law professor. “Not only does the scale raise serious concerns about taking JAGs away from their regular duties, but it also raises the question of why the Department of Justice is having so much trouble trying these cases itself.”
Second opinion: Steven Lepper, a retired Air Force judge advocate general, said he has serious doubts about the administration's new use of the military lawyers. “The fact that there is no military nexus here between the kinds of cases that JAGs serving as special assistant U.S. attorneys are going to help prosecute essentially puts these JAGs in a role where the fundamental question ought to be whether doing that is a violation of Posse Comitatus,” he said. Continue reading, here.
Nationwide protests and walkouts are planned Friday in 46 states across the country in response to the deaths of American citizens Alex Pretti and Renee Good at the hands of immigration agents in Minneapolis this month. The plans come on the heels of “last Friday's protests when thousands marched through Minneapolis in the bitter cold, urging an end to President Donald Trump's immigration crackdown in their city,” Reuters reported Friday from Minneapolis.
Panning out: “After weeks of videos showing aggressive tactics by heavily armed and masked officers in Minneapolis, American approval of Trump's immigration policy has fallen to its lowest in his second term,” the wire service writes.
Footage circulated Thursday of a woman in Minnesota who walked outside to warm the car for her kids and was abducted by federal agents. The video shows her calling someone on the phone to look after her children, who were left alone in the house.
Meanwhile in D.C., police arrested 54 religious demonstrators who sat inside the Hart Senate Office Building as several held banners that read “Do Justice, Love kindness, Abolish ICE.”
The view from Minnesota: “It’s an armed force that’s assaulting, that’s killing my constituents, my citizens,” Gov. Tim Walz said in an interview with The Atlantic this week. “I mean, is this a Fort Sumter?” Walz asked, referring to the South Carolina fort where Confederate forces fired the first shots of the Civil War in 1861.
Some Americans have observed that unrest today echoes the tumultuous 1960s, which saw several assassinations—including President John F. Kennedy, his brother Robert Kennedy, Malcomb X and Martin Luther King Jr. Those observers point to the attempted assasination of Trump, the assassination of Charlie Kirk and two Democratic lawmakers from Minnesota last year, as well as the two Americans killed in Minneapolis this month. Other historians have pointed to Germany in 1933 with the rise of police state tactics and concentration camps. And still others have pointed to a time when congressional decorum and gridlock was far worse than it is today: America in the 1850s, after congress passed the Fugitive Slave Act, which tackled an overhyped problem and targeted northern sanctuary cities and helped collapse the country and ignite a civil war in 1861, as Walz mentioned.
Trump’s deportation raids have inspired at least two protest songs in America: “Join ICE,” by Jesse Welles, and “Streets of Minneapolis,” by Bruce Springstein, which was released this week after the deaths of Pretti and Good. Shock over their deaths has reached as far as the Danish island of Greenland, where some residents who said they were warm to the idea of becoming a U.S. territory under Trump now said they’ve changed their mind, the New York Times reported Thursday.
On social media Thursday night, Trump called Pretti an “agitator and, perhaps, insurrectionist” after footage was posted online Wednesday showing Pretti spit at an agent and kick the tail light off of a government vehicle on Jan. 13. The agents then exited their vehicle and tackled him to the ground, breaking one of his ribs. The incident occurred one week before DHS agents tackled and disarmed him before shooting him to death on Saturday.
Related reading:
- “U.S. cardinal urges defunding of ICE: 'We need to see what's happening in front of us',” PBS News reported Wednesday;
- And “Trump reshapes US historical and cultural institutions,” Reuters reported Friday, citing changes across museums, monuments and national parks.
Around the Defense Department
A secretive Air Force spy drone was used in the U.S. military’s operation to capture Venezuela’s leader earlier this month, Lockheed Martin’s CEO confirmed, marking a rare disclosure of the aircraft’s operations, Defense One’s Tom Novelly reported Thursday.
James Taiclet confirmed that RQ-170 Sentinel stealth drones were part of the Jan. 3 Venezuelan mission, dubbed Operation Absolute Resolve, on a Thursday earnings call. “Lockheed Martin products once again proved critical to the U.S. military's most demanding missions,” Taiclet said. “The recent Operation Absolute Resolve included F-35 and F-22 fighter jets, RQ-170 Sentinel stealth drones, and Sikorsky Black Hawk helicopters, which helped ensure mission success while bringing the men and women of our armed forces home safely.”
Taiclet’s mention of the spy drone is the first disclosure of the aircraft’s operations in roughly half a decade. In 2021, the 432nd Wing at Creech Air Force Base in Nevada briefly mentioned the unit had “successfully deployed and redeployed RQ-170 Sentinel forces” in a news release. While the use of the surveillance drone in the Venezuela operations was not surprising to some Air Force analysts, one expert said the disclosure of the mission from Lockheed Martin was abnormal. Read on, here.
And lastly this week: Experts have questions about the White House’s new National Defense Strategy, including whether there’s an implementation plan to go with it, Defense One’s Meghann Myers reported Thursday.
One consideration: While there are always some tensions or contradictions in an NDS, because they’re written by a group of people, this latest document seems to go in several directions at the same time, said Becca Wasser, a CNAS adjunct senior fellow.
The thesis of the NDS is that the rules-based international order was a far-fetched fantasy. It’s a favored worldview of Elbridge Colby, the Pentagon’s policy chief and key NDS author, Myers reports.
The strategy proposes to replace that framework with what the Trump administration has coined the “Trump corollary” to the Monroe Doctrine: “American military dominance” in the Western Hemisphere that denies “adversaries’ ability to position forces or other threatening capabilities” there.
“What is interesting about that, though, is that, of course, it doesn't say much about what this is,” said Dustin Walker, policy director at Anduril. “What is replacing that order, what are the sort of higher-order strategic objectives that we are pursuing here?” He added, “You don't really hear much about sort of procurement priorities. I think Golden Dome is literally the only specific capability area mentioned in the document. So you don't have a lot of guidance for force design and development here. There's no description of the budget or sort of investment profile that's going to be required to do this.”
Second opinion: The document may not even be “worth the paper it's written on because the president’s going to do whatever he wants and he's not going to even try to adhere to it, which might be why it was released with such little fanfare,” said Stacie Pettyjohn, a CNAS senior fellow with the Center for a New American Security, which hosted a Wednesday discussion on the strategy. Continue reading, here.
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Another day, another Android malware campaign targeting unsuspecting users worldwide by masquerading as popular apps.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cybersecurity researchers have discovered malicious Google Chrome extensions that come with capabilities to hijack affiliate links, steal data, and collect OpenAI ChatGPT authentication tokens. One of the extensions in question is Amazon Ads Blocker (ID: pnpchphmplpdimbllknjoiopmfphellj), which claims to be a tool to browse Amazon without any sponsored content. It was uploaded to the Chrome
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶


