• A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD’s KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and…

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor’s own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine’s Threat Analysis

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Today’s headlines are full of killer robots and doomsayers, but the most urgent risk in military AI is more mundane: the people shaping it share neither a common lexicon nor common data. 

    The problem is not a lack of discussion. The authors have taken part in many global deliberations, both as conveners and as private-sector representatives, and we can report: If the world is to forge responsible governance of AI in the military domain, it will need shared definitions and a way to fuse relevant developments and decisions into something approximating “ground truth.”

    The players in AI-military integration come from every realm: governments, militaries, the private sector, academia, the legal system, civil society, human rights, technology, journalism, and more. In multilateral negotiations and colloquial parlance, they speak varied languages—literally and topically. They are guided by varied incentives: some are eagerly pursuing AI-military integration, while others are trying to regulate it. A word like “autonomy” means something different to a general, an engineer, a lawyer, and a human rights advocate, not to mention the nuances born of the 200 or so countries they call home.

    The staggering breadth of these players, combined with the wide range of AI applications, means that data about their actions is scattered. It can be found in government contract announcements, legislation, news coverage, court documents, patent applications, and beyond, in nearly every global language. This has made it impossible to track and compare developments within and across countries.

    Without common language and common data, humanitarian organizations often talk past supply-chain experts. Tech executives fail to communicate effectively with academic researchers. Efforts to develop responsible AI-military integration cannot move ahead. 

    This is not a new concern. In 2024, the Responsible AI in the Military Domain Summit, or REAIM—the preeminent forum for global discussions of the topic—urged stakeholders to begin “fostering a common understanding of…capabilities and limitations [of AI-military integration], and a shared understanding of the possible applications…and their potential impacts, including both benefits and risks.” The same year, the United Nations Institute for Disarmament Research Roundtable for AI, Security, and Ethics identified six priority areas for governance, including: “Building a shared and solid knowledge base on AI in the military domain, developed through cross-regional, inter-disciplinary and multi-stakeholder input.” And last year’s report by the Global Commission REAIM urged states to “maintain international repositories of best practices, including AI concepts and definitions, AI capabilities in specific contexts of application…and military AI policies” to support national and international regulatory efforts. 

    One effort to bridge the data gap is the AI-Military Integration Database, operated by AIMID, a private company whose CEO is one of the authors. The database does a daily scan for news and information about AI-military integration in more than 20 languages—news reports, company announcements, academic articles, legislation, contracts, think tank reports, and more. The result is an ever-growing knowledge graph: a structured, footnoted map of actors, technologies, events and the relationships between them. This makes it possible to see which countries are doing what, with what technologies, from what companies, and for what use cases. In short, AIMID aims to deliver a single, verifiable picture of global AI-military integration, a data-driven “ground truth.” 

    Among other benefits, the database aims to help allies and partners pool knowledge about testing, evaluation, verification, and validation—supporting innovation and interoperability while avoiding the costly duplication of technical efforts. It might also help reduce tension between global rivals by providing empirical reference points, reducing dangerous interstate misperceptions, and ensuring that states’ security policies are anchored in evidence rather than ambiguity. For anyone concerned with responsible AI-military development—governments, businesses, NGOs, academics, or average citizens—AIMID serves as a unique resource,

    But more than merely recognizing that data fragmentation is hindering responsible military-AI progress, defense leaders around the world should next fund and adopt the tools necessary to fully understand the data and intelligence-gathering side of this new ecosystem. Indeed, while organizations like AIMID cannot fully solve the fundamental problem of data fragmentation, they represent some of the best resources available. 

    This commentary is published in coordination with the 2026 Global Security Forum, of which Defense One is a media partner.

    Dr. Jason Warner is the CEO of the AI-Military Integration Database (AIMID). He holds a Ph.D. from Harvard University.

    Sofia Romansky is a Strategic Analyst at The Hague Centre for Strategic Studies (HCSS) and Subject Matter Expert for the NATO Defence Education Enhancement Program (DEEP). She previously served as the Project Coordinator of the Global Commission on Responsible Artificial Intelligence in the Military Domain (GC REAIM).

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers from Calif (Calif.io) demonstrated a working untethered jailbreak on iOS 27.0.1 running on an iPhone 18 Pro. They showed it live at the Hexacon 2026 offensive security conference in Paris on October 16, 2026. Heise reports it is the first reboot-proof jailbreak since iOS 9, and that AI helped find the exploit chain. […]

    The post Researchers Demonstrate iOS 27.0.1 Untethered Jailbreak on iPhone 18 Pro appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Progress Software has released fixes for 12 vulnerabilities in MOVEit Transfer, its managed file transfer (MFT) platform. Several of the flaws allow authentication bypass, session hijacking and administrative control. The company’s September 2026 critical security bulletin, published October 15, 2026, urges customers to upgrade immediately. MOVEit Transfer vulnerabilities According to the September 2026 critical security […]

    The post Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party’s wallet without authorization to complete a coding task. The incident, the AI company said, involved an internal research model part

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • MITRE released ATT&CK v20 on October 13, 2026. It adds the first Enterprise techniques for direct and indirect prompt injection, AI-enabled exfiltration and AI result poisoning. MITRE ATT&CK v20 Adds New AI Attack Techniques According to updates published by MITRE, the release updates Techniques, Groups, Campaigns and Software across the Enterprise, Mobile and ICS domains. […]

    The post MITRE ATT&CK v20 Adds New AI Attack Techniques for Prompt Injection and Data Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • MDR vs EDR vs SOC explained for 2026, covering tools, monitoring, incident response, staffing and how each option supports CMMC compliance.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶