-
New research has uncovered exploitation primitives in the .NET Framework that could be leveraged against enterprise-grade applications to achieve remote code execution. WatchTowr Labs, which has codenamed the “invalid cast vulnerability” SOAPwn, said the issue impacts Barracuda Service Center RMM, Ivanti Endpoint Manager (EPM), and Umbraco 8. But the number of affected vendors is likely to be
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
Nearly half of Americans (48%) oppose U.S. military attacks on alleged drug trafficking boats, and that includes almost a fifth (19%) of Republicans, according to a new survey conducted in early December and published Wednesday by Reuters/Ipsos.Just 34% support the attacks, while another 18% said they were unsure. “There have been at least 22 strikes that have killed 87 people since September 2,” Reuters reminds readers. The U.S. has killed those aboard the boats without due process and in a manner that critics have argued may violate the laws of war.
- Also in that survey: 64% said they don’t support Trump’s recent pardon of convicted cocaine trafficker former Honduran President Juan Orlando Hernandez, whom Trump last week ordered to be released amid a 45-year prison sentence in the U.S. Read more, here.
New: Two U.S. Navy F/A-18s were tracked flying over the Gulf of Venezuela on Tuesday, according to open-source monitor Flightradar24, which noted afterward the fighter jets were the most tracked flights on the live radar website.
When asked about the jets, a U.S. official told Defense One’s Thomas Novelly Tuesday evening that the Defense Department “conducts routine, lawful operations in international airspace, including over the Gulf of Venezuela,” adding: “We will continue to fly safely, professionally, and in accordance with international law to protect the homeland, monitor illicit activity, and support stability across the Americas.”
Their flight path marks the latest escalation of U.S. military force near Venezuela, which has included repeated military strikes on alleged drug runners in the Caribbean Sea in addition to regional B-1 and B-52 bomber flights amid the largest U.S. military buildup in the Caribbean since the Cuban missile crisis.
Could the U.S. really invade right now? The force “lacks support or logistics for Venezuela ground invasion,” which “leaves airstrikes as Trump’s most feasible and immediate option—despite his warnings of stronger action,” Politico reported Tuesday after a podcast interview with the president.
Expert input: “The United States does not have the ground forces needed for an invasion,” said Mark Cancian, a retired Marine colonel and co-author of a recent CSIS analysis. “The Venezuelan ground forces number some 90,000 including the army, marines and National Guard. The United States has only 2,200 Marines [nearby], and there’s no movement to reinforce them.” Read on, here.
During classified briefings about the Pentagon’s boat strikes Tuesday on Capitol Hill, “We got some clarity on the chain of command and who made decisions at what point, but on the legality of it we didn’t get a lot of clarity,” Rep. Adam Smith, D-Wash., said afterward, according to the New York Times. Smith also said it was “pretty clear” that the second strike on Sept. 2 to kill two survivors was the commander at the time “Admiral [Frank] Bradley’s call, based on the rules of engagement given to him by Hegseth.”
Developing: Smith’s counterpart on the Armed Services Committee said he plans to quash a congressional inquiry into the Sept. 2 strikes, Politico reported Tuesday. “It’s done,” said HASC Chairman Rep. Mike Rogers, R-Ala., to reporters. “I’ve got all the answers I needed,” he said. Meantime, “It’s still an open question whether the video will be made public, as some lawmakers have urged,” Politico’s Connor O'Brien reports.
Hegseth told lawmakers Tuesday he wants more time to weigh the merits of releasing the footage publicly, the New York Times reported. Lawmakers could still “hear from the commander who ordered the strike and see the unedited video of the incident in the coming days,” according to Politico.
A new window into the boat-strikes: In September and October, the Pentagon’s lawyers raced “to ensure survivors did not end up in the U.S. judicial system, where court cases could force the administration to show evidence justifying President Trump’s military campaign in the region,” the New York Times reported Tuesday (gift link).
Also notable: U.S. “military officials referred to [the survivors] by specific terms that included ‘distressed mariners.’ That phrase is usually used in a peacetime and civilian context,” a trio of Times reporters write. Read the rest, here.
Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson, Thomas Novelly and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1954, U.S. Air Force Col. John Stapp took 19 Gs as his rocket sled accelerated to 632 mph in five seconds—then 40 Gs as it slammed to a halt. The test helped prove the feasibility of rocket-powered ejection seats.
SecDef Hegseth’s AI rollout stumbles immediately out of the gate. “The future of American warfare is here, and it’s spelled A-I,” SecDef Hegseth said in a video announcement Tuesday—linking to the program at GenAi.Mil.
The idea is to allow service members to “conduct deep research, format documents, and even analyze video or imagery at unprecedented speed,” Hegseth said. However, “the platform can’t actually be accessed from external networks,” and so readers of Hegseth’s social media post were left with internet errors, the New Republic reports. According to Reddit users, active duty troops “received surprise invitations to use the new platform on their work computer.” But since the announcement emerged for some with little warning, at least one user said the invite looked “really suspicious.”
Related: View some of the new AI program promotional posters “plastered” throughout the Pentagon and also shared on Reddit, here.
And ICYMI: Research and engineering chief Emil Michael talked about the department’s AI efforts on Monday.
Update: Congress is committing to only a fraction of the funding given to the Navy’s F/A-XX program last year. But the latest version of the defense policy bill fully backs the development of the Air Force’s F-47 fighter, Defense One’s Tom Novelly reported Tuesday.
The numbers appear to reflect a White House and Pentagon victory over lawmakers who pushed to get the long-proposed replacement for the F/A-18 Super Hornet and F/A-18 electronic-warfare jet onto the drawing board this year. As things stand, the F/A-XX will receive less than 1 percent of the $38 billion that the NDAA would authorize to develop, buy, and upgrade military aircraft, according to the House majority’s summary of the bill.
Caveat: The 2026 appropriations bill has yet to emerge, the reconciliation bill might add funds, and the program might also, as it has in the past, receive funds through classified accounts, Novelly writes. Read more, here.
Additional reading:
- Developing: “US judge blocks Trump's National Guard deployment in Los Angeles,” Reuters reported Wednesday morning from New York;
- “South Korea’s Hanwha, US defense startup Vatn to build underwater drones,” the wire service reported Wednesday as well;
- “Australian MQ-28 CCA Downs Drone in Milestone Air-to-Air Test,” Air and Space Forces Magazine reported Tuesday;
- And Palantir co-founder Joe Lonsdale says he “wants to bring back public executions,” Newsweek and multiple other outlets reported this week.
Trump vs. Europe
A longer, unpublished version of the National Security Strategy proposes new vehicles for leadership on the world stage and a different way to put its thumb on the scales of Europe’s future—through its cultural values. Defense One’s Meghann Myers, who reviewed the document, reveals some takeaways, here.
Trump himself espoused his desire to reshape a “weak” Europe in a Monday interview with Politico, which wrote on Tuesday that he “denounced Europe as a ‘decaying’ group of nations led by ‘weak’ people,…belittling the traditional U.S. allies for failing to control migration and end the Russia-Ukraine war, and signaling that he would endorse European political candidates aligned with his own vision for the continent.
“The broadside attack against European political leadership represents the president’s most virulent denunciation to date of these Western democracies, threatening a decisive rupture with countries like France and Germany that already have deeply strained relations with the Trump administration.” Read on, here. The New York Times added its own coverage of the interview as well.
Meanwhile, in Europe, leaders are accelerating plans to “confront the unthinkable: a future in which America is no longer their primary security guarantor and Europe has to organize its own defense far sooner than anyone imagined.” Politico, here.
By the way: Just last year, Russia reportedly plotted to plant bombs on U.S.-bound flights, according to the Financial Times. That update extends from the previously-reported instances from July 2024 when “DHL parcels exploded in logistics centres in the UK, Poland and Germany,” FT’s Sam Jones writes.
“Security services would eventually trace the plot back to a group of Russian-directed saboteurs who had a further 6kg of explosive material in their possession. That was enough to give them the capability for what security officials told the Financial Times was the next stage of the plan: to attack flights to the US, and cause more disruption to the airline industry than any act of terror since the World Trade Center attacks.” More, here.
Additional reading:
- Ukrainian President “Zelenskyy reaffirms his refusal to cede land to Russia as he rallies European support,” the Associated Press reported Tuesday;
- And ICYMI, here’s “What the US wants from Ukraine: Leave Donbas, one way or another,” Politico reported Monday.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
This week in cybersecurity from the editors at Cybercrime Magazine
Sausalito, Calif. – Dec. 10, 2025If you’re in the cybersecurity field working anywhere in Europe, then there’s a good chance that you’re in London this week at the Black Hat Conference.
Black Hat, the cybersecurity industry’s most established and in-depth security event series, announced the appointment of Suzy Pallett, who is based in the U.K., as the brand’s new President on Sep. 1.
In this episode on the Cybercrime Magazine Podcast, Pallett joins host Amanda Glassner to discuss her new position, the conference’s storied history in the cybersecurity community, and more, including events in the U.S., Canada, Middle East and Africa, Asia, and Europe.
Pallett brings over 20 years of experience across global B2B and B2C events, most recently serving as Executive Vice President, Europe and Middle East at Money20/20, the world’s leading global FinTech event series. Pallett will be focused on accelerating the growth of Black Hat’s global events, working closely with the community to ensure a smooth transition and continued excellence.
Cybercrime Magazine is a Media Partner for the Black Hat USA and Europe conferences in 2025.
Listen to the Podcast Interview
Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:
- SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
- NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
- HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
- VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
- M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
- BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
- PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
- PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
- RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.
Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.
The post Black Hat Welcomes Suzy Pallett as New Brand President appeared first on Cybercrime Magazine.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Three security vulnerabilities have been disclosed in the Peripheral Component Interconnect Express (PCIe) Integrity and Data Encryption (IDE) protocol specification that could expose a local attacker to serious risks. The flaws impact PCIe Base Specification Revision 5.0 and onwards in the protocol mechanism introduced by the IDE Engineering Change Notice (ECN), according to the PCI Special
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a security flaw impacting the WinRAR file archiver and compression utility to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal bug that could enable code execution. However, for exploitation
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cloud security is changing. Attackers are no longer just breaking down the door; they are finding unlocked windows in your configurations, your identities, and your code. Standard security tools often miss these threats because they look like normal activity. To stop them, you need to see exactly how these attacks happen in the real world. Next week, the Cortex Cloud team at Palo Alto Networks
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild. Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity. Two other defects are listed as publicly known at the time of the release. These include 29 privilege escalation, 18 remote code
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Fortinet, Ivanti, and SAP have moved to address critical security flaws in their products that, if successfully exploited, could result in an authentication bypass and code execution. The Fortinet vulnerabilities affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager and relate to a case of improper verification of a cryptographic signature. They are tracked as CVE-2025-59718 and
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Congress is committing to only a fraction of the funding necessary for the Navy’s F/A-XX program in the latest version of the defense policy bill, while fully backing the development of the Air Force’s F-47 fighter.
The compromise version of the 2026 National Defense Authorization Act released late Sunday evening contains roughly $2.6 billion for the Air Force’s F-47 program, and just $74 million to develop the Navy’s unnamed sixth-generation fighter jet. The numbers appear to reflect a White House and Pentagon victory over lawmakers who pushed to get the long-proposed replacement for the F/A-18 Super Hornet and F/A-18 electronic-warfare jet onto the drawing board this year.
“We did make a strategic decision to go all in on F-47…due to our belief that the industrial base can only handle going fast on one program at this time, and the presidential priority to go all in on F-47 and get that program right while maintaining the option for F/A-XX in the future,” a U.S. defense official told reporters during a June budget rollout.
The F/A-XX will receive less than 1 percent of the $38 billion that the NDAA would authorize to develop, buy, and upgrade military aircraft, according to the House majority’s summary of the bill. Still, the 2026 appropriations bill has yet to emerge, the reconciliation bill might add funds, and the program might also, as it has in the past, receive funds through classified accounts.
A House Armed Services Committee spokesperson did not immediately respond to clarifications regarding the total amount of funding for the program.
In March, the Navy reportedly came close to choosing Boeing or Northrop Grumman to make the future aircraft. But no announcement was made, and the service requested only $74 million for 2026, far less than the $454 million the service received last year.
Defense Secretary Pete Hegseth has echoed the White House’s concerns about pursuing the Navy’s future fighter, reportedly telling lawmakers in a November letter that the Pentagon “strongly supports its original fiscal 2026 request reevaluating the F/A-XX program due to industrial base concerns of two sixth-generation programs occurring simultaneously.”
Several lawmakers, including Sen. Mitch McConnell, R-Ky. have been vocal about their desire to keep the program moving.
“Pentagon dithering over the Navy’s sixth-generation fighter, the F/A-XX, has delayed its development and led to hundreds of millions in contract-extension costs,” McConnell wrote last week in a Wall Street Journal opinion piece. “If the department made a decision, Mr. Trump could launch a program that ensures the aircraft carrier remains America’s premier power-projection platform for decades.”
The final funding amount for the Navy’s future fighter is still up in the air. In July, the House passed its version of the 2026 defense appropriations bill with $972 million for the F/A-XX.
“The Committee understands the Navy’s requirement for a sixth-generation fighter remains unchanged and emphatically notes that the Air Force’s F-47 program is not interchangeable with Navy’s carrier-capable program,” House appropriators wrote, adding that “both programs are necessary parts of the future joint fight and failure to pursue Navy’s F/A-XX program risks leaving the U.S. dangerously outmatched in a high-end conflict.”
Reconciliation funding passed that same month included $750 million to “accelerate the FA/XX aircraft.” The full Senate has yet to vote on its version of the appropriations bill, which includes $1.4 billion for it.
The Senate version of the authorization bill reportedly included $500 million for F/A-XX through a special access program known as “Link Plumeria,” which has been previously tied to the Navy’s next-generation fighter efforts. The compromise NDAA identified $377 million for “Link Plumeria.”
As for the F-47: lawmakers are funding it yet but still want answers to basic questions.
The compromise NDAA requests a report on the F-47 program with details about “projected costs, schedule, and funding requirements” through 2034. Lawmakers are also requesting details on the estimated force structure requirements, strategic basing considerations, construction costs, personnel training requirements, and a strategy for integrating Air National Guard and Air Force Reserve units into the future fighter’s operations.
The Air Force Secretary must provide those findings by March 1, 2027. The jet is is expected to make its first flight in 2028.
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶



