🤖 Claude Mythos tops AI cyber weapon test
Booz Allen’s Cyber Weapon Index evaluated 18 US and Chinese models under identical conditions for autonomous vulnerability discovery and end-to-end intrusion. Claude Mythos was the only model to complete the full cyber kill chain without human assistance, including full domain compromise with and without stolen credentials. Grok-4.5, Muse Spark 1.1, and GLM-5.2 reached full domain access and control.
The main signal is less the leaderboard than the narrowing gap: all but one model gained initial network access, and Booz Allen assesses mainstream AI-enabled attacks as imminent. The report also found attack harnesses can sharply amplify weaker models, making tooling and orchestration as critical as the base model itself.
🛰️ Open sources - closed narratives
@sitreports
Booz Allen’s Cyber Weapon Index evaluated 18 US and Chinese models under identical conditions for autonomous vulnerability discovery and end-to-end intrusion. Claude Mythos was the only model to complete the full cyber kill chain without human assistance, including full domain compromise with and without stolen credentials. Grok-4.5, Muse Spark 1.1, and GLM-5.2 reached full domain access and control.
The main signal is less the leaderboard than the narrowing gap: all but one model gained initial network access, and Booz Allen assesses mainstream AI-enabled attacks as imminent. The report also found attack harnesses can sharply amplify weaker models, making tooling and orchestration as critical as the base model itself.
🛰️ Open sources - closed narratives
@sitreports
📡 BGP hijack used to push malicious Virtualizor update
A newly detailed supply-chain incident used a BGP hijack to redirect traffic and deliver a trojanized Virtualizor update. The tampered package reportedly established persistent root access on affected systems, turning a routine software update path into the initial intrusion vector.
The case highlights how network-layer interference can be paired with trusted update mechanisms to bypass normal admin expectations. For defenders, the key issue is not only package integrity but also route security, update validation, and post-install monitoring for persistence at root level.
🛰️ Open sources - closed narratives
@sitreports
A newly detailed supply-chain incident used a BGP hijack to redirect traffic and deliver a trojanized Virtualizor update. The tampered package reportedly established persistent root access on affected systems, turning a routine software update path into the initial intrusion vector.
The case highlights how network-layer interference can be paired with trusted update mechanisms to bypass normal admin expectations. For defenders, the key issue is not only package integrity but also route security, update validation, and post-install monitoring for persistence at root level.
🛰️ Open sources - closed narratives
@sitreports
🔍 JFrog Artifactory flaw exploited to mint admin tokens
CVE-2026-82329, a critical authentication bypass in the default configuration of self-managed JFrog Artifactory, is being exploited to forge administrative access tokens. watchTowr observed attackers creating their own admin tokens, while JFrog Artifactory patched the issue on 28 August across multiple 7.x releases. JFrog Cloud is stated to have been protected.
The access path matters more than the initial bug: admin tokens can survive a binary upgrade and provide direct control over artifacts, users, groups, and security settings. In environments where build and deployment systems automatically trust Artifactory content, that creates a supply-chain exposure with immediate downstream risk.
🛰️ Open sources - closed narratives
@sitreports
CVE-2026-82329, a critical authentication bypass in the default configuration of self-managed JFrog Artifactory, is being exploited to forge administrative access tokens. watchTowr observed attackers creating their own admin tokens, while JFrog Artifactory patched the issue on 28 August across multiple 7.x releases. JFrog Cloud is stated to have been protected.
The access path matters more than the initial bug: admin tokens can survive a binary upgrade and provide direct control over artifacts, users, groups, and security settings. In environments where build and deployment systems automatically trust Artifactory content, that creates a supply-chain exposure with immediate downstream risk.
🛰️ Open sources - closed narratives
@sitreports
🔍 SonicWall patches two exploited SMA 1000 zero-days
SonicWall released hotfixes for two actively exploited SMA 1000 VPN flaws: CVE-2026-83548, a pre-auth SSRF (CVSS 10.0), and CVE-2026-83549, a post-auth command injection bug (CVSS 7.8). The company said attackers may chain them for arbitrary command execution. Affected versions include 12.4.3-03453 and earlier, and 12.5.0-02835 and earlier; fixes are in the SMA 1000 advisory.
This is a high-priority edge-device patch. SonicWall also recommends compromise checks, reimaging if needed, and credential resets.
🛰️ Open sources - closed narratives
@sitreports
SonicWall released hotfixes for two actively exploited SMA 1000 VPN flaws: CVE-2026-83548, a pre-auth SSRF (CVSS 10.0), and CVE-2026-83549, a post-auth command injection bug (CVSS 7.8). The company said attackers may chain them for arbitrary command execution. Affected versions include 12.4.3-03453 and earlier, and 12.5.0-02835 and earlier; fixes are in the SMA 1000 advisory.
This is a high-priority edge-device patch. SonicWall also recommends compromise checks, reimaging if needed, and credential resets.
🛰️ Open sources - closed narratives
@sitreports
🔍 Malicious .git configs can trigger code execution in AI coding agents
A newly disclosed issue shows that crafted Git repository configuration can cause AI coding tools including Claude, Codex, and Cursor to execute attacker-controlled code during normal repository interaction. The exposed attack surface centers on repository-level .git configs, turning trusted development workflows into an execution path.
Operationally, this shifts risk from prompt abuse to supply-chain level repository handling. Any agent that reads, initializes, or acts on local Git context may inherit hostile behavior before a user reviews code, making repo provenance and config inspection a primary defensive control.
🛰️ Open sources - closed narratives
@sitreports
A newly disclosed issue shows that crafted Git repository configuration can cause AI coding tools including Claude, Codex, and Cursor to execute attacker-controlled code during normal repository interaction. The exposed attack surface centers on repository-level .git configs, turning trusted development workflows into an execution path.
Operationally, this shifts risk from prompt abuse to supply-chain level repository handling. Any agent that reads, initializes, or acts on local Git context may inherit hostile behavior before a user reviews code, making repo provenance and config inspection a primary defensive control.
🛰️ Open sources - closed narratives
@sitreports
🔍 Linux rootkit targets Elastic trusted_pids path
Research on the Singularity Linux rootkit shows a loader can abuse Elastic Defend’s trusted_pids eBPF map to suppress module_load telemetry during malicious kernel module insertion. Testing cited Elastic Defend 9.5.2 on Ubuntu 6.8.0-138, where the BPF program exits early if the loading process is marked trusted, preventing module metadata collection and event creation.
The significance is narrow but serious: the technique does not disable the agent, it blinds one kernel-module detection path. It highlights how trusted-process logic and eBPF map integrity become critical inspection points, especially when taint-based analytics depend on telemetry generated inside the same kernel space an attacker already controls.
🛰️ Open sources - closed narratives
@sitreports
Research on the Singularity Linux rootkit shows a loader can abuse Elastic Defend’s trusted_pids eBPF map to suppress module_load telemetry during malicious kernel module insertion. Testing cited Elastic Defend 9.5.2 on Ubuntu 6.8.0-138, where the BPF program exits early if the loading process is marked trusted, preventing module metadata collection and event creation.
The significance is narrow but serious: the technique does not disable the agent, it blinds one kernel-module detection path. It highlights how trusted-process logic and eBPF map integrity become critical inspection points, especially when taint-based analytics depend on telemetry generated inside the same kernel space an attacker already controls.
🛰️ Open sources - closed narratives
@sitreports
🔍 More than a dozen Serbians targeted with mercenary spyware, digital rights group finds
At least 14 people in Serbia’s civil society were targeted with advanced spyware ahead of local elections in March, the SHARE Foundation said. The headline points to a coordinated digital intrusion campaign aimed at non-state actors in a politically sensitive period.
Operationally, this places commercial surveillance tools back at the center of election-period security monitoring. Targeting civil society with mercenary spyware indicates both access to sophisticated intrusion capability and an interest in intelligence collection beyond formal state institutions.
🛰️ Open sources - closed narratives
@sitreports
At least 14 people in Serbia’s civil society were targeted with advanced spyware ahead of local elections in March, the SHARE Foundation said. The headline points to a coordinated digital intrusion campaign aimed at non-state actors in a politically sensitive period.
Operationally, this places commercial surveillance tools back at the center of election-period security monitoring. Targeting civil society with mercenary spyware indicates both access to sophisticated intrusion capability and an interest in intelligence collection beyond formal state institutions.
🛰️ Open sources - closed narratives
@sitreports
🔍 Sangoma Switchvox flaw hit in active RCE exploitation
Attackers are exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox that enables remote code execution via the /pa endpoint. Horizon3 observed rapid attacks from 176.65.148.184 on August 30, including reverse shell deployment, process enumeration, and base64-encoded data exfiltration. Sangoma patched the issue in Switchvox 8.4.0.2 on July 14.
This is a direct edge-service compromise path against internet-exposed enterprise VoIP infrastructure. With roughly 4,000 exposed devices cited and signs of compromise logged in db-quirks.log plus outbound traffic on port 39323, unpatched systems should be treated as high-priority incident response cases.
🛰️ Open sources - closed narratives
@sitreports
Attackers are exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox that enables remote code execution via the /pa endpoint. Horizon3 observed rapid attacks from 176.65.148.184 on August 30, including reverse shell deployment, process enumeration, and base64-encoded data exfiltration. Sangoma patched the issue in Switchvox 8.4.0.2 on July 14.
This is a direct edge-service compromise path against internet-exposed enterprise VoIP infrastructure. With roughly 4,000 exposed devices cited and signs of compromise logged in db-quirks.log plus outbound traffic on port 39323, unpatched systems should be treated as high-priority incident response cases.
🛰️ Open sources - closed narratives
@sitreports
🔍 Critical Cisco Nexus 9000 flaw enables unauthenticated root RCE
Cisco has disclosed a critical vulnerability affecting Nexus 9000 switches that can let unauthenticated remote attackers execute code as root. The issue impacts a core network platform used in data center environments, raising the risk of direct compromise without valid credentials. Cisco details are outlined in the Cisco Nexus 9000 flaw report.
Operationally, unauthenticated root-level execution on switching infrastructure is a high-impact scenario: it can undermine segmentation, visibility, and trust in east-west traffic handling. For defenders, this shifts the problem from isolated device exposure to potential control over a central network layer.
🛰️ Open sources - closed narratives
@sitreports
Cisco has disclosed a critical vulnerability affecting Nexus 9000 switches that can let unauthenticated remote attackers execute code as root. The issue impacts a core network platform used in data center environments, raising the risk of direct compromise without valid credentials. Cisco details are outlined in the Cisco Nexus 9000 flaw report.
Operationally, unauthenticated root-level execution on switching infrastructure is a high-impact scenario: it can undermine segmentation, visibility, and trust in east-west traffic handling. For defenders, this shifts the problem from isolated device exposure to potential control over a central network layer.
🛰️ Open sources - closed narratives
@sitreports
🔍 Coder registry compromise pushed malicious Terraform modules
Attackers breached Coder’s Cloudflare-backed registry infrastructure and added unauthorized servers to the pool serving registry.coder.com, causing some users between 07:35 and 21:45 UTC on August 31 to receive modified Terraform modules with credential-stealing code. Coder’s advisory says the payload targeted environment secrets, API keys, CI/CD credentials, OIDC tokens, SSH keys, terminal history, and some internal configuration secrets, exfiltrating data to coder-infra.com.
This is a software supply-chain event at the registry layer rather than a single package compromise. The impact hinges on whether provisioners fetched modules during the exposure window, making log review, cache purging, and broad secret rotation the immediate priority.
🛰️ Open sources - closed narratives
@sitreports
Attackers breached Coder’s Cloudflare-backed registry infrastructure and added unauthorized servers to the pool serving registry.coder.com, causing some users between 07:35 and 21:45 UTC on August 31 to receive modified Terraform modules with credential-stealing code. Coder’s advisory says the payload targeted environment secrets, API keys, CI/CD credentials, OIDC tokens, SSH keys, terminal history, and some internal configuration secrets, exfiltrating data to coder-infra.com.
This is a software supply-chain event at the registry layer rather than a single package compromise. The impact hinges on whether provisioners fetched modules during the exposure window, making log review, cache purging, and broad secret rotation the immediate priority.
🛰️ Open sources - closed narratives
@sitreports
🔍 HPE patches critical ArubaOS-CX RCE flaw
HPE has fixed CVE-2026-73749, a critical buffer overflow in ArubaOS-CX that allows unauthenticated remote code execution with elevated privileges via crafted packets to an affected daemon. The ArubaOS-CX bulletin also covers 23 additional flaws, including command execution, arbitrary file write, auth bypass, and default-password exposure across multiple release branches.
The issue affects enterprise switching infrastructure used in government, healthcare, universities, data centers, and service providers. Even without confirmed active exploitation, the combination of pre-auth RCE and multiple management-plane weaknesses makes patch prioritization operationally urgent.
🛰️ Open sources - closed narratives
@sitreports
HPE has fixed CVE-2026-73749, a critical buffer overflow in ArubaOS-CX that allows unauthenticated remote code execution with elevated privileges via crafted packets to an affected daemon. The ArubaOS-CX bulletin also covers 23 additional flaws, including command execution, arbitrary file write, auth bypass, and default-password exposure across multiple release branches.
The issue affects enterprise switching infrastructure used in government, healthcare, universities, data centers, and service providers. Even without confirmed active exploitation, the combination of pre-auth RCE and multiple management-plane weaknesses makes patch prioritization operationally urgent.
🛰️ Open sources - closed narratives
@sitreports
🔍 FalconFlank PoC targets CrowdStrike Falcon macro-removal path
Researcher Nightmare Eclipse released a proof-of-concept for FalconFlank, a reported privilege-escalation flaw in CrowdStrike Falcon’s Microsoft Office macro-removal feature. The PoC is said to work on fully updated Windows 11 25H2 and Windows Server 2025 systems with Falcon Phase 3 - Optimal Protection and the macro-removal policy enabled. CrowdStrike said it is investigating and advised customers to disable that Windows policy setting.
The case is notable because it shifts the researcher’s recent focus from Windows internals to endpoint security tooling, and underscores how document sanitization features can become local escalation surfaces when tied closely to host protection flows.
🛰️ Open sources - closed narratives
@sitreports
Researcher Nightmare Eclipse released a proof-of-concept for FalconFlank, a reported privilege-escalation flaw in CrowdStrike Falcon’s Microsoft Office macro-removal feature. The PoC is said to work on fully updated Windows 11 25H2 and Windows Server 2025 systems with Falcon Phase 3 - Optimal Protection and the macro-removal policy enabled. CrowdStrike said it is investigating and advised customers to disable that Windows policy setting.
The case is notable because it shifts the researcher’s recent focus from Windows internals to endpoint security tooling, and underscores how document sanitization features can become local escalation surfaces when tied closely to host protection flows.
🛰️ Open sources - closed narratives
@sitreports
🔍 Pegasus and NoviSpy used against Serbian protesters
Citizen Lab confirmed a zero-click Pegasus infection on the iPhone of a Serbian student protest member, traced to an iMessage exploit active between December 2025 and January 2026. SHARE Foundation documented at least 14 advanced spyware targeting cases since early 2026, while Amnesty Tech and SHARE also found a new NoviSpy variant on an Android phone seized during police questioning.
The case indicates parallel use of mercenary and domestic spyware against activists, students, and opposition figures during an election year. Zero-click compromise on iPhone and post-seizure Android installation point to both remote and custodial access pathways, expanding the surveillance footprint across Serbia’s protest environment.
🛰️ Open sources - closed narratives
@sitreports
Citizen Lab confirmed a zero-click Pegasus infection on the iPhone of a Serbian student protest member, traced to an iMessage exploit active between December 2025 and January 2026. SHARE Foundation documented at least 14 advanced spyware targeting cases since early 2026, while Amnesty Tech and SHARE also found a new NoviSpy variant on an Android phone seized during police questioning.
The case indicates parallel use of mercenary and domestic spyware against activists, students, and opposition figures during an election year. Zero-click compromise on iPhone and post-seizure Android installation point to both remote and custodial access pathways, expanding the surveillance footprint across Serbia’s protest environment.
🛰️ Open sources - closed narratives
@sitreports
🔍 FBI probes dark-web sale of 153 million driver’s license scans
The FBI’s New Orleans field office is investigating after Nexus advertised records linked to over 170 million North American identities, including 153 million driver’s licenses and 10 million ID cards. Listings reportedly included front-and-back scans, infrared and ultraviolet images, photos, and timestamps. Evidence reviewed in the investigation points to IDScan.net, which says it is examining the incident.
If authentic, the dataset goes beyond routine PII leaks: full document images, barcodes, signatures, and scan metadata could enable fraud, account takeovers, and more convincing impersonation. Daily record growth may also indicate ongoing access rather than a one-time dump.
🛰️ Open sources - closed narratives
@sitreports
The FBI’s New Orleans field office is investigating after Nexus advertised records linked to over 170 million North American identities, including 153 million driver’s licenses and 10 million ID cards. Listings reportedly included front-and-back scans, infrared and ultraviolet images, photos, and timestamps. Evidence reviewed in the investigation points to IDScan.net, which says it is examining the incident.
If authentic, the dataset goes beyond routine PII leaks: full document images, barcodes, signatures, and scan metadata could enable fraud, account takeovers, and more convincing impersonation. Daily record growth may also indicate ongoing access rather than a one-time dump.
🛰️ Open sources - closed narratives
@sitreports
🔍 Thomson Reuters court software breach may have exposed sealed case data
Thomson Reuters disclosed a breach affecting court software used in U.S. judicial workflows, with potential exposure of Social Security numbers and sealed records. The incident centers on Thomson Reuters systems tied to court data handling, raising concern over both personal identifiers and restricted case material.
The significance is not only privacy loss but compromise of judicial data controls. Exposure of sealed filings would indicate failure at a high-trust legal data layer, expanding impact from routine PII theft to possible disclosure of protected proceedings.
🛰️ Open sources - closed narratives
@sitreports
Thomson Reuters disclosed a breach affecting court software used in U.S. judicial workflows, with potential exposure of Social Security numbers and sealed records. The incident centers on Thomson Reuters systems tied to court data handling, raising concern over both personal identifiers and restricted case material.
The significance is not only privacy loss but compromise of judicial data controls. Exposure of sealed filings would indicate failure at a high-trust legal data layer, expanding impact from routine PII theft to possible disclosure of protected proceedings.
🛰️ Open sources - closed narratives
@sitreports
📡 Pentagon launches mobile SCIF program for cleared industry access
The Defense Department has started the Secure Space Network, an initiative to design and produce about 50 mobile Sensitive Compartmented Information Facilities with related information systems. The transportable units are intended for rapid deployment to military bases, industry sites, and other locations where classified work is required.
The move directly targets a known bottleneck in the defense industrial base: smaller and non-traditional firms often lack accredited spaces for classified development and integration. A scalable, surge-capable mobile SCIF fleet lowers entry barriers and expands the pool of companies able to participate in sensitive programs.
🛰️ Open sources - closed narratives
@sitreports
The Defense Department has started the Secure Space Network, an initiative to design and produce about 50 mobile Sensitive Compartmented Information Facilities with related information systems. The transportable units are intended for rapid deployment to military bases, industry sites, and other locations where classified work is required.
The move directly targets a known bottleneck in the defense industrial base: smaller and non-traditional firms often lack accredited spaces for classified development and integration. A scalable, surge-capable mobile SCIF fleet lowers entry barriers and expands the pool of companies able to participate in sensitive programs.
🛰️ Open sources - closed narratives
@sitreports
🤖 Anthropic still flagged as risk to defense industrial base, US official says
A U.S. defense official says Anthropic remains designated a “Supply Chain Risk” at the Department of Defense and across the wider defense industrial base. The statement directly rejects claims of easing tensions between the AI company and the administration.
For defense procurement and trusted-tech screening, the designation matters more than public messaging. A standing supply-chain risk flag can shape vendor access, partnership decisions, and integration pathways across contractors handling sensitive programs.
🛰️ Open sources - closed narratives
@sitreports
A U.S. defense official says Anthropic remains designated a “Supply Chain Risk” at the Department of Defense and across the wider defense industrial base. The statement directly rejects claims of easing tensions between the AI company and the administration.
For defense procurement and trusted-tech screening, the designation matters more than public messaging. A standing supply-chain risk flag can shape vendor access, partnership decisions, and integration pathways across contractors handling sensitive programs.
🛰️ Open sources - closed narratives
@sitreports
🔍 ICE exposed restricted data via Palantir app before vetting
ICE deportation officers reportedly received the ELITE app on issued phones as a standard tool, including hires whose background checks were still incomplete. The Palantir-built system aggregates addresses, criminal histories, immigration records, court data, and other personally identifiable information, while DHS has not published a dedicated privacy impact assessment for ELITE.
Operationally, this combines accelerated hiring with immediate access to a sensitive targeting platform. The reported gap is not only personnel vetting, but governance: a fielded AI-enabled enforcement tool handling broad personal data without the full privacy documentation normally meant to define oversight, safeguards, and accountability.
🛰️ Open sources - closed narratives
@sitreports
ICE deportation officers reportedly received the ELITE app on issued phones as a standard tool, including hires whose background checks were still incomplete. The Palantir-built system aggregates addresses, criminal histories, immigration records, court data, and other personally identifiable information, while DHS has not published a dedicated privacy impact assessment for ELITE.
Operationally, this combines accelerated hiring with immediate access to a sensitive targeting platform. The reported gap is not only personnel vetting, but governance: a fielded AI-enabled enforcement tool handling broad personal data without the full privacy documentation normally meant to define oversight, safeguards, and accountability.
🛰️ Open sources - closed narratives
@sitreports
📡 Air Force accelerates MQ-9 replacement after heavy wartime attrition
The U.S. Air Force is moving faster on the Massed Modular Aircraft program after losing 45 MQ-9A Reapers in Operation Epic Fury, roughly a quarter of the fleet by mid-August. Officials now want at least 180 lower-cost aircraft at about $10 million per air vehicle, using mature technology and accepting reduced performance and survivability to speed fielding.
The shift marks a clear move from small numbers of expensive ISR-strike drones toward attritable capacity. Cost per effect, production volume, and shorter service life are being prioritized over long-term sustainment, indicating combat losses have forced a reassessment of what is operationally replaceable at scale.
🛰️ Open sources - closed narratives
@sitreports
The U.S. Air Force is moving faster on the Massed Modular Aircraft program after losing 45 MQ-9A Reapers in Operation Epic Fury, roughly a quarter of the fleet by mid-August. Officials now want at least 180 lower-cost aircraft at about $10 million per air vehicle, using mature technology and accepting reduced performance and survivability to speed fielding.
The shift marks a clear move from small numbers of expensive ISR-strike drones toward attritable capacity. Cost per effect, production volume, and shorter service life are being prioritized over long-term sustainment, indicating combat losses have forced a reassessment of what is operationally replaceable at scale.
🛰️ Open sources - closed narratives
@sitreports
📡 U.S. Navy and Quad partners expand AI tracking of dark fleets in the Pacific
NIWC Pacific has awarded Vantor a contract to provide Maritime Sentry for Indo-Pacific maritime domain awareness. The system fuses satellite imagery, SAR, AIS data, and AI-based vessel fingerprinting to detect and track ships that disable, spoof, or never transmit identification signals. The effort will support U.S. and partner workflows, including Indian Navy systems and SeaVision.
The key shift is not just detection but integration: Vantor’s output will feed directly into existing operational platforms used across Quad-linked partners. That improves shared maritime picture-building across a vast theater where non-compliant shipping, sanctions evasion, and covert activity exploit AIS blind spots.
🛰️ Open sources - closed narratives
@sitreports
NIWC Pacific has awarded Vantor a contract to provide Maritime Sentry for Indo-Pacific maritime domain awareness. The system fuses satellite imagery, SAR, AIS data, and AI-based vessel fingerprinting to detect and track ships that disable, spoof, or never transmit identification signals. The effort will support U.S. and partner workflows, including Indian Navy systems and SeaVision.
The key shift is not just detection but integration: Vantor’s output will feed directly into existing operational platforms used across Quad-linked partners. That improves shared maritime picture-building across a vast theater where non-compliant shipping, sanctions evasion, and covert activity exploit AIS blind spots.
🛰️ Open sources - closed narratives
@sitreports
📡 US military turns off ad trackers on devices amid Middle East targeting reports
The U.S. military has disabled advertising trackers on a range of phones and computers after reports that commercially available location data was used to target American forces in the Middle East. The move surfaced through statements and letters tied to Senator Ron Wyden.
Operationally, this frames ad-tech telemetry as a direct force protection issue rather than a privacy concern alone. It also underlines how routine mobile and device data can become actionable targeting intelligence when aggregated, sold, and matched against military patterns.
🛰️ Open sources - closed narratives
@sitreports
The U.S. military has disabled advertising trackers on a range of phones and computers after reports that commercially available location data was used to target American forces in the Middle East. The move surfaced through statements and letters tied to Senator Ron Wyden.
Operationally, this frames ad-tech telemetry as a direct force protection issue rather than a privacy concern alone. It also underlines how routine mobile and device data can become actionable targeting intelligence when aggregated, sold, and matched against military patterns.
🛰️ Open sources - closed narratives
@sitreports