{
  "schema_version": 2,
  "issue_date": "2026-09-15",
  "generated_at": "2026-09-15T21:04:18.199Z",
  "insight_context": {
    "schema_version": 2,
    "mode": "current",
    "checked_at": "2026-09-15T21:04:16.789Z",
    "report_date": "2026-09-15",
    "manifest_generated_at": "2026-09-15T16:44:42Z",
    "report_url": "https://ricomanifesto.github.io/SentryInsight/"
  },
  "articles": [
    {
      "id": "reporting-85fda3d5eeb6",
      "title": "Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites",
      "link": "https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/",
      "date": "2026-09-15T20:34:15.000Z",
      "source": "Bleeping Computer",
      "summary": "Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account…",
      "firstSeen": "2026-09-15T21:04:17.414Z"
    },
    {
      "id": "reporting-5b3e6060de6c",
      "title": "Microsoft Issues Emergency Fixes After Massive Patch Tuesday",
      "link": "https://www.darkreading.com/application-security/microsoft-emergency-fixes-patch-tuesday",
      "date": "2026-09-15T20:16:00.000Z",
      "source": "Dark Reading",
      "summary": "You can't make an omelet without breaking a few eggs, and you can't patch nearly 1,000 CVEs without a few glitches.",
      "firstSeen": "2026-09-15T21:04:17.414Z"
    },
    {
      "id": "reporting-990957c2387d",
      "title": "Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident",
      "link": "https://www.darkreading.com/vulnerabilities-threats/bhusa26huggingfacetalk",
      "date": "2026-09-15T19:27:19.000Z",
      "source": "Dark Reading",
      "summary": "The 'Breaking' News: The OpenAI–Hugging Face Incident - A Technical Reconstruction and Its Implications for AI At this Black Hat USA 2026 talk, OpenAI security engineers and researchers will reconstruct the OpenAI-Hugging Face incident and examine its implications for AI security, cyber resilience, and alignment. Throughout the session, they will share insights that address key topics raised by the Black Hat Review Board, including model safeguards, evaluation and containment practices, defensive use cases for AI, and the broader implications of increasingly autonomous systems for the cybersecurity community. The session will trace the models' attack path, including how frontier models are sandboxed during evaluations, how the models exploited a zero-day vulnerability to gain internet access, and how they identified and leveraged a remote code execution path on Hugging Face infrastructure. Drawing on the joint investigation, the speakers will explain how the activity was detected, contained, and investigated. They will also discuss the changes OpenAI is making to strengthen evaluation environments, containment controls, and monitoring capabilities, as well as the role AI systems played in supporting the investigation and response. In addition to the technical reconstruction of the incident, the session will address broader questions relevant to the security community, including lessons for improving AI system security, defensive applications of AI in incident response, and approaches to mitigating emerging risks associated with increasingly capable models. The discussion will also examine alignment challenges associated with long-running agents, including reward hacking, shifts in model behavior and persona over extended trajectories, and information sharing across multi-agent systems. Finally, the speakers will explore what this incident suggests about emerging AI cyber capabilities and how organizations can use AI to strengthen prevention, detection, investigation, and response efforts.",
      "firstSeen": "2026-09-15T21:04:17.414Z"
    },
    {
      "id": "reporting-e6910dbe4779",
      "title": "KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens",
      "link": "https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html",
      "date": "2026-09-15T18:54:14.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and…",
      "firstSeen": "2026-09-15T21:04:17.414Z"
    },
    {
      "id": "reporting-e55cfacdec13",
      "title": "VectraRAT Can Hack Windows Enterprises for $250 per Month",
      "link": "https://www.darkreading.com/endpoint-security/vectrarat-hack-windows-enterprises",
      "date": "2026-09-15T16:45:37.000Z",
      "source": "Dark Reading",
      "summary": "The full-service malware-as-a-service (MaaS) platform offers a Windows implant, command-and-control (C2) infrastructure, and an operator panel for comprehensive remote access.",
      "firstSeen": "2026-09-15T21:04:17.414Z"
    },
    {
      "id": "reporting-17561f6ddeba",
      "title": "CenterPoint Energy confirms customer data stolen in cyberattack",
      "link": "https://www.bleepingcomputer.com/news/security/centerpoint-energy-confirms-customer-data-stolen-in-cyberattack/",
      "date": "2026-09-15T16:40:14.000Z",
      "source": "Bleeping Computer",
      "summary": "CenterPoint Energy disclosed a breach compromising some customers' personal information after an attacker leaked data allegedly stolen from the utility company…",
      "firstSeen": "2026-09-15T21:04:17.414Z"
    },
    {
      "id": "reporting-41594bea7c5a",
      "title": "Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists",
      "link": "https://thehackernews.com/2026/09/iranian-hackers-use-telegram-controlled.html",
      "date": "2026-09-15T16:29:51.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran's intelligence service uses to spy on dissidents, journalists, and activists around the world. The malware is controlled via the Telegram messaging app and can copy a target's emails and chat messages, take screenshots, and activate the microphone to record…",
      "firstSeen": "2026-09-15T21:04:17.414Z"
    },
    {
      "id": "reporting-999d56a1d809",
      "title": "BambooToken Malware Uses MQTT to Control Windows and Linux Systems",
      "link": "https://thehackernews.com/2026/09/bambootoken-malware-uses-mqtt-to.html",
      "date": "2026-09-15T15:23:19.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America.",
      "firstSeen": "2026-09-15T16:39:02.952Z"
    },
    {
      "id": "reporting-05ce5f8d2829",
      "title": "BambooToken malware controls Windows and Linux systems via MQTT",
      "link": "https://www.bleepingcomputer.com/news/security/bambootoken-malware-controls-windows-and-linux-systems-via-mqtt/",
      "date": "2026-09-15T15:00:00.000Z",
      "source": "Bleeping Computer",
      "summary": "A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems…",
      "firstSeen": "2026-09-15T16:39:02.952Z"
    },
    {
      "id": "reporting-beff2a4f92d5",
      "title": "Hackers target WordPress sites via third-party WooCommerce plugin",
      "link": "https://www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-via-third-party-woocommerce-plugin/",
      "date": "2026-09-15T14:45:10.000Z",
      "source": "Bleeping Computer",
      "summary": "Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor…",
      "firstSeen": "2026-09-15T16:39:02.952Z"
    },
    {
      "id": "reporting-ff7f881cf08d",
      "title": "What Zero-Day Response Should Be in the Post-Mythos Era",
      "link": "https://www.bleepingcomputer.com/news/security/what-zero-day-response-should-be-in-the-post-mythos-era/",
      "date": "2026-09-15T13:45:54.000Z",
      "source": "Bleeping Computer",
      "summary": "AI is shrinking the time between vulnerability disclosure and exploitation, leaving defenders less time to wait for patches or public exploits. Picus Security explains how exploitability validation, security control testing, and autonomous pentesting can help teams close exposure gaps before attackers arrive…",
      "firstSeen": "2026-09-15T16:39:02.952Z"
    },
    {
      "id": "reporting-0d4ce8b8f152",
      "title": "CISA: Critical VMware RCE flaw now exploited by ransomware gangs",
      "link": "https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/",
      "date": "2026-09-15T12:16:32.000Z",
      "source": "Bleeping Computer",
      "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July…",
      "firstSeen": "2026-09-15T16:39:02.952Z"
    },
    {
      "id": "reporting-f78f80e44815",
      "title": "Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds",
      "link": "https://thehackernews.com/2026/09/human-attacker-exploits-marimo-rce.html",
      "date": "2026-09-15T11:52:28.000Z",
      "source": "The Hacker News",
      "summary": "With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH…",
      "firstSeen": "2026-09-15T16:39:02.952Z"
    },
    {
      "id": "reporting-cfd00dbf5fd3",
      "title": "Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point",
      "link": "https://thehackernews.com/2026/09/attack-chains-not-just-attack-surfaces.html",
      "date": "2026-09-15T11:26:36.000Z",
      "source": "The Hacker News",
      "summary": "Introduction Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my organization fail the phishing simulation? Does this SIEM rule fire on this particular technique? And, in more mature organizations, this testing happens continuously rather than as a one-off exercise. But no matter how much you validate against these…",
      "firstSeen": "2026-09-15T16:39:02.952Z"
    },
    {
      "id": "reporting-bf27a701dddc",
      "title": "Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers",
      "link": "https://thehackernews.com/2026/09/mass-scanning-campaign-exploits-vite.html",
      "date": "2026-09-15T11:12:32.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs. The…",
      "firstSeen": "2026-09-15T16:39:02.952Z"
    },
    {
      "id": "reporting-d25118e27437",
      "title": "Suspected Black Axe gang leaders face cybercrime charges in the US",
      "link": "https://www.bleepingcomputer.com/news/security/black-axe-gang-members-extradited-to-us-face-cybercrime-charges/",
      "date": "2026-09-15T09:50:25.000Z",
      "source": "Bleeping Computer",
      "summary": "Five alleged leaders of the Black Axe cybercrime syndicate, known for its involvement in global-scale cyber-enabled financial fraud, have been extradited to the United States to face wire fraud and money laundering charges…",
      "firstSeen": "2026-09-15T11:26:36.908Z"
    },
    {
      "id": "reporting-d8af88201601",
      "title": "Microsoft confirms KB5002914 Excel update breaks copy and paste",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-kb5002914-security-update-breaks-excel-copy-and-paste/",
      "date": "2026-09-15T08:40:20.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft has confirmed that copy and paste may silently fail for some Excel users after installing the September 2026 KB5002914 security update…",
      "firstSeen": "2026-09-15T11:26:36.908Z"
    },
    {
      "id": "reporting-96c09c631f16",
      "title": "Cisco patches Secure Email Gateway zero-day exploited in attacks",
      "link": "https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/",
      "date": "2026-09-15T07:31:09.000Z",
      "source": "Bleeping Computer",
      "summary": "Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks…",
      "firstSeen": "2026-09-15T11:26:36.908Z"
    },
    {
      "id": "reporting-7c09d00af3de",
      "title": "LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server",
      "link": "https://thehackernews.com/2026/09/litespeed-enterprise-flaw-could-let-one.html",
      "date": "2026-09-15T06:52:16.000Z",
      "source": "The Hacker News",
      "summary": "A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel warned in an advisory published on September 14. On such servers, many customers' sites run on a single machine, and an attacker with one of those hosting accounts could exploit the flaw to access or alter other sites and the server itself…",
      "firstSeen": "2026-09-15T11:26:36.908Z"
    },
    {
      "id": "reporting-afc835b3ebd2",
      "title": "Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution",
      "link": "https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html",
      "date": "2026-09-15T06:11:11.000Z",
      "source": "The Hacker News",
      "summary": "Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of insufficient validation in the email parsing logic that could allow an unauthenticated, remote attacker…",
      "firstSeen": "2026-09-15T11:26:36.908Z"
    },
    {
      "id": "reporting-689ffb8dd99a",
      "title": "China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE",
      "link": "https://thehackernews.com/2026/09/china-linked-hackers-exploit-chrome.html",
      "date": "2026-09-15T05:31:05.000Z",
      "source": "The Hacker News",
      "summary": "A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. \"The…",
      "firstSeen": "2026-09-15T11:26:36.908Z"
    },
    {
      "id": "reporting-caf5df445550",
      "title": "'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/sandworm-chains-cisco-vulnerabilities-cyclops-blink",
      "date": "2026-09-14T21:37:28.000Z",
      "source": "Dark Reading",
      "summary": "The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022.",
      "firstSeen": "2026-09-14T23:45:55.055Z"
    },
    {
      "id": "reporting-89e52df0d44d",
      "title": "Microsoft releases emergency Windows updates to fix RDS failures",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-windows-updates-to-fix-rds-failures/",
      "date": "2026-09-14T20:52:18.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft has released emergency out-of-band Windows updates to fix Remote Desktop Services failures caused by this month's security updates, along with Hyper-V and USB audio problems on some Windows versions…",
      "firstSeen": "2026-09-14T23:45:55.055Z"
    },
    {
      "id": "reporting-bc6f1b881d2b",
      "title": "Japan's Digital Agency says VPN flaw exposed 246,000 personnel records",
      "link": "https://www.bleepingcomputer.com/news/security/japans-digital-agency-says-vpn-flaw-exposed-246-000-personnel-records/",
      "date": "2026-09-14T20:36:02.000Z",
      "source": "Bleeping Computer",
      "summary": "Japan's Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees…",
      "firstSeen": "2026-09-14T23:45:55.055Z"
    },
    {
      "id": "reporting-238d9d5bfc83",
      "title": "Maximum Severity GitLab Flaw Puts Supply Chains at Risk",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/maximum-severity-gitlab-flaw-supply-chains-risk",
      "date": "2026-09-14T20:19:22.000Z",
      "source": "Dark Reading",
      "summary": "CVE-2026-85706 is a path traversal vulnerability with a 10 out of 10 CVSS score, affecting both GitLab Community Edition and Enterprise Edition instances.",
      "firstSeen": "2026-09-14T23:45:55.055Z"
    },
    {
      "id": "reporting-f635bd0fb914",
      "title": "Homebrew 7.0.0 gets built-in GUI, better security controls",
      "link": "https://www.bleepingcomputer.com/news/security/homebrew-700-gets-built-in-gui-better-security-controls/",
      "date": "2026-09-14T19:51:04.000Z",
      "source": "Bleeping Computer",
      "summary": "Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface…",
      "firstSeen": "2026-09-14T23:45:55.055Z"
    },
    {
      "id": "reporting-0c060fb984f7",
      "title": "Twitch extension with 30K installs exposes users’ OAuth tokens",
      "link": "https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/",
      "date": "2026-09-14T19:03:51.000Z",
      "source": "Bleeping Computer",
      "summary": "A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session tokens to a commercial bot service…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-6aad7771fb49",
      "title": "Hackers hijack HBO Max Reddit account to push malware in ClickFix ads",
      "link": "https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/",
      "date": "2026-09-14T18:34:16.000Z",
      "source": "Bleeping Computer",
      "summary": "Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-d1e3ec219567",
      "title": "New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing",
      "link": "https://thehackernews.com/2026/09/new-ddrop-attack-breaks-intel-tdx-and.html",
      "date": "2026-09-14T18:02:13.000Z",
      "source": "The Hacker News",
      "summary": "Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently dropping writes to a server's memory, so the processor keeps reading old encrypted data as if it were current. The attack requires an attacker who already controls the server's software and can briefly access the machine to insert a small circuit…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-2e4ea22accc3",
      "title": "3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials",
      "link": "https://thehackernews.com/2026/09/3bb-attacker-used-meshcentral-backdoor.html",
      "date": "2026-09-14T18:01:49.000Z",
      "source": "The Hacker News",
      "summary": "An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said. The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker's own tools and a list of…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-7b20c25c5672",
      "title": "Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports",
      "link": "https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html",
      "date": "2026-09-14T17:58:16.000Z",
      "source": "The Hacker News",
      "summary": "A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12. In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-09d1dd4eafdf",
      "title": "Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries",
      "link": "https://thehackernews.com/2026/09/red-heron-exploits-gitea-rce-to.html",
      "date": "2026-09-14T16:56:30.000Z",
      "source": "The Hacker News",
      "summary": "A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. \"Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems,\" Acronis Threat Research Unit (TRU)…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-722811b86b4d",
      "title": "Anthropic CEO: Time to Shift From Improving to Controlling AI",
      "link": "https://www.darkreading.com/cyber-risk/anthropic-ceo-shift-from-improving-to-controlling-ai",
      "date": "2026-09-14T16:41:10.000Z",
      "source": "Dark Reading",
      "summary": "Dario Amodei says it's time to slow the pace of frontier AI improvements so that security and risk prevention efforts can catch up. What does this mean for enterprises?",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-5aa4d6dc4864",
      "title": "Hackers target exposed Vite dev servers to steal AWS, Azure secrets",
      "link": "https://www.bleepingcomputer.com/news/security/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets/",
      "date": "2026-09-14T16:15:58.000Z",
      "source": "Bleeping Computer",
      "summary": "A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-0c1a781fba3e",
      "title": "WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution",
      "link": "https://thehackernews.com/2026/09/wordpress-adds-automated-plugin-reviews.html",
      "date": "2026-09-14T16:00:04.000Z",
      "source": "The Hacker News",
      "summary": "WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved. \"New plugins are reviewed before they enter the directory, but updates ship continuously after that,\" David Perez, WordPress Official Plugin…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-161dd11ccccf",
      "title": "⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits",
      "link": "https://thehackernews.com/2026/09/weekly-recap-rogue-ai-agents-wechat.html",
      "date": "2026-09-14T14:40:34.000Z",
      "source": "The Hacker News",
      "summary": "AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination. The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-5240973ddd6b",
      "title": "Why Patch Automation Needs Brakes, Not Just an Accelerator",
      "link": "https://www.bleepingcomputer.com/news/security/why-patch-automation-needs-brakes-not-just-an-accelerator/",
      "date": "2026-09-14T14:01:11.000Z",
      "source": "Bleeping Computer",
      "summary": "Patch automation can help IT teams keep pace with growing update volumes, but deploying faster also means bad updates can spread faster. Action1 explains how update rings, predefined success criteria, and human oversight can make automated patching faster without sacrificing control…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-0952b915a227",
      "title": "Webinar: How malicious OAuth apps can lead to Google Workspace breaches",
      "link": "https://www.bleepingcomputer.com/news/security/webinar-how-malicious-oauth-apps-can-lead-to-google-workspace-breaches/",
      "date": "2026-09-14T12:15:23.000Z",
      "source": "Bleeping Computer",
      "summary": "Attackers can combine social engineering with malicious OAuth applications to gain access to Google Workspace data without relying solely on stolen passwords. This webinar examines two attacks to show how these breaches unfold and which security controls can help stop them…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-d82614babf1b",
      "title": "AI Changed the Exposure Problem. Validation Needs to Change With It.",
      "link": "https://thehackernews.com/2026/09/ai-changed-exposure-problem-validation.html",
      "date": "2026-09-14T11:58:00.000Z",
      "source": "The Hacker News",
      "summary": "There's a lot of noise around AI and cybersecurity right now. What’s actually important is far simpler, if often lost in the hubbub. Vulnerability discovery is getting faster and happening at a much greater scale, while defenders still have to work out which findings actually deserve their action. In the first half of 2026, a whopping 35,853 CVEs were published, roughly 49% more than in the…",
      "firstSeen": "2026-09-14T19:46:43.052Z"
    },
    {
      "id": "reporting-d736f387a99b",
      "title": "Microsoft: September updates cause RDS failures on Windows Server",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-updates-cause-rds-failures-on-windows-server/",
      "date": "2026-09-14T09:50:25.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft has confirmed reports that the September 2026 security updates cause Remote Desktop Services (RDS) failures on Windows Server systems…",
      "firstSeen": "2026-09-14T12:19:45.686Z"
    },
    {
      "id": "reporting-9c68dabef82c",
      "title": "Revolut discloses data breach exposing financial info, passports",
      "link": "https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/",
      "date": "2026-09-14T08:48:24.000Z",
      "source": "Bleeping Computer",
      "summary": "Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency…",
      "firstSeen": "2026-09-14T12:19:45.686Z"
    },
    {
      "id": "reporting-2843574c9b45",
      "title": "Microsoft: September updates break audio on some Windows PCs",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-updates-break-audio-on-some-windows-pcs/",
      "date": "2026-09-14T08:08:16.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft has confirmed that USB audio devices may fail on some Windows systems after installing the KB5124008and KB5124012 September 2026 security updates…",
      "firstSeen": "2026-09-14T12:19:45.686Z"
    },
    {
      "id": "reporting-69430c4b5fd5",
      "title": "Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users",
      "link": "https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html",
      "date": "2026-09-14T07:24:39.000Z",
      "source": "The Hacker News",
      "summary": "A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named \"Twitch Enhanced Viewer | JeetBot,\" lists HISHIMIRO/jeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store - Chrome -…",
      "firstSeen": "2026-09-14T12:19:45.686Z"
    },
    {
      "id": "reporting-31d7ea4cc106",
      "title": "CISA: Hackers now exploit max severity GitLab flaw in attacks",
      "link": "https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks/",
      "date": "2026-09-14T07:06:27.000Z",
      "source": "Bleeping Computer",
      "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks…",
      "firstSeen": "2026-09-14T12:19:45.686Z"
    },
    {
      "id": "reporting-b2a972265875",
      "title": "Hackers exploit Tencent app flaw to deploy GrayRabbit malware",
      "link": "https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/",
      "date": "2026-09-13T14:26:32.000Z",
      "source": "Bleeping Computer",
      "summary": "Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor…",
      "firstSeen": "2026-09-13T15:56:25.862Z"
    },
    {
      "id": "reporting-fa59062d0b2f",
      "title": "Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data",
      "link": "https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html",
      "date": "2026-09-13T10:11:48.000Z",
      "source": "The Hacker News",
      "summary": "Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers…",
      "firstSeen": "2026-09-13T11:26:55.317Z"
    },
    {
      "id": "reporting-0ddc7c58e041",
      "title": "CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV",
      "link": "https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html",
      "date": "2026-09-12T15:54:45.000Z",
      "source": "The Hacker News",
      "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. Details of the vulnerabilities are as follows - CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization…",
      "firstSeen": "2026-09-12T20:23:28.263Z"
    },
    {
      "id": "reporting-59b3d76728f8",
      "title": "Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent",
      "link": "https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/",
      "date": "2026-09-12T14:14:32.000Z",
      "source": "Bleeping Computer",
      "summary": "The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103…",
      "firstSeen": "2026-09-12T15:19:30.915Z"
    },
    {
      "id": "reporting-d66479afd965",
      "title": "When the Whole Company Adopts AI: What It Does to Your SOC",
      "link": "https://thehackernews.com/2026/09/when-whole-company-adopts-ai-what-it.html",
      "date": "2026-09-12T10:24:44.000Z",
      "source": "The Hacker News",
      "summary": "Over the past year, we watched a new class of alert appear in enterprise security operations centers and grow faster than anything else in the stream: alerts that were triggered by AI tools and agents. Not attacks against AI, but the ordinary, everyday footprint of an organization using it, from developers running coding agents and non-technical staff signing consumer AI tools into corporate…",
      "firstSeen": "2026-09-12T15:19:30.915Z"
    },
    {
      "id": "reporting-f05890c0a6ff",
      "title": "OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers",
      "link": "https://thehackernews.com/2026/09/openai-agents-linked-to-rubygems.html",
      "date": "2026-09-12T09:07:56.000Z",
      "source": "The Hacker News",
      "summary": "The \"major malicious attack\" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the…",
      "firstSeen": "2026-09-12T10:24:23.974Z"
    },
    {
      "id": "reporting-ed5e0e272a95",
      "title": "Hackers abused Claude to extract secrets from 1.8M Android apps",
      "link": "https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/",
      "date": "2026-09-11T20:19:09.000Z",
      "source": "Bleeping Computer",
      "summary": "Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes…",
      "firstSeen": "2026-09-11T20:45:34.169Z"
    }
  ]
}