{
  "schema_version": 2,
  "issue_date": "2026-09-24",
  "generated_at": "2026-09-24T21:21:05.620Z",
  "insight_context": {
    "schema_version": 2,
    "mode": "current",
    "checked_at": "2026-09-24T21:21:04.011Z",
    "report_date": "2026-09-24",
    "manifest_generated_at": "2026-09-24T11:33:56Z",
    "report_url": "https://ricomanifesto.github.io/SentryInsight/"
  },
  "articles": [
    {
      "id": "reporting-9e7b4de9cac3",
      "title": "'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing",
      "link": "https://www.darkreading.com/application-security/salesbleed-exploits-salesforce-agents-slack-phishing",
      "date": "2026-09-24T21:04:03.000Z",
      "source": "Dark Reading",
      "summary": "Agentic AI can smuggle arbitrary instructions from the Web, across multiple apps, into trusted internal communications channels.",
      "firstSeen": "2026-09-24T21:21:04.350Z"
    },
    {
      "id": "reporting-7265697f416b",
      "title": "MacSync malware uses public iCloud calendars to deliver new payloads",
      "link": "https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/",
      "date": "2026-09-24T20:53:35.000Z",
      "source": "Bleeping Computer",
      "summary": "A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads…",
      "firstSeen": "2026-09-24T21:21:04.350Z"
    },
    {
      "id": "reporting-4e2ff3ee1aa8",
      "title": "SectopRAT Returns, Hiding Inside a Legitimate Application",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/sectoprat-returns-hiding-inside-legitimate-application",
      "date": "2026-09-24T20:32:50.000Z",
      "source": "Dark Reading",
      "summary": "The latest activity from the remote access Trojan (RAT) shows why organizations should monitor the behavior of applications rather than blindly trusting them, experts say.",
      "firstSeen": "2026-09-24T21:21:04.350Z"
    },
    {
      "id": "reporting-8692e38436e8",
      "title": "New Carbonato malware uses AI agents to hijack exposed Docker hosts",
      "link": "https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/",
      "date": "2026-09-24T20:10:48.000Z",
      "source": "Bleeping Computer",
      "summary": "A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control…",
      "firstSeen": "2026-09-24T21:21:04.350Z"
    },
    {
      "id": "reporting-7a9b3e084e40",
      "title": "Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions",
      "link": "https://thehackernews.com/2026/09/unpatched-oneplus-flaws-let-installed.html",
      "date": "2026-09-24T18:10:18.000Z",
      "source": "The Hacker News",
      "summary": "A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told him the same flaws affect many more of its own devices and those of OPPO, though it has not…",
      "firstSeen": "2026-09-24T21:21:04.350Z"
    },
    {
      "id": "reporting-37f6b04fa6f0",
      "title": "ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories",
      "link": "https://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.html",
      "date": "2026-09-24T17:52:43.000Z",
      "source": "The Hacker News",
      "summary": "This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more than expected. Fake prompts look real enough. And some attacks barely need an exploit at all — just…",
      "firstSeen": "2026-09-24T21:21:04.350Z"
    },
    {
      "id": "reporting-d8d3bf9e01bc",
      "title": "Exposed GitLab project email addresses let attackers push code",
      "link": "https://www.bleepingcomputer.com/news/security/exposed-gitlab-project-email-addresses-let-attackers-push-code/",
      "date": "2026-09-24T17:47:44.000Z",
      "source": "Bleeping Computer",
      "summary": "Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports…",
      "firstSeen": "2026-09-24T21:21:04.350Z"
    },
    {
      "id": "reporting-e32e04002703",
      "title": "Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content",
      "link": "https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html",
      "date": "2026-09-24T15:27:32.000Z",
      "source": "The Hacker News",
      "summary": "The \"third-party[.]com\" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. \"third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays,\" Manifold Security's Head of Research, Ax Sharma, said. \"Unlike 'example[.]com,' third-party[.]com…",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-3f4d35272a0b",
      "title": "3 Cyber Threats That Defined the Summer of 2026",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/3-cyber-threats-defined-summer-2026",
      "date": "2026-09-24T14:44:12.000Z",
      "source": "Dark Reading",
      "summary": "This installment of the Reporters' Notebook video series discusses the impact of AI agents breaching Hugging Face, Fairlife's ransomware attack, and Iranian-linked threat actors compromising a dozen US water systems. It was a busy summer.",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-f6922c0e9c4b",
      "title": "Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer",
      "link": "https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html",
      "date": "2026-09-24T14:29:06.000Z",
      "source": "The Hacker News",
      "summary": "An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. \"When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the…",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-acf3df0908a9",
      "title": "How to Build A SASE Framework for Modern Cybersecurity",
      "link": "https://www.darkreading.com/cloud-security/how-to-build-sase-framework",
      "date": "2026-09-24T14:02:43.000Z",
      "source": "Dark Reading",
      "summary": "Keeping edge computing safe requires organizations to fundamentally rethink security governance. Here is a path forward: a step-by-step guide to building a SASE framework.",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-1c3c43c41079",
      "title": "FedRAMP VDR & VER: Daily Scans Are Only the Beginning",
      "link": "https://www.bleepingcomputer.com/news/security/fedramp-vdr-and-ver-daily-scans-are-only-the-beginning/",
      "date": "2026-09-24T14:02:12.000Z",
      "source": "Bleeping Computer",
      "summary": "FedRAMP's new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecdotes explains why the December 7 deadline is just the beginning of a broader shift toward continuous, automated compliance validation…",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-75c374a3d121",
      "title": "Ghost Service Accounts Enable M365 Data Theft in Chile",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/ghost-service-accounts-m365-data-theft-chile",
      "date": "2026-09-24T13:30:00.000Z",
      "source": "Dark Reading",
      "summary": "Even if the organization locks down employee accounts, forgotten and lost service accounts can still undo the organization's entire M365 environment.",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-d7761a75ee2f",
      "title": "Hackers now exploit critical Roundcube flaw in code injection attacks",
      "link": "https://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/",
      "date": "2026-09-24T13:27:57.000Z",
      "source": "Bleeping Computer",
      "summary": "A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security…",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-f8ad8d75a50e",
      "title": "Prompt-Injection Bug Hits $4B Agentic AI App 'Manus'",
      "link": "https://www.darkreading.com/application-security/prompt-injection-bug-agentic-ai-app-manus",
      "date": "2026-09-24T13:00:00.000Z",
      "source": "Dark Reading",
      "summary": "AI apps that interpret external data (read: most AI apps) need exceptionally rigorous security filters, or attackers can take advantage.",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-1f4ae2ff4c87",
      "title": "Windows 11 KB5124010 update released with 46 changes and fixes",
      "link": "https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5124010-update-released-with-46-changes-and-fixes/",
      "date": "2026-09-24T12:16:32.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft released the KB5124010 September 2026 non-security preview update for Windows 11 24H2 and 25H2, with 46 changes including Bluetooth improvements and the ability to remap the Copilot key…",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-00d7c4958ac5",
      "title": "Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls",
      "link": "https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html",
      "date": "2026-09-24T12:05:27.000Z",
      "source": "The Hacker News",
      "summary": "The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name \"com.corp.mdm\" Corp MDM…",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-eeeda4f678fa",
      "title": "Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore",
      "link": "https://thehackernews.com/2026/09/secrets-sprawl-is-identity-problem-that.html",
      "date": "2026-09-24T11:00:00.000Z",
      "source": "The Hacker News",
      "summary": "AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl Report, commits identified as AI-assisted are leaking secrets at approximately twice the rate of human-written ones. Most of the fastest-growing categories of leaked credentials are now connected to AI…",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-f5dd20ff54d8",
      "title": "CISA: Ransomware gangs now exploiting critical TeamCity flaw",
      "link": "https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/",
      "date": "2026-09-24T10:42:37.000Z",
      "source": "Bleeping Computer",
      "summary": "​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July…",
      "firstSeen": "2026-09-24T11:26:17.959Z"
    },
    {
      "id": "reporting-7e0f816f375f",
      "title": "OpenAI hacked Australian Medicare govt site, probed data providers",
      "link": "https://www.bleepingcomputer.com/news/security/openai-hacked-australian-medicare-govt-site-probed-data-providers/",
      "date": "2026-09-24T09:38:53.000Z",
      "source": "Bleeping Computer",
      "summary": "OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a security weakness in an Australian government portal while performing information-retrieval tasks as part of a research project…",
      "firstSeen": "2026-09-24T11:26:17.959Z"
    },
    {
      "id": "reporting-5408002adacb",
      "title": "17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360",
      "link": "https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html",
      "date": "2026-09-24T09:14:21.000Z",
      "source": "The Hacker News",
      "summary": "ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read…",
      "firstSeen": "2026-09-24T11:26:17.959Z"
    },
    {
      "id": "reporting-97c422976cf7",
      "title": "Microsoft fixes bug that broke Windows File History backup feature",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-backup-feature-broken-by-september-updates/",
      "date": "2026-09-24T08:14:47.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft has fixed a known issue that breaks the built-in File History backup feature on some Windows systems after installing the September 2026 security updates…",
      "firstSeen": "2026-09-24T11:26:17.959Z"
    },
    {
      "id": "reporting-7a413f58e46a",
      "title": "OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files",
      "link": "https://thehackernews.com/2026/09/openai-agent-bypassed-australian.html",
      "date": "2026-09-24T07:07:25.000Z",
      "source": "The Hacker News",
      "summary": "An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and personal records. The agent reached files on it that were not public, but no personal…",
      "firstSeen": "2026-09-24T11:26:17.959Z"
    },
    {
      "id": "reporting-b54ca687b5eb",
      "title": "TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords",
      "link": "https://thehackernews.com/2026/09/teamfiltration-compromises-seven.html",
      "date": "2026-09-24T06:32:03.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. \"The campaign compromised 7 accounts –…",
      "firstSeen": "2026-09-24T11:26:17.959Z"
    },
    {
      "id": "reporting-baff1d5496fd",
      "title": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure",
      "link": "https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html",
      "date": "2026-09-24T05:36:18.000Z",
      "source": "The Hacker News",
      "summary": "Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE). \"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file…",
      "firstSeen": "2026-09-24T11:26:17.959Z"
    },
    {
      "id": "reporting-3c5d9756b70d",
      "title": "Placeholder domain used in dev docs now serves ClickFix attacks",
      "link": "https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/",
      "date": "2026-09-23T22:46:01.000Z",
      "source": "Bleeping Computer",
      "summary": "The \"third-party.com\" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands…",
      "firstSeen": "2026-09-24T04:04:59.459Z"
    },
    {
      "id": "reporting-a165484b908f",
      "title": "SASE Converges Network & Security Into One Cloud Solution",
      "link": "https://www.darkreading.com/cloud-security/sase-converges-network-security-one-cloud",
      "date": "2026-09-23T22:29:10.000Z",
      "source": "Dark Reading",
      "summary": "Enterprise computing is moving to the edge. Keeping it secure requires tactics far beyond putting up firewalls.",
      "firstSeen": "2026-09-24T16:51:42.271Z"
    },
    {
      "id": "reporting-ab9e6d2169bc",
      "title": "New RemControl Android banking malware targets users in Europe and Canada",
      "link": "https://www.bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada/",
      "date": "2026-09-23T21:25:13.000Z",
      "source": "Bleeping Computer",
      "summary": "A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application…",
      "firstSeen": "2026-09-24T04:04:59.459Z"
    },
    {
      "id": "reporting-ce08fe4b2a6e",
      "title": "EDR Evasion Stack Helps Process Injection Slip Past Defenses",
      "link": "https://www.darkreading.com/endpoint-security/edr-evasion-stack-helps-process-injection-slip-past-defenses",
      "date": "2026-09-23T21:03:01.000Z",
      "source": "Dark Reading",
      "summary": "A process parameter-poisoning technique evades EDR by injecting code into process initialization structures without using the Windows APIs that EDR tools typically watch out for.",
      "firstSeen": "2026-09-23T21:19:28.233Z"
    },
    {
      "id": "reporting-1c23b8ad7b78",
      "title": "GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks",
      "link": "https://www.darkreading.com/application-security/gitlab-email-addresses-supply-chain-attacks",
      "date": "2026-09-23T20:53:38.000Z",
      "source": "Dark Reading",
      "summary": "Incoming email addresses automatically assigned to each user on the platform contain highly privileged access tokens that attackers can use.",
      "firstSeen": "2026-09-23T21:19:28.233Z"
    },
    {
      "id": "reporting-702aeb848c91",
      "title": "Check Point warns of hackers exploiting Security Gateway VPN RCE flaw",
      "link": "https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/",
      "date": "2026-09-23T19:53:54.000Z",
      "source": "Bleeping Computer",
      "summary": "Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product…",
      "firstSeen": "2026-09-23T21:19:28.233Z"
    },
    {
      "id": "reporting-368846adf0a4",
      "title": "Hackers start exploiting critical WordPress flaw for code execution",
      "link": "https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/",
      "date": "2026-09-23T18:31:22.000Z",
      "source": "Bleeping Computer",
      "summary": "Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed…",
      "firstSeen": "2026-09-23T21:19:28.233Z"
    },
    {
      "id": "reporting-d1ccb5f32ae9",
      "title": "Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry",
      "link": "https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html",
      "date": "2026-09-23T18:06:30.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/…",
      "firstSeen": "2026-09-23T21:19:28.233Z"
    },
    {
      "id": "reporting-88652842189a",
      "title": "A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You",
      "link": "https://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.html",
      "date": "2026-09-23T16:53:10.000Z",
      "source": "The Hacker News",
      "summary": "The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a button labeled \"Email work item to this project.\" Mail sent to it opens an issue in that project, authored…",
      "firstSeen": "2026-09-23T21:19:28.233Z"
    },
    {
      "id": "reporting-8b8a2ad63964",
      "title": "Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers",
      "link": "https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/",
      "date": "2026-09-23T16:20:54.000Z",
      "source": "Bleeping Computer",
      "summary": "A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-20d13eec11e1",
      "title": "MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key",
      "link": "https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html",
      "date": "2026-09-23T16:06:41.000Z",
      "source": "The Hacker News",
      "summary": "Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-e8c276516926",
      "title": "UAE, Saudi Arabia Face Onslaught of Increasingly Complex Cyberattacks",
      "link": "https://www.darkreading.com/threat-intelligence/uae-saudi-arabia-face-onslaught-of-increasingly-sophisticated-automated-cyberattacks",
      "date": "2026-09-23T16:01:00.000Z",
      "source": "Dark Reading",
      "summary": "The United Arab Emirates and Kingdom of Saudi Arabia together absorbed 50% of all cyberattacks recorded across the Gulf region in the first half of 2026.",
      "firstSeen": "2026-09-23T11:10:11.469Z"
    },
    {
      "id": "reporting-071e1775dc0d",
      "title": "Attackers Manipulate AI Chatbots in Mass Disinformation, Phishing Campaign",
      "link": "https://www.darkreading.com/threat-intelligence/attackers-manipulate-ai-chatbots-mass-disinformation-phishing-campaign",
      "date": "2026-09-23T14:47:09.000Z",
      "source": "Dark Reading",
      "summary": "Threat actors are poisoning ChatGPT, Gemini, and Google AI Overview answers by seeding the Web with malicious links and data and then optimizing the content.",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-957f7dd38517",
      "title": "InfraTrust report warns network management systems under attack",
      "link": "https://www.bleepingcomputer.com/news/security/infratrust-report-warns-network-management-systems-under-attack/",
      "date": "2026-09-23T14:35:26.000Z",
      "source": "Bleeping Computer",
      "summary": "Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-1e2c3d8631df",
      "title": "This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move",
      "link": "https://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.html",
      "date": "2026-09-23T14:17:58.000Z",
      "source": "The Hacker News",
      "summary": "A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is.",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-721edf9e0fd7",
      "title": "How One Kubernetes YAML Can Hand Over a GCP Organization",
      "link": "https://www.bleepingcomputer.com/news/security/how-one-kubernetes-yaml-can-hand-over-a-gcp-organization/",
      "date": "2026-09-23T14:01:11.000Z",
      "source": "Bleeping Computer",
      "summary": "A Kubernetes user with limited permissions can potentially gain control of an entire Google Cloud organization by exploiting the authority granted to Google Kubernetes Config Connector. Varonis explains how this confused deputy problem can turn a single Kubernetes YAML file into a path to organization-wide privilege escalation…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-344fcd62c82a",
      "title": "Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI",
      "link": "https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html",
      "date": "2026-09-23T13:52:46.000Z",
      "source": "The Hacker News",
      "summary": "Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and StepSecurity, the libraries in question below - @memtensor/memos-cloud-openclaw-plugin versions…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-a0cbe8a44ac4",
      "title": "Arista patches actively exploited VeloCloud Orchestrator zero-day",
      "link": "https://www.bleepingcomputer.com/news/security/arista-patches-actively-exploited-velocloud-orchestrator-zero-day/",
      "date": "2026-09-23T12:29:53.000Z",
      "source": "Bleeping Computer",
      "summary": "Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-879d2dbbe17d",
      "title": "New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control",
      "link": "https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html",
      "date": "2026-09-23T12:16:00.000Z",
      "source": "The Hacker News",
      "summary": "A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take \"full control of the server,\" the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts. cPanel has released fixed versions for both…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-9e58e34631c5",
      "title": "545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent",
      "link": "https://thehackernews.com/2026/09/545-hackers-tested-it-first-now-xranges.html",
      "date": "2026-09-23T11:47:19.000Z",
      "source": "The Hacker News",
      "summary": "Autonomous security agents are getting good at finding bugs. Nobody has a good way to measure how good. Point one at a realistic target and what comes back is a report the agent wrote about itself: confident prose, a list of findings, and no way to tell which of them happened. Someone with a security background then sits down and checks every claim against the target. Which findings are real…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-33b7b548b2fc",
      "title": "Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests",
      "link": "https://thehackernews.com/2026/09/anthropic-and-openai-models-still.html",
      "date": "2026-09-23T11:47:13.000Z",
      "source": "The Hacker News",
      "summary": "Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior. Opus 5.5, per Anthropic, is a \"major step up from Opus 5,\" and \"achieves the best scores of any model to date on our automated behavioral audit, our alignment suite that tests Claude across thousands…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-5cd3f2ce9ae8",
      "title": "Microsoft: September Windows updates break Always On VPN connections",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-windows-updates-break-always-on-vpn-connections/",
      "date": "2026-09-23T11:18:13.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-a94e39978082",
      "title": "Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape",
      "link": "https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html",
      "date": "2026-09-23T11:12:18.000Z",
      "source": "The Hacker News",
      "summary": "A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22. The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases. DepthFirst…",
      "firstSeen": "2026-09-23T16:31:25.729Z"
    },
    {
      "id": "reporting-54af9eeed99c",
      "title": "F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers",
      "link": "https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html",
      "date": "2026-09-23T08:29:48.000Z",
      "source": "The Hacker News",
      "summary": "Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.",
      "firstSeen": "2026-09-23T11:10:11.469Z"
    },
    {
      "id": "reporting-47e5a40f39f4",
      "title": "Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware",
      "link": "https://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.html",
      "date": "2026-09-23T08:29:24.000Z",
      "source": "The Hacker News",
      "summary": "A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break…",
      "firstSeen": "2026-09-23T11:10:11.469Z"
    },
    {
      "id": "reporting-a1294697a945",
      "title": "Ryuk ransomware member sentenced to 24 months in prison",
      "link": "https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-sentenced-to-24-months-in-prison/",
      "date": "2026-09-23T08:20:05.000Z",
      "source": "Bleeping Computer",
      "summary": "An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks…",
      "firstSeen": "2026-09-23T11:10:11.469Z"
    },
    {
      "id": "reporting-e1f16ad60edb",
      "title": "F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks",
      "link": "https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/",
      "date": "2026-09-23T07:17:23.000Z",
      "source": "Bleeping Computer",
      "summary": "F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks…",
      "firstSeen": "2026-09-23T11:10:11.469Z"
    },
    {
      "id": "reporting-cda8fee27801",
      "title": "Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input",
      "link": "https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html",
      "date": "2026-09-23T07:04:40.000Z",
      "source": "The Hacker News",
      "summary": "A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version…",
      "firstSeen": "2026-09-23T11:10:11.469Z"
    },
    {
      "id": "reporting-c2b107c39a2f",
      "title": "ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants",
      "link": "https://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.html",
      "date": "2026-09-23T05:30:09.000Z",
      "source": "The Hacker News",
      "summary": "The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency. \"We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job,\" the group said in a statement posted on their dark…",
      "firstSeen": "2026-09-23T11:10:11.469Z"
    },
    {
      "id": "reporting-907c082edb08",
      "title": "Rogue external MFA providers can steal passwords during logins",
      "link": "https://www.bleepingcomputer.com/news/security/rogue-external-mfa-providers-can-steal-passwords-during-logins/",
      "date": "2026-09-22T21:45:45.000Z",
      "source": "Bleeping Computer",
      "summary": "Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts…",
      "firstSeen": "2026-09-23T04:09:53.865Z"
    },
    {
      "id": "reporting-9a8c2d680adb",
      "title": "Sweden fines Miljödata $183,000 over breach affecting 2.2 million",
      "link": "https://www.bleepingcomputer.com/news/security/sweden-fines-milj-data-183-000-over-breach-affecting-22-million/",
      "date": "2026-09-22T21:40:37.000Z",
      "source": "Bleeping Computer",
      "summary": "Sweden's data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2.2 million people…",
      "firstSeen": "2026-09-23T04:09:53.865Z"
    }
  ]
}