{
  "schema_version": 2,
  "issue_date": "2026-10-01",
  "generated_at": "2026-10-01T21:22:15.612Z",
  "insight_context": {
    "schema_version": 2,
    "mode": "current",
    "checked_at": "2026-10-01T21:22:13.881Z",
    "report_date": "2026-10-01",
    "manifest_generated_at": "2026-10-01T18:31:14Z",
    "report_url": "https://ricomanifesto.github.io/SentryInsight/"
  },
  "articles": [
    {
      "id": "reporting-b2099d009ed0",
      "title": "Autonomous AI agents tried to hack US, Canadian government websites",
      "link": "https://www.bleepingcomputer.com/news/security/autonomous-ai-agents-tried-to-hack-us-canadian-government-websites/",
      "date": "2026-10-01T20:52:50.000Z",
      "source": "Bleeping Computer",
      "summary": "Autonomous AI agents using aggressive strategies attempted to hack U.S. and Canadian government websites to find school and divorce statistics…",
      "firstSeen": "2026-10-01T21:22:14.208Z"
    },
    {
      "id": "reporting-8b472bb05c2f",
      "title": "Microsoft says threat actors are ahead in the early AI race",
      "link": "https://www.bleepingcomputer.com/news/security/microsoft-says-threat-actors-are-ahead-in-the-early-ai-race/",
      "date": "2026-10-01T19:32:47.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace…",
      "firstSeen": "2026-10-01T21:22:14.208Z"
    },
    {
      "id": "reporting-1ba8da53d09e",
      "title": "Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers",
      "link": "https://thehackernews.com/2026/10/police-arrest-16-year-old-suspected-of.html",
      "date": "2026-10-01T16:55:57.000Z",
      "source": "The Hacker News",
      "summary": "Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site. Investigators identified him as KillSec's suspected…",
      "firstSeen": "2026-10-01T18:26:58.711Z"
    },
    {
      "id": "reporting-ab51ae9f2bbe",
      "title": "ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories",
      "link": "https://thehackernews.com/2026/10/threatsday-ai-powered-zero-day-chain.html",
      "date": "2026-10-01T16:45:38.000Z",
      "source": "The Hacker News",
      "summary": "This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the lesson running through the list. Attackers do not always need a brilliant new trick. They can…",
      "firstSeen": "2026-10-01T18:26:58.711Z"
    },
    {
      "id": "reporting-dcd4b62c704a",
      "title": "WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory",
      "link": "https://thehackernews.com/2026/10/wordpress-backdoor-rebuilds-itself.html",
      "date": "2026-10-01T14:37:35.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the \"SC_\" markers present in the injected content. Sucuri has described the malware as a \"self-healing mesh\" that's…",
      "firstSeen": "2026-10-01T15:28:42.475Z"
    },
    {
      "id": "reporting-624e1a7a0804",
      "title": "Police dismantle KillSec ransomware gang allegedly led by 16-year-old",
      "link": "https://www.bleepingcomputer.com/news/security/police-dismantle-killsec-ransomware-gang-allegedly-led-by-16-year-old/",
      "date": "2026-10-01T14:25:14.000Z",
      "source": "Bleeping Computer",
      "summary": "An international law enforcement operation dubbed \"Operation KillSwitch\" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator…",
      "firstSeen": "2026-10-01T15:28:42.475Z"
    },
    {
      "id": "reporting-929134258e6a",
      "title": "The Day-One Hole in Zero Trust Architecture",
      "link": "https://www.bleepingcomputer.com/news/security/the-day-one-hole-in-zero-trust-architecture/",
      "date": "2026-10-01T14:01:11.000Z",
      "source": "Bleeping Computer",
      "summary": "Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued…",
      "firstSeen": "2026-10-01T15:28:42.475Z"
    },
    {
      "id": "reporting-3e59dcb3b502",
      "title": "Kiteworks patches max severity code injection vulnerability",
      "link": "https://www.bleepingcomputer.com/news/security/kiteworks-patches-max-severity-email-protection-gateway-code-injection-vulnerability/",
      "date": "2026-10-01T13:51:08.000Z",
      "source": "Bleeping Computer",
      "summary": "Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution…",
      "firstSeen": "2026-10-01T15:28:42.475Z"
    },
    {
      "id": "reporting-cb1c29fbd6b4",
      "title": "Warlock Ransomware Hits Large Spanish, Portuguese Orgs",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/warlock-ransomware-spanish-portuguese",
      "date": "2026-10-01T13:00:00.000Z",
      "source": "Dark Reading",
      "summary": "A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places.",
      "firstSeen": "2026-10-01T15:28:42.475Z"
    },
    {
      "id": "reporting-1866931397ea",
      "title": "How Financial Services Companies Can Modernize Their Software Supply Chain",
      "link": "https://thehackernews.com/2026/10/how-financial-services-companies-can.html",
      "date": "2026-10-01T11:45:00.000Z",
      "source": "The Hacker News",
      "summary": "Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else raises the change-freeze calendar. The finding gets an exception, a compensating control, and a date…",
      "firstSeen": "2026-10-01T12:27:46.835Z"
    },
    {
      "id": "reporting-52279358df2a",
      "title": "Microsoft enables Windows settings backup by default for orgs",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-enables-windows-settings-backup-by-default-for-orgs/",
      "date": "2026-10-01T11:14:28.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2…",
      "firstSeen": "2026-10-01T12:27:46.835Z"
    },
    {
      "id": "reporting-33c11d72966e",
      "title": "OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates",
      "link": "https://thehackernews.com/2026/10/openai-disrupts-reasoning-extraction.html",
      "date": "2026-10-01T10:42:36.000Z",
      "source": "The Hacker News",
      "summary": "OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. A \"core cluster of the activity,\" going back to the first week of July, has been attributed to individuals associated with Moonshot AI, a Chinese AI company based in Beijing. It did not cite any…",
      "firstSeen": "2026-10-01T12:27:46.835Z"
    },
    {
      "id": "reporting-346b23ad75b1",
      "title": "CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV",
      "link": "https://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html",
      "date": "2026-10-01T10:33:16.000Z",
      "source": "The Hacker News",
      "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with…",
      "firstSeen": "2026-10-01T12:27:46.835Z"
    },
    {
      "id": "reporting-4f07180fa121",
      "title": "Hackers stole Pentagon personnel records of over 3 million people",
      "link": "https://www.bleepingcomputer.com/news/security/hackers-breach-pentagon-human-resources-management-system-steal-data-of-nearly-3-million-people/",
      "date": "2026-10-01T09:44:28.000Z",
      "source": "Bleeping Computer",
      "summary": "The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025…",
      "firstSeen": "2026-10-01T12:27:46.835Z"
    },
    {
      "id": "reporting-0a705b1644e1",
      "title": "Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version",
      "link": "https://thehackernews.com/2026/10/google-rolls-out-gemini-4-argon-to.html",
      "date": "2026-10-01T07:49:36.000Z",
      "source": "The Hacker News",
      "summary": "Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon, that it said is being rolled out to a set of trusted cyber defenders through its Fairwind Program. \"It delivers frontier performance in complex workflows across real-world software engineering, enterprise knowledge work like legal and finance, and cybersecurity defense,\" Koray Kavukcuoglu…",
      "firstSeen": "2026-10-01T09:21:06.385Z"
    },
    {
      "id": "reporting-a3f893b99aeb",
      "title": "Metamask discloses security incident affecting its infrastructure",
      "link": "https://www.bleepingcomputer.com/news/security/metamask-discloses-security-incident-affecting-its-infrastructure/",
      "date": "2026-10-01T07:33:57.000Z",
      "source": "Bleeping Computer",
      "summary": "On Thursday, cryptocurrency wallet provider MetaMask has disclosed an ongoing infrastructure security incident affecting some of its infrastructure…",
      "firstSeen": "2026-10-01T09:21:06.385Z"
    },
    {
      "id": "reporting-43ea94fc4334",
      "title": "Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path",
      "link": "https://thehackernews.com/2026/10/apple-coregraphics-poc-emerges-as.html",
      "date": "2026-10-01T05:54:41.000Z",
      "source": "The Hacker News",
      "summary": "Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working…",
      "firstSeen": "2026-10-01T09:21:06.385Z"
    },
    {
      "id": "reporting-b4409a570832",
      "title": "Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft",
      "link": "https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html",
      "date": "2026-10-01T05:21:10.000Z",
      "source": "The Hacker News",
      "summary": "Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. \"Their investigation identified malicious activity involving third-party security products, including a zero-day vulnerability, and recovered a customized tool used by the attacker…",
      "firstSeen": "2026-10-01T06:31:49.073Z"
    },
    {
      "id": "reporting-65e6681dca63",
      "title": "MetaMask Security Incident Prompts Exit of Affected Ethereum Validators",
      "link": "https://thehackernews.com/2026/10/metamask-security-incident-prompts-exit.html",
      "date": "2026-10-01T05:10:09.000Z",
      "source": "The Hacker News",
      "summary": "MetaMask on Thursday said it's responding to what it described as an \"ongoing security incident\" impacting part of its infrastructure. \"We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors,\" the software cryptocurrency wallet maker said. \"At this time, we have identified no immediate threat to MetaMask wallets.\" MetaMask…",
      "firstSeen": "2026-10-01T06:31:49.073Z"
    },
    {
      "id": "reporting-87574535fedc",
      "title": "Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs",
      "link": "https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html",
      "date": "2026-10-01T04:35:34.000Z",
      "source": "The Hacker News",
      "summary": "Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler…",
      "firstSeen": "2026-10-01T06:31:49.073Z"
    },
    {
      "id": "reporting-298d890b9a3c",
      "title": "Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/malicious-custom-gpts-chatgpt-rat-delivery-lure",
      "date": "2026-09-30T21:25:47.000Z",
      "source": "Dark Reading",
      "summary": "In yet another ClickFix-style campaign, threat actors abuse legitimate domains from OpenAI and Google to fool unsuspecting users.",
      "firstSeen": "2026-10-01T00:56:28.786Z"
    },
    {
      "id": "reporting-cb10f964c9d0",
      "title": "Trump, Tech Giants Strike Voluntary AI Safety Accord",
      "link": "https://www.darkreading.com/cyber-risk/trump-tech-giants-strike-voluntary-ai-safety-accord",
      "date": "2026-09-30T20:51:15.000Z",
      "source": "Dark Reading",
      "summary": "The new White House Accord on so-called \"Super Intelligence\" calls on companies to implement greater controls and oversight over AI safety.",
      "firstSeen": "2026-10-01T00:56:28.786Z"
    },
    {
      "id": "reporting-2d28f457acee",
      "title": "Russian state hackers use new RedFlick technique to push malware",
      "link": "https://www.bleepingcomputer.com/news/security/russian-state-hackers-use-new-redflick-technique-to-push-malware/",
      "date": "2026-09-30T20:34:01.000Z",
      "source": "Bleeping Computer",
      "summary": "The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed \"RedFlick\" to deploy its signature CosmicPulse backdoor…",
      "firstSeen": "2026-09-30T21:16:23.308Z"
    },
    {
      "id": "reporting-3776ad1cae04",
      "title": "DIVD says Zammad zero-days enabled AI-driven network breach",
      "link": "https://www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/",
      "date": "2026-09-30T19:49:15.000Z",
      "source": "Bleeping Computer",
      "summary": "The Dutch Institute for Vulnerability Disclosure (DIVD) says that the breach of its network was possible by exploiting a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system…",
      "firstSeen": "2026-09-30T21:16:23.308Z"
    },
    {
      "id": "reporting-2cf02acd767a",
      "title": "As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half",
      "link": "https://www.darkreading.com/cybersecurity-careers/ai-reshapes-soc-career-ladder",
      "date": "2026-09-30T18:56:56.000Z",
      "source": "Dark Reading",
      "summary": "New Swimlane research underscores a paradox: While AI detection and response is essential to giving defenders an edge, one in four security pros say AI limits their skill development.",
      "firstSeen": "2026-09-30T21:16:23.308Z"
    },
    {
      "id": "reporting-2ebaae643cd3",
      "title": "Over 543,000 valid credentials exposed in public GitHub repositories",
      "link": "https://www.bleepingcomputer.com/news/security/over-543-000-valid-credentials-exposed-in-public-github-repositories/",
      "date": "2026-09-30T18:08:34.000Z",
      "source": "Bleeping Computer",
      "summary": "More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platform's security measures to prevent accidental leaks of sensitive data…",
      "firstSeen": "2026-09-30T18:21:31.251Z"
    },
    {
      "id": "reporting-fe95a2c38caf",
      "title": "Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets",
      "link": "https://thehackernews.com/2026/09/attackers-exploit-zimbra-flaw-to-deploy.html",
      "date": "2026-09-30T16:46:29.000Z",
      "source": "The Hacker News",
      "summary": "Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol…",
      "firstSeen": "2026-09-30T18:21:31.251Z"
    },
    {
      "id": "reporting-cb2af8d2a0d2",
      "title": "Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks",
      "link": "https://thehackernews.com/2026/09/attackers-abuse-msp360-to-deploy.html",
      "date": "2026-09-30T16:32:59.000Z",
      "source": "The Hacker News",
      "summary": "Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. \"Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected…",
      "firstSeen": "2026-09-30T18:21:31.251Z"
    },
    {
      "id": "reporting-37d3b9649bea",
      "title": "CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS",
      "link": "https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-pre-auth-rce-flaw-in-mikrotik-routeros/",
      "date": "2026-09-30T15:49:29.000Z",
      "source": "Bleeping Computer",
      "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition…",
      "firstSeen": "2026-09-30T18:21:31.251Z"
    },
    {
      "id": "reporting-9475c717ac1e",
      "title": "Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager",
      "link": "https://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html",
      "date": "2026-09-30T15:24:54.000Z",
      "source": "The Hacker News",
      "summary": "Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a…",
      "firstSeen": "2026-09-30T18:21:31.251Z"
    },
    {
      "id": "reporting-ec979f717a94",
      "title": "Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net",
      "link": "https://www.darkreading.com/threat-intelligence/russia-star-blizzard-apt-ditches-clickfix-widen-phishing-net",
      "date": "2026-09-30T15:02:25.000Z",
      "source": "Dark Reading",
      "summary": "The APT actor is using a new tactic, dubbed \"RedFlick,\" against Ukrainian-linked targets such as NGOs, think tanks, and journalists to deploy its CosmicPulse backdoor.",
      "firstSeen": "2026-09-30T15:22:00.238Z"
    },
    {
      "id": "reporting-72dbeeb1790c",
      "title": "Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures",
      "link": "https://thehackernews.com/2026/09/attackers-abuse-chatgpt-custom-gpts-to.html",
      "date": "2026-09-30T15:00:15.000Z",
      "source": "The Hacker News",
      "summary": "Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another feature in trusted artificial intelligence (AI) platforms. Prior campaigns have weaponized shared…",
      "firstSeen": "2026-09-30T18:21:31.251Z"
    },
    {
      "id": "reporting-8f1d5c9abb63",
      "title": "Cisco warns of new SD-WAN zero-day exploited in attacks",
      "link": "https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/",
      "date": "2026-09-30T14:46:40.000Z",
      "source": "Bleeping Computer",
      "summary": "Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges…",
      "firstSeen": "2026-09-30T15:22:00.238Z"
    },
    {
      "id": "reporting-ad0d1f3062bd",
      "title": "AI's Third Wave: Coworkers Break the Security Model That Worked for Agents",
      "link": "https://www.bleepingcomputer.com/news/security/ais-third-wave-coworkers-break-the-security-model-that-worked-for-agents/",
      "date": "2026-09-30T14:01:11.000Z",
      "source": "Bleeping Computer",
      "summary": "Persistent AI coworkers may operate continuously with standing access, creating identity risks that existing security models were not designed to handle. Token Security explains why these agents need their own identities, owners, scoped permissions, and lifecycle controls…",
      "firstSeen": "2026-09-30T15:22:00.238Z"
    },
    {
      "id": "reporting-29c0329f5a87",
      "title": "Microsoft to block Entra ID script injection attacks starting October",
      "link": "https://www.bleepingcomputer.com/news/security/microsoft-to-block-entra-id-script-injection-attacks-starting-october/",
      "date": "2026-09-30T13:37:15.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month…",
      "firstSeen": "2026-09-30T15:22:00.238Z"
    },
    {
      "id": "reporting-8889e814016c",
      "title": "TeamViewer urges users to patch severe flaws “as soon as possible”",
      "link": "https://www.bleepingcomputer.com/news/security/teamviewer-urges-users-to-patch-severe-flaws-as-soon-as-possible/",
      "date": "2026-09-30T12:25:10.000Z",
      "source": "Bleeping Computer",
      "summary": "Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software…",
      "firstSeen": "2026-09-30T12:30:38.513Z"
    },
    {
      "id": "reporting-239ba2260483",
      "title": "Know Your Enemy: Browser-Based Attack Techniques in 2026",
      "link": "https://thehackernews.com/2026/09/know-your-enemy-browser-based-attack.html",
      "date": "2026-09-30T11:58:00.000Z",
      "source": "The Hacker News",
      "summary": "Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltration playing out in the browser. Here are the six most dangerous techniques that should be on every security team's radar in 2026. 1.",
      "firstSeen": "2026-09-30T15:22:00.238Z"
    },
    {
      "id": "reporting-d36b3ecb6626",
      "title": "AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub",
      "link": "https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html",
      "date": "2026-09-30T11:30:00.000Z",
      "source": "The Hacker News",
      "summary": "AI coding agents asked to share screenshots of code changes for review have put internal company images in public GitHub repositories, security company Glow said. Its researchers found more than 13,000 internal images from developers at over 300 organizations, including customer billing records and screens of features not yet released. In most cases, they sat under developers' personal accounts…",
      "firstSeen": "2026-09-30T12:30:38.513Z"
    },
    {
      "id": "reporting-52ffe63dd45a",
      "title": "Bitget hacked via zero-day in third-party security products",
      "link": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
      "date": "2026-09-30T11:11:46.000Z",
      "source": "Bleeping Computer",
      "summary": "Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products…",
      "firstSeen": "2026-09-30T12:30:38.513Z"
    },
    {
      "id": "reporting-4e63cd870861",
      "title": "US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access",
      "link": "https://thehackernews.com/2026/09/us-focused-csuite-phishing-steals.html",
      "date": "2026-09-30T10:45:00.000Z",
      "source": "The Hacker News",
      "summary": "ANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions coming from the United States. Technology, manufacturing, government, and consulting organizations showed the highest exposure. By combining Microsoft 365 session theft with remote-access tool deployment, CSuite can turn a phishing incident into broader account compromise, fraud…",
      "firstSeen": "2026-09-30T12:30:38.513Z"
    },
    {
      "id": "reporting-7595f834fb9c",
      "title": "Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT",
      "link": "https://thehackernews.com/2026/09/attackers-exploit-netscaler-flaw-for.html",
      "date": "2026-09-30T08:24:35.000Z",
      "source": "The Hacker News",
      "summary": "Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe. The activity, observed by Mandiant Consulting and Google Threat Intelligence Group (GTIG) in September 2026, has targeted government, financial services, technology, education, and legal and professional…",
      "firstSeen": "2026-09-30T12:30:38.513Z"
    },
    {
      "id": "reporting-1b25f217f425",
      "title": "OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted",
      "link": "https://thehackernews.com/2026/09/openssl-fixes-high-severity-dtls-flaw.html",
      "date": "2026-09-30T08:09:28.000Z",
      "source": "The Hacker News",
      "summary": "A High-severity OpenSSL flaw can leak heap memory to the other side of a DTLS connection or crash the program, OpenSSL said on September 29 as it released fixes. DTLS, the TLS variant used for UDP traffic, resends a handshake message if no reply arrives before the timer expires. The leak or crash can happen when such a resend starts while a larger handshake message is stuck part-way…",
      "firstSeen": "2026-09-30T12:30:38.513Z"
    },
    {
      "id": "reporting-22d143dd8ff5",
      "title": "South Africa Seeks Help After Cyberattack Targets Air Traffic Control",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/south-africa-help-cyberattack-air-traffic-control",
      "date": "2026-09-30T07:00:00.000Z",
      "source": "Dark Reading",
      "summary": "As aviation infrastructure suffers more cyberattacks, air traffic systems are the latest target, with a ransomware toolkit installed on at least one operational network.",
      "firstSeen": "2026-09-30T09:18:59.843Z"
    },
    {
      "id": "reporting-a2c9b41769a0",
      "title": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution",
      "link": "https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html",
      "date": "2026-09-30T05:30:30.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that's rooted in the NetScaler…",
      "firstSeen": "2026-09-30T09:18:59.843Z"
    },
    {
      "id": "reporting-3b6b222f8b8e",
      "title": "Microsoft is rolling out Linux container support to WSL",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-is-rolling-out-linux-container-support-to-wsl/",
      "date": "2026-09-30T00:40:57.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft is taking Windows Subsystem for Linux beyond just running Linux distributions, as WSL Containers is now generally available…",
      "firstSeen": "2026-09-30T00:50:00.312Z"
    },
    {
      "id": "reporting-d49e0531691d",
      "title": "Apple Zero-Day Vulnerability Weaponized in Targeted Attacks",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/apple-zero-day-vulnerability-weaponized-targeted-attacks",
      "date": "2026-09-29T21:31:29.000Z",
      "source": "Dark Reading",
      "summary": "Attackers are exploiting CVE-2026-86950, an out-of-bounds write flaw, in an extremely sophisticated fashion, according to Apple.",
      "firstSeen": "2026-09-30T00:50:00.312Z"
    },
    {
      "id": "reporting-1e9b704f29a5",
      "title": "Signal adds encypted local backup support to iOS, desktop apps",
      "link": "https://www.bleepingcomputer.com/news/security/signal-adds-encypted-local-backup-support-to-ios-desktop-apps/",
      "date": "2026-09-29T21:30:08.000Z",
      "source": "Bleeping Computer",
      "summary": "Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows)…",
      "firstSeen": "2026-09-30T00:50:00.312Z"
    },
    {
      "id": "reporting-b9ebd84c7b27",
      "title": "Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution",
      "link": "https://www.darkreading.com/application-security/unsloth-studio-flaw-model-inspection-code-execution",
      "date": "2026-09-29T21:08:42.000Z",
      "source": "Dark Reading",
      "summary": "A patched Unsloth Studio vulnerability allows malicious AI models to execute arbitrary Python code during inspection, via the trust_remote_code setting.",
      "firstSeen": "2026-09-29T21:16:19.742Z"
    },
    {
      "id": "reporting-aafd86b072fb",
      "title": "Custom ChatGPTs push ClickFix attacks to deploy RAT malware",
      "link": "https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/",
      "date": "2026-09-29T20:59:39.000Z",
      "source": "Bleeping Computer",
      "summary": "Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware…",
      "firstSeen": "2026-09-29T21:16:19.742Z"
    },
    {
      "id": "reporting-156dd54c407b",
      "title": "FBI tells ShinyHunters members to turn themselves in after recent arrest",
      "link": "https://www.bleepingcomputer.com/news/security/fbi-tells-shinyhunters-members-to-turn-themselves-in-after-recent-arrest/",
      "date": "2026-09-29T20:09:55.000Z",
      "source": "Bleeping Computer",
      "summary": "The FBI is warning members of the ShinyHunters extortion group to turn themselves in after Dutch police arrested a man the bureau described as one of the group's alleged leaders…",
      "firstSeen": "2026-09-29T21:16:19.742Z"
    }
  ]
}