{
  "schema_version": 2,
  "issue_date": "2026-10-24",
  "generated_at": "2026-10-24T21:14:26.229Z",
  "insight_context": {
    "schema_version": 2,
    "mode": "stale",
    "checked_at": "2026-10-24T21:14:25.010Z",
    "report_date": "2026-10-06",
    "manifest_generated_at": "2026-10-06T00:51:11Z",
    "report_url": "https://ricomanifesto.github.io/SentryInsight/"
  },
  "articles": [
    {
      "id": "reporting-ed9fe79f62b5",
      "title": "BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot",
      "link": "https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/",
      "date": "2026-10-24T14:17:32.000Z",
      "source": "Bleeping Computer",
      "summary": "A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast…",
      "firstSeen": "2026-10-24T15:13:21.255Z"
    },
    {
      "id": "reporting-a64123d82829",
      "title": "Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software",
      "link": "https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html",
      "date": "2026-10-24T11:09:29.000Z",
      "source": "The Hacker News",
      "summary": "A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially…",
      "firstSeen": "2026-10-24T12:20:41.220Z"
    },
    {
      "id": "reporting-c2f353f11fca",
      "title": "Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline",
      "link": "https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html",
      "date": "2026-10-24T11:03:33.000Z",
      "source": "The Hacker News",
      "summary": "LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. \"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of…",
      "firstSeen": "2026-10-24T12:20:41.220Z"
    },
    {
      "id": "reporting-ed6cb319ad85",
      "title": "Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads",
      "link": "https://thehackernews.com/2026/10/google-says-gmail-and-photos-data.html",
      "date": "2026-10-24T10:36:33.000Z",
      "source": "The Hacker News",
      "summary": "Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. \"You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use…",
      "firstSeen": "2026-10-24T12:20:41.220Z"
    },
    {
      "id": "reporting-ae5fe3ec49b3",
      "title": "Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet",
      "link": "https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html",
      "date": "2026-10-24T09:04:24.000Z",
      "source": "The Hacker News",
      "summary": "Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was…",
      "firstSeen": "2026-10-24T12:20:41.220Z"
    },
    {
      "id": "reporting-ad7396463092",
      "title": "CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud",
      "link": "https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html",
      "date": "2026-10-24T06:25:57.000Z",
      "source": "The Hacker News",
      "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating…",
      "firstSeen": "2026-10-24T09:15:18.751Z"
    },
    {
      "id": "reporting-ba4956958d93",
      "title": "Trust Is Not What It Seems — And Fraudsters Are Counting on It",
      "link": "https://www.darkreading.com/cyber-risk/trust-is-not-what-it-seems-and-fraudsters-are-counting-on-it",
      "date": "2026-10-23T20:57:56.000Z",
      "source": "Dark Reading",
      "summary": "Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.",
      "firstSeen": "2026-10-23T21:18:43.986Z"
    },
    {
      "id": "reporting-a5d4387518b8",
      "title": "Abandoned Popcorn Time app exposed millions of devices to RCE attacks",
      "link": "https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/",
      "date": "2026-10-23T20:55:05.000Z",
      "source": "Bleeping Computer",
      "summary": "Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers…",
      "firstSeen": "2026-10-23T21:18:43.986Z"
    },
    {
      "id": "reporting-f32271df15f1",
      "title": "Exposed to PHP2Shell? Cyber Experts Weigh in With Advice",
      "link": "https://www.darkreading.com/application-security/exposed-php2shell-cyber-experts-advice",
      "date": "2026-10-23T19:41:23.000Z",
      "source": "Dark Reading",
      "summary": "Fixing the critical PHP flaws is not as simple as clicking \"Update.\" Here's how to assess your risk, and what you can do to protect yourself.",
      "firstSeen": "2026-10-23T21:18:43.986Z"
    },
    {
      "id": "reporting-e3ceabcd0c4b",
      "title": "Microsoft Teams to get AI-powered, context-aware phishing detection",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/",
      "date": "2026-10-23T18:54:41.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026…",
      "firstSeen": "2026-10-23T21:18:43.986Z"
    },
    {
      "id": "reporting-68f2c8a7a2b6",
      "title": "BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations",
      "link": "https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html",
      "date": "2026-10-23T18:50:13.000Z",
      "source": "The Hacker News",
      "summary": "Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report…",
      "firstSeen": "2026-10-23T21:18:43.986Z"
    },
    {
      "id": "reporting-14b4c9cf953f",
      "title": "Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws",
      "link": "https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html",
      "date": "2026-10-23T17:54:08.000Z",
      "source": "The Hacker News",
      "summary": "Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any…",
      "firstSeen": "2026-10-23T18:30:29.370Z"
    },
    {
      "id": "reporting-6fb95eceef2a",
      "title": "Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions",
      "link": "https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html",
      "date": "2026-10-23T17:50:47.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an \"Autonomous Red Team Kill Chain Framework\" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an…",
      "firstSeen": "2026-10-23T18:30:29.370Z"
    },
    {
      "id": "reporting-2355d4d8f657",
      "title": "AI Tools Are Generating Massive Attacks for Little Cost",
      "link": "https://www.darkreading.com/cybersecurity-operations/ai-tools-massive-attacks-little-cost",
      "date": "2026-10-23T17:26:59.000Z",
      "source": "Dark Reading",
      "summary": "One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.",
      "firstSeen": "2026-10-23T18:30:29.370Z"
    },
    {
      "id": "reporting-0d09c5ddef1b",
      "title": "Microsoft: Windows Server 2016 reaches end of support in January",
      "link": "https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2016-reaches-end-of-support-in-january/",
      "date": "2026-10-23T17:05:07.000Z",
      "source": "Bleeping Computer",
      "summary": "Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027…",
      "firstSeen": "2026-10-23T18:30:29.370Z"
    },
    {
      "id": "reporting-5d9f1f66a499",
      "title": "Quest Diagnostics confirms data breach exposed patient records",
      "link": "https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/",
      "date": "2026-10-23T16:40:07.000Z",
      "source": "Bleeping Computer",
      "summary": "American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system…",
      "firstSeen": "2026-10-23T18:30:29.370Z"
    },
    {
      "id": "reporting-d32d82b9d677",
      "title": "PHP shares mitigation for new RCE vulnerability with no patch",
      "link": "https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/",
      "date": "2026-10-23T15:38:05.000Z",
      "source": "Bleeping Computer",
      "summary": "The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch…",
      "firstSeen": "2026-10-23T18:30:29.370Z"
    },
    {
      "id": "reporting-92749712f915",
      "title": "You gave your AI agent access, but who is giving it orders?",
      "link": "https://www.bleepingcomputer.com/news/security/you-gave-your-ai-agent-access-but-who-is-giving-it-orders/",
      "date": "2026-10-23T14:00:10.000Z",
      "source": "Bleeping Computer",
      "summary": "AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub helps protect agents through skill verification, secure connectivity, and runtime controls that intercept dangerous act…",
      "firstSeen": "2026-10-23T15:15:47.210Z"
    },
    {
      "id": "reporting-11a81d41fc58",
      "title": "Why Caribbean Threats Cascade Into Global Cyber-Risk",
      "link": "https://www.darkreading.com/cyber-risk/why-caribbean-threats-cascade-global-cyber-risk",
      "date": "2026-10-23T14:00:00.000Z",
      "source": "Dark Reading",
      "summary": "The region is demonstrating what happens when exploits accelerate but assurance does not.",
      "firstSeen": "2026-10-23T15:15:47.210Z"
    },
    {
      "id": "reporting-64b0ac9d140d",
      "title": "Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials",
      "link": "https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html",
      "date": "2026-10-23T13:50:56.000Z",
      "source": "The Hacker News",
      "summary": "Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims…",
      "firstSeen": "2026-10-23T15:15:47.210Z"
    },
    {
      "id": "reporting-55d5c18d6220",
      "title": "Cyber Insurance's New Reality: Underwriting Isn't Enough",
      "link": "https://www.darkreading.com/cyber-risk/cyber-insurances-underwriting-isnt-enough",
      "date": "2026-10-23T13:30:00.000Z",
      "source": "Dark Reading",
      "summary": "Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.",
      "firstSeen": "2026-10-23T15:15:47.210Z"
    },
    {
      "id": "reporting-690940732ff7",
      "title": "HPE patches eight max severity RCE and auth bypass AOS flaws",
      "link": "https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/",
      "date": "2026-10-23T12:48:00.000Z",
      "source": "Bleeping Computer",
      "summary": "Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues…",
      "firstSeen": "2026-10-23T15:15:47.210Z"
    },
    {
      "id": "reporting-3729c69a11df",
      "title": "AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack",
      "link": "https://www.darkreading.com/cybersecurity-operations/ai-agents-insider-threats-inside-microsoft-unified-security-stack",
      "date": "2026-10-23T11:38:28.000Z",
      "source": "Dark Reading",
      "summary": "Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may compound — not contain — the risk.",
      "firstSeen": "2026-10-23T12:35:19.433Z"
    },
    {
      "id": "reporting-d3e6fb1a3911",
      "title": "PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches",
      "link": "https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html",
      "date": "2026-10-23T11:25:43.000Z",
      "source": "The Hacker News",
      "summary": "PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called…",
      "firstSeen": "2026-10-23T12:35:19.433Z"
    },
    {
      "id": "reporting-76da60089176",
      "title": "Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack",
      "link": "https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html",
      "date": "2026-10-23T11:11:23.000Z",
      "source": "The Hacker News",
      "summary": "The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of…",
      "firstSeen": "2026-10-23T12:35:19.433Z"
    },
    {
      "id": "reporting-e21e419ebac5",
      "title": "Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image",
      "link": "https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html",
      "date": "2026-10-23T09:36:00.000Z",
      "source": "The Hacker News",
      "summary": "Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.",
      "firstSeen": "2026-10-23T12:35:19.433Z"
    },
    {
      "id": "reporting-5119cb5ec018",
      "title": "Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data",
      "link": "https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html",
      "date": "2026-10-23T08:40:43.000Z",
      "source": "The Hacker News",
      "summary": "Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their \"Node2Shell\" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw…",
      "firstSeen": "2026-10-23T09:17:35.755Z"
    },
    {
      "id": "reporting-43513002b0c3",
      "title": "Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances",
      "link": "https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html",
      "date": "2026-10-23T08:35:45.000Z",
      "source": "The Hacker News",
      "summary": "AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set…",
      "firstSeen": "2026-10-23T12:35:19.433Z"
    },
    {
      "id": "reporting-9d0cfa945b25",
      "title": "PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware",
      "link": "https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html",
      "date": "2026-10-23T07:40:45.000Z",
      "source": "The Hacker News",
      "summary": "Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote…",
      "firstSeen": "2026-10-23T09:17:35.755Z"
    },
    {
      "id": "reporting-b9a055634559",
      "title": "State Bank of India Suffers a Customer PII Data Leak",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/state-bank-india-customer-pii-data-leak",
      "date": "2026-10-23T03:30:00.000Z",
      "source": "Dark Reading",
      "summary": "Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII.",
      "firstSeen": "2026-10-23T06:37:00.312Z"
    },
    {
      "id": "reporting-ea40ccd76acf",
      "title": "Railway warns devs to rotate secrets after potential breach",
      "link": "https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/",
      "date": "2026-10-22T21:25:31.000Z",
      "source": "Bleeping Computer",
      "summary": "Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week…",
      "firstSeen": "2026-10-23T00:50:15.745Z"
    },
    {
      "id": "reporting-c8b85a504961",
      "title": "Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack",
      "link": "https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack",
      "date": "2026-10-22T20:42:17.000Z",
      "source": "Dark Reading",
      "summary": "The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.",
      "firstSeen": "2026-10-23T00:50:15.745Z"
    },
    {
      "id": "reporting-714df2670eae",
      "title": "What We Missed: Feds Lasso Texas Laptop Farms",
      "link": "https://www.darkreading.com/insider-threats/texas-laptop-farms-north-korean-it-workers",
      "date": "2026-10-22T20:33:10.000Z",
      "source": "Dark Reading",
      "summary": "In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in \"Operation Lonestar Justice\" to Staples' gift card bonanza.",
      "firstSeen": "2026-10-22T21:15:13.044Z"
    },
    {
      "id": "reporting-1e6095c6e828",
      "title": "Capcom confirms data breach affecting 11.7 million accounts",
      "link": "https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/",
      "date": "2026-10-22T20:22:45.000Z",
      "source": "Bleeping Computer",
      "summary": "Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information…",
      "firstSeen": "2026-10-22T21:15:13.044Z"
    },
    {
      "id": "reporting-507bd11e2057",
      "title": "Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour",
      "link": "https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware-french",
      "date": "2026-10-22T19:30:20.000Z",
      "source": "Dark Reading",
      "summary": "Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.",
      "firstSeen": "2026-10-22T21:15:13.044Z"
    },
    {
      "id": "reporting-37f56369e2ff",
      "title": "LiteLLM release pipeline hacked to distribute info-stealer malware",
      "link": "https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/",
      "date": "2026-10-22T19:12:51.000Z",
      "source": "Bleeping Computer",
      "summary": "Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables…",
      "firstSeen": "2026-10-22T21:15:13.044Z"
    }
  ]
}