[
 {
  "url": "https://cyberpresso.com/statistics/cybersecurity-statistics",
  "title": "Cybersecurity Statistics 2026",
  "type": "statistics",
  "updated": "2026-08-25",
  "summary": "Cybersecurity statistics 2026 from live Dupple data: 30,573 cyber stories clustered, 2,577 breach, ransomware and CVE items, and 651 security tools benchmarked."
 },
 {
  "url": "https://cyberpresso.com/reviews/1password-review",
  "title": "1Password Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "An honest 2026 review of 1Password: real pricing from $2.99/mo, its Secret Key security model, admin tooling, weaknesses, and the best alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-ai-for-penetration-testing",
  "title": "The Best AI for Penetration Testing in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Pentera, NodeZero, XBOW, Terra Security, RunSybil, SafeBreach, and AttackIQ compared on real capability, pricing, and where each still needs a human."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-ai-for-phishing-detection",
  "title": "The 8 Best AI for Phishing Detection in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "8 AI phishing detection tools for SOC and email teams, compared honestly: real weaknesses, pricing (mostly quote-only), and how to pick one."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-ai-for-threat-detection",
  "title": "The 8 Best AI for Threat Detection in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Darktrace, Vectra, CrowdStrike, SentinelOne, Microsoft Defender, Exabeam, Securonix, and Anvilogic compared on real pricing and honest gaps."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-ai-for-vulnerability-management",
  "title": "The Best AI for Vulnerability Management in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Wiz, Snyk, Tenable, Qualys, Rapid7, Orca, Aikido, and Nucleus compared on real pricing, reachability, and where each tool still misses."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-ai-security-tools",
  "title": "The 9 Best AI Security Tools in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "CrowdStrike Charlotte AI, Microsoft Security Copilot, SentinelOne Purple AI, Darktrace, and Vectra AI compared on real 2026 pricing and SOC fit."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-antivirus-for-mac",
  "title": "The Best Antivirus for Mac in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Bitdefender, Norton, Malwarebytes and six more Mac antivirus apps compared on independent lab scores and September 2026 US pricing, with Apple's free XProtect as the baseline."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-cloud-security-posture-tools",
  "title": "The Best Cloud Security Posture Tools in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The CSPM and cloud security platforms worth running in 2026, compared on how they scan, how they prioritise, and what they cost when the quote finally arrives."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-data-loss-prevention-software",
  "title": "The Best Data Loss Prevention Software in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The DLP products worth running in 2026, compared on the only published Microsoft list prices versus quote-only Forcepoint, Symantec, Nightfall and Cyberhaven seats."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-edr-endpoint-protection",
  "title": "The Best EDR & Endpoint Protection in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The endpoint detection and response platforms that stop modern ransomware in 2026, compared on detection, agent weight, and real per-seat cost."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-encrypted-cloud-storage",
  "title": "The Best Encrypted Cloud Storage in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Eight zero-knowledge storage services a security-minded buyer can actually price today, with US dollar rates read on each vendor's own pricing page in September 2026."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-free-vpns",
  "title": "The Best Free VPNs in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Which free VPN plan is actually safe to run in 2026, with the data cap, device limit and paid upgrade price read from each vendor's own site."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-incident-response-platforms",
  "title": "The Best Incident Response Platforms in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The incident response and AI triage platforms worth running in 2026, compared on what they actually automate and what they cost per investigation."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-mdm-software",
  "title": "The Best MDM Software in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The MDM platforms IT teams actually deploy in 2026: Jamf, Iru (formerly Kandji), Intune, NinjaOne and Hexnode compared on platform coverage, zero-touch enrolment and compliance reporting."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-password-managers",
  "title": "Best Password Managers of 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "1Password wins for most teams, Proton Pass for privacy and value, Passpack for MSPs. An honest 2026 buyers guide for security and IT pros."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-password-managers-for-families",
  "title": "The Best Password Managers for Families in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Family password managers compared on seats, sharing and what happens when a parent or a teenager loses access, with prices checked on each vendor's own pricing page this month."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-security-awareness-training",
  "title": "The Best Security Awareness Training in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The security awareness training platforms that actually change employee behavior in 2026, ranked on phishing sims, content, and reporting."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-soc2-compliance-automation",
  "title": "The Best SOC 2 Compliance Automation Tools in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The SOC 2 automation platforms compared on what they actually automate, what the auditor still costs you separately, and why three of the four will not tell you the price."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-vulnerability-scanners",
  "title": "The Best Vulnerability Scanners in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The vulnerability scanners security teams trust in 2026, ranked on accuracy, false positives, risk prioritization, and real per-asset cost."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-zero-trust-platforms",
  "title": "The Best Zero Trust Platforms in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "The zero trust network access platforms worth deploying in 2026, compared on how they authenticate, what they log, and what they actually cost per user."
 },
 {
  "url": "https://cyberpresso.com/reviews/bitdefender-review",
  "title": "Bitdefender Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Honest Bitdefender GravityZone review for security teams: single-agent EPP plus EDR and XDR, real per-endpoint pricing, verified AV-TEST and MITRE ATT&CK results, and 5 direct alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/bitwarden-review",
  "title": "Bitwarden Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Bitwarden review 2026: a free unlimited vault, what Premium and the business seats cost, where self-hosting stops, and five priced alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/crowdstrike-alternatives",
  "title": "The Best CrowdStrike Alternatives in 2026",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Eight CrowdStrike Falcon alternatives for 2026, priced in USD on each vendor's own page, for teams leaving Falcon over cost, module sprawl, or the 2024 sensor outage."
 },
 {
  "url": "https://cyberpresso.com/reviews/crowdstrike-review",
  "title": "CrowdStrike Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Honest CrowdStrike Falcon review for security teams: real Falcon Go, Pro, and Enterprise per-device pricing, single-agent EDR and XDR strengths, the cost and complexity trade-offs, and 5 direct alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/expressvpn-review",
  "title": "ExpressVPN Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "ExpressVPN review 2026: Basic's entry rate on the US checkout we verified holds for 28 months, then renews annually, with no monthly-pay option."
 },
 {
  "url": "https://cyberpresso.com/reviews/malwarebytes-review",
  "title": "Malwarebytes Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Malwarebytes review 2026: ThreatDown device prices, where EDR and MDR start, the consumer Teams trap, and four priced alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/microsoft-defender-for-business-review",
  "title": "Microsoft Defender for Business Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Defender for Business in 2026 is a user-priced endpoint license for a Microsoft tenant of 300 or fewer, and servers, Plan 2, and four alternatives decide if that price holds."
 },
 {
  "url": "https://cyberpresso.com/reviews/nordlayer-review",
  "title": "NordLayer Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "An honest NordLayer review for 2026: published per-user pricing, what each tier really includes, where it sits against Check Point SASE (formerly Perimeter 81) and Tailscale, and its limits."
 },
 {
  "url": "https://cyberpresso.com/reviews/nordpass-review",
  "title": "NordPass Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "NordPass review 2026: real pricing on the current promo, the single-device free plan limit, XChaCha20 encryption, and how it compares with 1Password, Bitwarden, Proton Pass and Dashlane."
 },
 {
  "url": "https://cyberpresso.com/reviews/norton-review",
  "title": "Norton Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Norton review 2026: what Small Business costs a company, where the renewal list disagrees with the card, and why Norton 360 is not a company license."
 },
 {
  "url": "https://cyberpresso.com/reviews/proton-pass-review",
  "title": "Proton Pass Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Honest Proton Pass review: an open-source, end-to-end encrypted password manager from Switzerland, with built-in 2FA, SimpleLogin aliases, and passkeys. Real pricing, honest cons, and five alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/proton-vpn-review",
  "title": "Proton VPN Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Proton VPN review 2026: the free plan has no time limit and no device-two option, and the Plus yearly intro rate rises by more than half on renewal, both checked on the vendor's USD pricing page."
 },
 {
  "url": "https://cyberpresso.com/reviews/sentinelone-review",
  "title": "SentinelOne Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "SentinelOne in 2026 is worth Complete or Commercial, because the Core rate buys endpoint protection and detection history starts on Complete. A partner can still change the printed rate, so treat the page as a comparison rather than a purchase order."
 },
 {
  "url": "https://cyberpresso.com/reviews/surfshark-review",
  "title": "Surfshark Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "An honest 2026 review of Surfshark: real 2-year and monthly pricing, its Deloitte no-logs audits, unlimited simultaneous devices, weaknesses, and the best alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/tenable-review",
  "title": "Tenable Review",
  "type": "review",
  "updated": "2026-09-25",
  "summary": "Honest Tenable review for security teams: Nessus Professional at $4,790 a year, Tenable Vulnerability Management from $3,500 a year, real strengths in CVE coverage and VPR prioritization, real limits, and 5 alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/dashlane-review",
  "title": "Dashlane Review",
  "type": "review",
  "updated": "2026-09-24",
  "summary": "Dashlane review 2026: Omnix vault and detection prices, the US App Store personal year, what SSO leaves out, and five priced alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/keeper-review",
  "title": "Keeper Review",
  "type": "review",
  "updated": "2026-09-24",
  "summary": "Keeper review 2026: what Starter, Business, and Enterprise cost in USD, what SSO and BreachWatch add, and five priced alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/lastpass-review",
  "title": "LastPass Review",
  "type": "review",
  "updated": "2026-09-24",
  "summary": "LastPass review 2026: Premium, Teams, and Business prices, who the 50-user cap rules out, what the 2022 vault copy included, and five priced alternatives."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-dark-web-monitoring-tools",
  "title": "The Best Dark Web Monitoring Tools in 2026",
  "type": "review",
  "updated": "2026-09-01",
  "summary": "The dark-web and credential-monitoring tools security buyers actually compare in 2026, ranked on published prices versus quote-only contracts, and on whether the product resets an account or only sends an email."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-api-security-tools",
  "title": "The Best API Security Tools in 2026",
  "type": "review",
  "updated": "2026-08-26",
  "summary": "The API security tools worth using in 2026, compared on request metering, desktop licenses and what the free scanners still catch."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-secrets-management-tools",
  "title": "The Best Secrets Management Tools in 2026",
  "type": "review",
  "updated": "2026-08-26",
  "summary": "Secrets managers compared on billing unit. Doppler prices per user, Infisical per identity, and machine identities usually outnumber people. Published pricing read August 2026."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-network-security-monitoring-tools",
  "title": "The Best Network Security Monitoring Tools in 2026",
  "type": "review",
  "updated": "2026-08-10",
  "summary": "The network security monitoring tools teams actually deploy in 2026: visibility, alerting and anomaly detection compared, from open source to enterprise."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-2fa-authenticator-apps",
  "title": "The Best 2FA Authenticator Apps in 2026",
  "type": "review",
  "updated": "2026-07-09",
  "summary": "The authenticator apps worth trusting with your logins in 2026, compared on backups, multi-device sync, and how much they lock you in."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-email-security-tools",
  "title": "The Best Email Security Tools in 2026",
  "type": "review",
  "updated": "2026-07-09",
  "summary": "The email security platforms security teams run in 2026, ranked on phishing and BEC detection, deployment model, and real per-user cost."
 },
 {
  "url": "https://cyberpresso.com/reviews/best-siem-tools",
  "title": "The Best SIEM Tools in 2026",
  "type": "review",
  "updated": "2026-07-09",
  "summary": "The SIEM platforms security teams actually run in 2026, ranked on detection quality, integrations, and whether the ingestion pricing quietly bankrupts you."
 },
 {
  "url": "https://cyberpresso.com/blog/best-cybersecurity-newsletters",
  "title": "Best Cybersecurity Newsletters in 2026: 10 Picks Compared",
  "type": "blog",
  "updated": "2026-09-25",
  "summary": "The best cybersecurity newsletters in 2026, compared by cadence, price and audience: Risky Bulletin, SANS NewsBites, tl;dr sec and 7 more, all free but one."
 },
 {
  "url": "https://cyberpresso.com/blog/ai-for-incident-response",
  "title": "AI for Incident Response in 2026: Real Use Cases and Limits",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "AI for incident response in 2026, walked through a real alert-to-containment timeline: where AI actually helps a SOC, the tools that do it, and the hard limits."
 },
 {
  "url": "https://cyberpresso.com/blog/ai-for-soc",
  "title": "AI for the SOC in 2026: What AI SOC Analysts Actually Do",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "What AI for the SOC actually means in 2026: how AI SOC analysts handle alert triage, enrichment and tier-1 automation, the tools to know, and the limits."
 },
 {
  "url": "https://cyberpresso.com/blog/chatgpt-for-cybersecurity",
  "title": "ChatGPT for Cybersecurity in 2026: 9 Prompts That Survive Contact With a SOC",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "Nine ChatGPT prompts for SOC analysts: reading logs and obfuscated scripts, drafting Sigma and YARA rules, IOC regex, ATT&CK mapping, and the three ways it gets security wrong."
 },
 {
  "url": "https://cyberpresso.com/blog/generative-ai-in-cybersecurity",
  "title": "Generative AI in Cybersecurity: Real Use Cases and Risks (2026)",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "How security teams actually use generative AI: real defensive use cases, how attackers abuse it, the risks in your own stack, and safe adoption."
 },
 {
  "url": "https://cyberpresso.com/blog/how-much-does-a-siem-cost",
  "title": "How Much Does a SIEM Cost? Real 2026 Pricing Models Explained",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "SIEM pricing explained: the four billing models, what drives the bill, why quotes vary tenfold, and how to estimate your cost before talking to sales."
 },
 {
  "url": "https://cyberpresso.com/blog/how-to-prevent-phishing-attacks",
  "title": "How to Prevent Phishing Attacks: Controls That Work When Training Fails",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "How to prevent phishing attacks in 2026: the technical controls that stop credential theft even when someone clicks, why awareness training is not enough, and what to do in the first hour."
 },
 {
  "url": "https://cyberpresso.com/blog/top-ai-cybersecurity-companies",
  "title": "13 Top AI Cybersecurity Companies in 2026 (What Their AI Actually Does)",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "The top AI cybersecurity companies in 2026, from CrowdStrike and Microsoft to agentic SOC startups. What each vendor's AI actually does, and where it's hype."
 },
 {
  "url": "https://cyberpresso.com/blog/what-is-prompt-injection",
  "title": "What Is Prompt Injection? The 2026 Guide (Attacks + Defenses)",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "Prompt injection is the top LLM security risk. Learn how direct and indirect attacks work, why it is hard to fix, and how to defend your AI agents."
 },
 {
  "url": "https://cyberpresso.com/blog/will-cybersecurity-be-replaced-by-ai",
  "title": "Will Cybersecurity Be Replaced by AI? The Attacker Has the Same Tools",
  "type": "blog",
  "updated": "2026-09-21",
  "summary": "Security is the one job where the same technology is pointed at you by the attacker. What AI already runs in the SOC, what it keeps failing at, and where the headcount goes."
 },
 {
  "url": "https://cyberpresso.com/blog/ai-for-cybersecurity",
  "title": "AI for Cybersecurity in 2026: What Works in a SOC and What Does Not",
  "type": "blog",
  "updated": "2026-07-17",
  "summary": "Where AI earns a place in a security stack in 2026: alert triage, threat detection, phishing, vulnerability management and pentesting, with the trade-offs named."
 },
 {
  "url": "https://cyberpresso.com/blog/cisa-teamcity-ransomware-rce",
  "title": "CISA Says Ransomware Gangs Are Now Exploiting Critical TeamCity Flaw in CI/CD Pipelines",
  "type": "news",
  "updated": "2026-09-25",
  "summary": "Ransomware gangs are now abusing CVE-2026-63077, a critical unauthenticated RCE in JetBrains TeamCity On-Premises patched in July. Fixed versions are 2025.11.7 and 2026.1.3."
 },
 {
  "url": "https://cyberpresso.com/blog/roundcube-sqli-preauth-exploited",
  "title": "Attackers Are Exploiting a Pre-Auth Roundcube SQL Injection Across Half a Million Mail Servers",
  "type": "news",
  "updated": "2026-09-25",
  "summary": "Attackers are exploiting CVE-2026-48842, a pre-auth SQL injection in Roundcube patched in May, while more than 500,000 Roundcube servers sit exposed on the internet."
 },
 {
  "url": "https://cyberpresso.com/blog/ai-agents-retail-600k-stolen-cards",
  "title": "AI Agents Hit 100 Online Stores for Cheap and Walked Off With 600,000 Stolen Credit Cards",
  "type": "news",
  "updated": "2026-09-24",
  "summary": "A Chinese-speaking attacker used rented AI agents to hit up to 100 online stores and steal more than 600,000 credit card records for about $8,000 total, roughly $25 per target, according to Gambit Security."
 },
 {
  "url": "https://cyberpresso.com/blog/albanese-openai-agent-medicare-hack",
  "title": "Australia's PM Says an OpenAI Agent Hacked Medicare and Told Altman He's Extremely Concerned",
  "type": "news",
  "updated": "2026-09-24",
  "summary": "Anthony Albanese says an OpenAI agent accessed a Medicare statistics portal without authorisation in June and wrote files to an internal server. OpenAI told Australia three months later, via a public mailbox."
 },
 {
  "url": "https://cyberpresso.com/blog/arista-velocloud-cvss10-zero-day",
  "title": "Arista Warns Admins to Patch a CVSS 10 VeloCloud Zero-Day Already Used Against Orchestrators",
  "type": "news",
  "updated": "2026-09-24",
  "summary": "Arista shipped fixes for CVE-2026-93952, a CVSS 10.0 zero-day in on-premises VeloCloud Orchestrator that is already being exploited. Only certificate-based setups are exposed, and the 6.1 and 7.0 trains have no fix yet."
 },
 {
  "url": "https://cyberpresso.com/blog/closedquorum-multi-llm-windows-malware",
  "title": "New Windows Malware Skips Command Servers and Lets Four AI Models Vote on What to Steal",
  "type": "news",
  "updated": "2026-09-24",
  "summary": "Cisco Talos documented CLOSEDQUORUM, a Windows implant that polls DeepSeek, Qwen, Mistral, and Gemini to vote on its next move instead of calling home to a C2 server. On a tie it favors DeepSeek, then Qwen, then Mistral, then Gemini."
 },
 {
  "url": "https://cyberpresso.com/blog/f5-big-ip-apm-oauth-zero-day-rce",
  "title": "F5 Patched a Critical BIG-IP Flaw Attackers Were Already Using for Login-Free Code Runs",
  "type": "news",
  "updated": "2026-09-23",
  "summary": "F5 shipped emergency hotfixes for a critical BIG-IP APM zero-day already exploited for unauthenticated remote code execution. It hits only setups where APM runs as an OAuth authorization server. CISA gave federal agencies until September 25."
 },
 {
  "url": "https://cyberpresso.com/blog/japan-waterplum-laptop-farm-30k",
  "title": "Japan Shut a North Korean Laptop Farm as Allies Say WaterPlum Hit 30,000 Devices for Pyongyang",
  "type": "news",
  "updated": "2026-09-23",
  "summary": "Japan dismantled its first North Korean laptop farm as the US, Australia, and Germany detailed WaterPlum, a fake-hiring campaign that infected at least 30,000 devices and sent about $10.71 million to Pyongyang."
 },
 {
  "url": "https://cyberpresso.com/blog/wordpress-click2shell-admin-click-rce",
  "title": "WordPress Patched Click2Shell After One Admin Click Could Quietly Hand Attackers the Site",
  "type": "news",
  "updated": "2026-09-23",
  "summary": "WordPress 7.1.1 patched Click2Shell, a theme-preview flaw that could reach remote code execution after a logged-in admin opened one crafted URL. It had no CVE at disclosure and earned a $300 bounty."
 },
 {
  "url": "https://cyberpresso.com/blog/zai-zcode-silent-workspace-exfil",
  "title": "Z.ai Killed ZCode Features After Devs Caught Silent Uploads of Local Workspaces to the Cloud",
  "type": "news",
  "updated": "2026-09-23",
  "summary": "Developers found Z.ai's ZCode coding assistant silently packaging local files and uploading them to Alibaba Cloud with no off switch. One dev logged 564 attempts on a 313MB archive before Z.ai apologized and pulled the feature."
 },
 {
  "url": "https://cyberpresso.com/blog/colorado-water-utilities-ot-hack",
  "title": "Hackers Hit Two Colorado Water Plants, Tweaked OT Settings, and Disabled Critical Alarms",
  "type": "news",
  "updated": "2026-09-22",
  "summary": "Colorado officials say attackers reached the control systems at two private water utilities in late August, changing equipment settings, disabling alarms, and altering pumping cycles at plants serving fewer than 200 people combined."
 },
 {
  "url": "https://cyberpresso.com/blog/crowdsec-tanstack-170-private-repos-stolen",
  "title": "CrowdSec Lost 170 Private Repos After Hackers Reused a Token From the TanStack npm Attack",
  "type": "news",
  "updated": "2026-09-22",
  "summary": "CrowdSec says attackers copied about 170 private GitHub repositories on 22 May 2026 using a former employee's OAuth token stolen in the TanStack npm attack. The leaked dump also exposed 83 user emails and 51 investors."
 },
 {
  "url": "https://cyberpresso.com/blog/meta-muse-zero-day-dictation-hijack",
  "title": "Meta Hyped Muse's Security. A Zero-Day Let Attackers Hijack Dictation and Take the Agent",
  "type": "news",
  "updated": "2026-09-22",
  "summary": "A zero-day in Meta's Muse macOS assistant let any local app redirect its dictation endpoint and steal the auth token, handing attackers the whole account. Meta shipped a hotfix about 12 hours after disclosure."
 },
 {
  "url": "https://cyberpresso.com/blog/openai-codex-sandbox-heapjack-escape",
  "title": "OpenAI's Codex Sandbox Let Attackers Run Commands on Your Machine Just by Opening a Repo",
  "type": "news",
  "updated": "2026-09-22",
  "summary": "Researchers found two escapes in OpenAI's Codex sandbox. The worse one, Heapjack, turned opening someone's repository into unsandboxed command execution. OpenAI fixed both within eight days."
 },
 {
  "url": "https://cyberpresso.com/blog/aesto-health-breach-9-5-million",
  "title": "Aesto Health breach hits 9.5 million patient records",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Aesto Health told HHS that 9,540,683 people are in a breach that ran 2 to 18 December 2025 on a slice of AWS. Stolen fields include SSNs, driver's licenses, medical and insurance data. HIPAA Journal counted 29 provider clients. No public threat-group claim as of 1 September."
 },
 {
  "url": "https://cyberpresso.com/blog/anthropic-fourth-claude-cyber-incident",
  "title": "Anthropic discloses fourth Claude cyber eval breakout",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Anthropic's 9 September research post adds a fourth incident, a January 2026 early Claude Opus 4.6 checkpoint, after a scan of about 141,000 transcripts missed a batch. A widened search of about 481 million transcripts, with Claude reviewing 9.2 million flagged, found no fifth case of similar severity."
 },
 {
  "url": "https://cyberpresso.com/blog/anthropic-sept-2026-threat-report",
  "title": "Anthropic says AI let lone actors run state-level hacks",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Anthropic's September 2026 threat-intelligence report covers Claude misuse it says it disrupted from December 2025 to August 2026 across seven harm areas. Haiku, Sonnet, and Opus were used. Fable and Mythos-class models were absent except one illicit distillation case. IOCs are downloadable from the report page."
 },
 {
  "url": "https://cyberpresso.com/blog/azure-data-theft-fortune-500",
  "title": "A seller is offering Azure data tied to Fortune 500 names, and two of them dispute it",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A threat actor called TheHatman is advertising data linked to major companies' Azure tenants. Hudson Rock points to compromised credentials rather than an Azure flaw, the totals all come from the seller, and Tata Consultancy Services and Gap say the data looks old."
 },
 {
  "url": "https://cyberpresso.com/blog/berlin-rhysida-data-publish",
  "title": "Berlin confirms second Rhysida data dump overnight",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A 6 September 2026 Land Berlin press release says attackers published a further data package overnight, including access credentials. The Senate department for urban development, building and housing tightened controls that may briefly disrupt specialist procedures. Berlin has not published a full inventory of either dump."
 },
 {
  "url": "https://cyberpresso.com/blog/bragjack-browser-ai-extension-hijack",
  "title": "One Ordinary Extension Hijacked Chrome, Edge, and Claude AI Before Anyone Clicked a Thing",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Forever Security's BragJack research, reported 16 September 2026, shows one Chromium extension can hijack built-in AI in Chrome, Edge, Comet, Opera Neon, and Claude. Chrome CVE-2026-0628 is CVSS 8.8, fixed in 143.0.7499.192. Edge CVE-2026-55945 is 4.2, fixed in 150.0.4078.48."
 },
 {
  "url": "https://cyberpresso.com/blog/brevo-clickfix-supply-chain-100k",
  "title": "Attackers Hijacked Brevo Widgets and Hit 100,000 Sites Before Anyone Noticed the Supply Chain",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Brevo's 14 September 2026 post-mortem says a compromised Cloudflare API key injected ClickFix scripts from 15:01 to 20:30 UTC. Sansec estimates more than 100,000 sites. WordPress admins faced silent plugin-install attempts."
 },
 {
  "url": "https://cyberpresso.com/blog/chatgpt-sandbox-cross-account-leak",
  "title": "ChatGPT sandbox flaw leaked Gmail across accounts",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Check Point Research on 8 September 2026 described a covert cross-account channel in ChatGPT code-execution containers that used JFrog Artifactory item properties as a shared clipboard. A lab demo retrieved Gmail through a connected app while answering a cooking question. OpenAI confirmed the implicated Artifactory instance was decommissioned."
 },
 {
  "url": "https://cyberpresso.com/blog/checkpoint-mgmt-root-cve-2026-91843",
  "title": "Check Point Says Every Security Management Server Is Open to Unauthenticated Root Attacks",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A stack overflow in Check Point's unauthenticated login path can give an attacker root on every on-prem Security Management Server. The fix is LivePatch Take 29 on R82.20 and Take 28 on older branches. Smart-1 Cloud is not affected."
 },
 {
  "url": "https://cyberpresso.com/blog/checkpoint-puzzlemask-plain-prose",
  "title": "Check Point shows plain prose can bypass AI safety filters",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Check Point Research's 10 September 2026 PuzzleMask blog says crafted plain-English wrappers marked safe in 100% of gatekeeper trials on a 23-prompt set, and gpt-5-thinking-high recovered and acted on the payload in 17 of 18 trials (about 94.4%). Anthropic Opus-class models blocked it."
 },
 {
  "url": "https://cyberpresso.com/blog/checkpoint-vpn-cert-flaws-9-8",
  "title": "Check Point patches two critical VPN certificate flaws",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Check Point SecureKnowledge sk1000117 and sk1000118 (last modified 9 September 2026) cover CVE-2026-85102 and CVE-2026-85103, both CVSS 9.8. Fixes include LivePatch Take 24 and Jumbo Hotfix R82.10 Take 44, R82 Take 126, and R81.20 Take 166. R82.20 is not affected."
 },
 {
  "url": "https://cyberpresso.com/blog/chrome-v8-cve-2026-85046-exploited",
  "title": "Google patches Chrome V8 flaw already exploited in the wild",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Chrome Stable 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux, patches CVE-2026-85046, a High V8 type confusion Google says is already exploited in the wild. Salvatore Gulizia (Serotav) reported it on 4 August 2026. Chrome Releases lists a $1,000 reward. The update has 12 security fixes. Google named no targets or actors."
 },
 {
  "url": "https://cyberpresso.com/blog/cisa-aa26-231a-siemens-s7-ai-exploits",
  "title": "Five US agencies warn of AI-built exploits probing Siemens S7 PLCs: advisory AA26-231A",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "NSA, CISA, FBI, DOE and EPA issued AA26-231A on active targeting of Siemens S7 PLCs over S7comm on TCP port 102, using snap7 tooling and AI-generated Python scripts. No victim count, no named group. The one control to check today is whether port 102 is internet-reachable."
 },
 {
  "url": "https://cyberpresso.com/blog/cisa-kev-gitea-cve-2026-60004",
  "title": "CISA adds Gitea CVE-2026-60004 to KEV, federal deadline August 28",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CISA added one self-hosted Gitea flaw, CVE-2026-60004 (CWE-94 code injection, CVSS 9.8), to its Known Exploited Vulnerabilities catalog on August 25, with a federal remediation deadline of August 28 under BOD 26-04. It was fixed in Gitea 1.27.1 back on July 28 (latest is 1.27.2), it needs repository write access rather than being unauthenticated by design, and CISA lists no threat actor and ransomware use as Unknown. The cryptominer-in-Docker story traces to a single Habr incident report, not to CISA."
 },
 {
  "url": "https://cyberpresso.com/blog/cisa-kev-netscaler-sql-six",
  "title": "CISA adds NetScaler and SQL Server flaws to KEV",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CISA added six CVEs to its KEV catalog on Aug 26, 2026, led by Citrix NetScaler CVE-2026-8452 and a 2019 SQL Server RCE, both due for federal agencies by Aug 29. CISA keeps the NetScaler bug labeled denial-of-service even as watchTowr reports RCE as root."
 },
 {
  "url": "https://cyberpresso.com/blog/cisa-kev-owncloud-linux-artifactory",
  "title": "CISA adds ownCloud, Linux IPv6 and Artifactory to KEV",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CISA added three actively exploited flaws to its Known Exploited Vulnerabilities catalog on August 27: an ownCloud improper-authentication bug (CVE-2023-49105), a Linux kernel IPv6 local privilege-escalation bug (CVE-2026-53362), and a JFrog Artifactory path-traversal bug (CVE-2026-66384). The first two carry an August 30 federal deadline and a forensic-triage flag; Artifactory runs to September 10."
 },
 {
  "url": "https://cyberpresso.com/blog/cisa-kev-sharepoint-vcenter-macos-ike",
  "title": "CISA gave federal agencies three days to patch four exploited flaws",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CISA added four actively exploited CVEs to the KEV catalog on 18 August 2026 with a federal due date of 21 August, a three-day window against the usual three weeks. Microsoft IKE, SharePoint, VMware vCenter and Apple macOS Screen Sharing. All four already have patches."
 },
 {
  "url": "https://cyberpresso.com/blog/cisa-kev-trueconf-phantomcore",
  "title": "CISA added two exploited TrueConf Server flaws to KEV, due August 23 and September 3 for federal agencies, but the Head Mare and PhantomCore attribution is Kaspersky's, not CISA's",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CISA added CVE-2026-72529 (CVSS 9.8, unauthenticated) and CVE-2026-72530 (CVSS 9.0, sandbox escape) in self-hosted TrueConf Server to its Known Exploited Vulnerabilities catalog on August 20, with federal deadlines of August 23 and September 3. TrueConf fixed both in June (builds 5.3.9 / 5.4.9 / 5.5.5). CISA names no actor; Kaspersky ties the chain to Head Mare and the PhantomCore backdoor."
 },
 {
  "url": "https://cyberpresso.com/blog/cisa-ray-ai-framework-rce-kev",
  "title": "CISA orders a three-day patch after a Ray AI flaw comes under active attack",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CISA added CVE-2025-62593, a remote-code-execution flaw in the Ray AI framework, to its Known Exploited Vulnerabilities catalog and gave federal agencies until August 20 to patch. The bug hits Ray versions before 2.52.0 through the dashboard and API."
 },
 {
  "url": "https://cyberpresso.com/blog/cisco-ise-login-bypass-active-exploit",
  "title": "Hackers Are Already Walking Past Login on Cisco Identity Services Engine Across Networks",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5, first published 16 September 2026 at 16:00 GMT, rates CVE-2026-76460 (CWE-648) CVSS 10.0. Unauthenticated requests can bypass ISE web management. Cisco says exploitation is active. CISA added it to KEV."
 },
 {
  "url": "https://cyberpresso.com/blog/cisco-nexus-9000-silicon-one-root-rce",
  "title": "Cisco patches critical Nexus 9000 switch flaw that gives attackers root",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Cisco's PSIRT advisory cisco-sa-n9k-s1-rce-EH8dEtr covers CVE-2026-20212, a CVSS 9.8 flaw in the Silicon One integration on Nexus 9000 switches. Software updates are available, it is not in CISA's KEV catalog, and the blast radius is ten product IDs rather than the whole Nexus 9000 line."
 },
 {
  "url": "https://cyberpresso.com/blog/cisco-secure-email-gateway-zero-day",
  "title": "Cisco Patches Secure Email Gateway Zero-Day Under Attack",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Cisco advisory cisco-sa-esa-inj-2bLVGmhX, first published 14 September 2026, covers CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway AsyncOS. Fixed builds are 15.5.5-014, 16.0.4-302, and 16.5.0-780. CISA KEV is due September 17."
 },
 {
  "url": "https://cyberpresso.com/blog/cisco-secure-fmc-auth-bypass-exploited",
  "title": "Cisco confirms Secure FMC flaw under active attack",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Cisco's 9 September 2026 advisory update (rev 2.5) says PSIRT saw active exploitation in August of CVE-2026-20079, a CVSS 10.0 Secure FMC auth bypass first published 4 March. CISA put it on KEV with a 12 September federal due date. Hot fixes cover FMC 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0."
 },
 {
  "url": "https://cyberpresso.com/blog/citrix-netscaler-cve-2026-19490",
  "title": "Citrix patches critical NetScaler auth bypass CVE-2026-19490, exploitation expected",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Citrix bulletin CTX696939 patches CVE-2026-19490, a CVSS 9.3 authentication bypass in customer-managed NetScaler ADC and Gateway. Fixed builds are 14.1-73.32 and 13.1-63.21. On 14.1-43.56+ and 13.1-61.28+ the bypass needs a SAML action. No confirmed in-the-wild exploitation yet."
 },
 {
  "url": "https://cyberpresso.com/blog/claude-code-auto-mode-prompt-injection",
  "title": "Claude Code Auto Mode broken by prompt injection",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Johann Rehberger (Embrace The Red) chained indirect prompt injection to reach code execution past the safety classifier that Claude Code's Auto Mode uses in place of human approval prompts. Small-sample success ran 60% to 80% across three variants. Anthropic points to a commissioned Trajectory Labs evaluation that logged 0.00% on a separate 72-scenario set that did not include this chain."
 },
 {
  "url": "https://cyberpresso.com/blog/cloudflare-1111-pq-dnssec",
  "title": "Cloudflare 1.1.1.1 adds post-quantum DNSSEC validation",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Cloudflare's 10 September 2026 engineering blog says 1.1.1.1 now validates ML-DSA-44 DNSSEC signatures. Each signature is 2,420 bytes, so answers may truncate on UDP and retry over TCP. When a parent DS advertises the algorithm, a conventional path alone fails."
 },
 {
  "url": "https://cyberpresso.com/blog/connectwise-screenconnect-file-transfer-flaw",
  "title": "ConnectWise flags ScreenConnect file transfer flaw",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "ConnectWise's 3 September 2026 ScreenConnect advisory covers a file transfer issue on cloud and on-prem, with no CVE yet and a fix promised within the week. Disable TransferFiles or TransferFilesInSession on every technician role. Shadowserver tracks nearly 6,000 internet-exposed instances."
 },
 {
  "url": "https://cyberpresso.com/blog/contagious-interview-macos-ottercookie",
  "title": "Contagious Interview shifts to fake Mac installers",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Jamf Threat Labs (Allen Golbig, 3 September 2026) found 14 unsigned macOS DMG and PKG samples impersonating apps such as The Unarchiver and Bartender. The chain stages OtterCookie after an Intel-only Node download and tracks later fetches with a short-lived HS256 JWT. Gatekeeper still blocks the files unless the quarantine flag is removed. This is a research blog, not an indictment."
 },
 {
  "url": "https://cyberpresso.com/blog/conti-lytvynenko-sentenced-4-years",
  "title": "Conti ransomware developer gets 4 years in US prison",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "The Justice Department on 10 September 2026 said Oleksii Lytvynenko, 44, was sentenced to four years for wire fraud conspiracy tied to Conti. Evidence showed he held stolen data from eight U.S. victims and four overseas, and coded a loader."
 },
 {
  "url": "https://cyberpresso.com/blog/crowdstrike-falconflank-privilege-escalation",
  "title": "CrowdStrike investigates Falcon privilege-escalation claim",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A researcher released FalconFlank, a proof of concept that claims local privilege escalation in CrowdStrike Falcon through the Microsoft Office malicious-macro remediation workflow. CrowdStrike is investigating and told customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting, saying Cloud Anti-malware for Microsoft Office Files remains the protective path. No public CVE or patch notice has been issued."
 },
 {
  "url": "https://cyberpresso.com/blog/dark-caracal-gocaracal-ethereum-c2",
  "title": "GoCaracal malware uses Ethereum as a C2 fallback",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Arctic Wolf Labs documents GoCaracal, a previously undocumented Go implant found in a June 2026 intrusion at a Venezuelan communications organization. When its primary command-and-control fails, the extended build reads a replacement C2 address from an Ethereum smart contract via eth_getStorageAt. Arctic Wolf ties it to Dark Caracal with medium confidence, from 249 related samples across January to July 2026. This is a research report on an on-chain dead-drop, not a CVE or a confirmed worldwide campaign."
 },
 {
  "url": "https://cyberpresso.com/blog/ddrop-attack-intel-tdx-amd-sev",
  "title": "DDRop Breaks Intel TDX and AMD SEV-SNP Defenses",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "An ACM CCS 2026 paper from KU Leuven, ETH Zurich, Durham University, and Google describes DDRop, a $159 DDR5 interposer that silently drops memory writes against Intel TDX and AMD SEV-SNP. Intel and AMD say physical access sits outside their published threat models."
 },
 {
  "url": "https://cyberpresso.com/blog/doj-fbi-qscan-qtrouter-seizure",
  "title": "DOJ and FBI seize China-linked QScan and QTRouter",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "The DOJ and FBI executed court-authorized domain seizures that rendered two PRC hacking platforms, QScan and QTRouter, inoperable. DOJ attributes them to the group QTFY at Nanjing Xinjiuwei, and names NASA, the Federal Reserve, DOE and the U.S. Senate among victims."
 },
 {
  "url": "https://cyberpresso.com/blog/exchange-cve-2026-62911-poc",
  "title": "Microsoft Exchange flaw gets a public exploit, about 22k servers exposed",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A public proof-of-concept for Microsoft Exchange CVE-2026-62911 is now on GitHub while Shadowserver counts 21,899 exposed, unpatched Exchange servers. Microsoft classifies the bug as a Critical Elevation of Privilege via authentication bypass by capture-replay, CVSS 8.0; the PoC author frames it as pre-auth RCE. Both framings are reported here."
 },
 {
  "url": "https://cyberpresso.com/blog/f5-big-ip-poisonedrefresh-memory-webshell",
  "title": "F5 BIG-IP malware plants fileless PHP shells in memory",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Attackers are exploiting CVE-2025-53521 on internet-facing F5 BIG-IP APM to drop a Linux rootkit and a fileless PHP webshell that lives in memory. The implant answers a magic POST to targeted .php3 webtop scripts with HTTP 201 and text/css. ShadowServer counted about 795 exposed endpoints still vulnerable."
 },
 {
  "url": "https://cyberpresso.com/blog/fire-ant-cisco-ios-xr-routers",
  "title": "Fire Ant moves from hypervisors onto Cisco routers",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Sygnia's incident-response report says the actor it tracks as Fire Ant expanded from hypervisors onto Cisco IOS XR routers, TACACS servers and Linux hosts, turning them into covert collection points. Sygnia assesses the tradecraft strongly overlaps China-nexus UNC3886, not a confirmed identity."
 },
 {
  "url": "https://cyberpresso.com/blog/gitlab-commits-api-file-read-flaw",
  "title": "GitLab patches max-severity commits API file-read flaw",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "GitLab's 10 September 2026 critical patch release (19.3.2, 19.2.6, 19.1.8) fixes CVE-2026-85706, a CVSS 10.0 path traversal in the repository commits API affecting CE and EE from 18.7. GitLab.com is already patched. Dedicated needs no action. Self-managed must upgrade."
 },
 {
  "url": "https://cyberpresso.com/blog/gitlab-critical-graphql-cve-2026-19478",
  "title": "GitLab ships an emergency fix for CVE-2026-19478: unauthenticated delete of public projects",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "GitLab's out-of-band release patches CVE-2026-19478, CVSS 9.4, which lets an unauthenticated user modify or delete public projects and user data via a GraphQL directive. Fixed in 18.11.11, 19.0.8, 19.1.6 and 19.2.4. Self-managed only. It is not a remote code execution bug."
 },
 {
  "url": "https://cyberpresso.com/blog/google-undercover-teampcp-canisterworm",
  "title": "Google Had an Undercover Analyst Inside TeamPCP as Hackers Breached a Thousand Companies",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A Mandiant persona sat in TeamPCP's roughly 12-person CanisterWorm chat from about March. Australian police later arrested two alleged principal participants. The AFP said the haul included more than 500,000 users' credentials."
 },
 {
  "url": "https://cyberpresso.com/blog/grindr-26m-uk-hiv-data-settlement",
  "title": "Grindr pays £26 million to settle UK HIV data claims",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Grindr Inc. Form 8-K (Item 8.01, filed 4 September 2026) discloses a UK High Court group-action settlement of £26 million, paid as £13 million by 31 December 2026 and £13 million by 31 March 2027 (about $17.6 million each). No admission of liability. The filing covers pre-2020 Kunlun-era practices."
 },
 {
  "url": "https://cyberpresso.com/blog/gyazo-breach-23m-users-490m-images",
  "title": "Gyazo's Breach Leaked 23 Million Accounts and 490 Million Image Links Anyone Can Open",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Attackers hit Gyazo's image-upload server and took about 23.62 million user records plus 490 million image metadata records, including IDs that rebuild public links. Credit cards were not exposed."
 },
 {
  "url": "https://cyberpresso.com/blog/hacktron-claude-openai-source-code-breach",
  "title": "Three Hackers Used Anthropic's Claude to Break Into OpenAI's Private Source Code for $6,500",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "OpenAI paid three Hacktron AI researchers $6,500 after they reached private source code with help from Anthropic's Claude. OpenAI said it addressed the vulnerabilities."
 },
 {
  "url": "https://cyberpresso.com/blog/hacktron-heif-heist-decoder-rce",
  "title": "Hacktron's AI Agents Found a Decoder Flaw That Opened Meta and OpenAI to Remote Code Execution",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Hacktron researchers found a memory-corruption flaw in libheif and libde265. Crafted HEIF, HEIC or AVIF files can yield remote code execution. Upstream libheif is patched."
 },
 {
  "url": "https://cyberpresso.com/blog/handala-crudeexclude-heavygram",
  "title": "Iran's Handala Group Blinds Defender Then Plants HEAVYGRAM, a Telegram-Controlled Backdoor",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Iran-linked Handala Hack is using a Delphi loader called CRUDEEXCLUDE to add Microsoft Defender exclusions, then planting HEAVYGRAM, a Telegram-controlled Windows backdoor."
 },
 {
  "url": "https://cyberpresso.com/blog/hbo-max-reddit-clickfix-malware",
  "title": "HBO Max Reddit Account Hijacked for ClickFix Malware",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "TechCrunch reports ClickFix lures ran through a compromised HBO Max Reddit account authorized to buy ads. Hudson Rock and ADAMnetworks say hundreds of fake ads pointed to an HBO Max-looking page that tells users to paste a command into Windows cmd or Mac Terminal."
 },
 {
  "url": "https://cyberpresso.com/blog/idscan-confirms-150m-licenses-breach",
  "title": "IDScan confirms breach of 150M-plus driver licenses",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "IDScan.net's September 4, 2026 website notice says an unauthorized party may have accessed customer cloud data after a September 1 tip. The company does not confirm a 153 million victim count. Free credit monitoring enrolls at 1-833-516-2980."
 },
 {
  "url": "https://cyberpresso.com/blog/iranian-chosen-brick-spyware",
  "title": "US, UK and Dutch Agencies Warn Iran's Chosen Brick Spyware Spies on Dissidents via Telegram",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A 15 September 2026 joint advisory from the UK NCSC, US FBI, and Netherlands AIVD says CHOSEN BRICK, also called HEAVYGRAM, has targeted dissidents, journalists, and activists since at least 2025. All observed infections are Windows PCs."
 },
 {
  "url": "https://cyberpresso.com/blog/jfrog-artifactory-auth-bypass-exploited",
  "title": "JFrog Artifactory auth bypass under active exploit, patch now",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "JFrog patched a critical Artifactory authentication bypass, CVE-2026-82329 (CWE-287), that can hand an unauthenticated network attacker admin access under default settings. Fixed self-hosted builds are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20; JFrog Cloud is already fortified. Researchers and trade press report active exploitation."
 },
 {
  "url": "https://cyberpresso.com/blog/kestra-auth-bypass-rce-cve-2026-49869",
  "title": "Kestra auth bypass lets attackers run root workflows",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Kestra advisory GHSA-5vc5-wxxq-3fjx assigns CVE-2026-49869, a CVSS 10.0 auth bypass via a /configs suffix match. CISA added it to KEV on 2 September 2026 with a 5 September BOD 26-04 due date and forensic triage required. Patch to 1.0.45 or 1.3.21."
 },
 {
  "url": "https://cyberpresso.com/blog/linux-kernel-four-lpe-public-root-exploits",
  "title": "Public Root Exploits Drop for Four Decade-Old Bugs Buried in the Linux Kernel Network Stack",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Researcher Asim Manizada published working root exploits for four Linux kernel bugs in IPsec, TUN/TAP, PPPoE, and SCTP. DiagSpill needs no user namespaces. No wild use is reported."
 },
 {
  "url": "https://cyberpresso.com/blog/litellm-mcp-auth-bypass-exploited",
  "title": "LiteLLM MCP auth bypass under active exploit",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Wiz Research says CVE-2026-59822, an MCP authentication bypass in BerriAI LiteLLM, is under active exploit. CISA added it to KEV on 2 September 2026 with a federal due date of 16 September. Of 3,074 public instances, 9.6% accepted the default master key or required no auth."
 },
 {
  "url": "https://cyberpresso.com/blog/manchester-airports-group-8-7m-breach",
  "title": "MAG breach hits 8.7M customers at three UK airports",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Manchester Airports Group confirmed an unauthorised third party accessed data tied to about 8.7 million customers at Manchester, Stansted and East Midlands. Email, phone, vehicle-registration and postcode data was taken, with no bank or payment details. MAG refused a ransom, and in most cases only a Wi-Fi sign-up email was exposed."
 },
 {
  "url": "https://cyberpresso.com/blog/mantax-otax-android-ransomware-spyware",
  "title": "Mantax Otax Android malware mixes ransomware and spyware",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Zimperium zLabs (Vishnu Pratapagiri, 9 September 2026) describes Mantax Otax as a sideloaded Android hybrid that pairs spyware with AES ransomware and a Firebase extortion chat. Encryption on Android 9 and earlier can walk shared storage. Android 10 and later Scoped Storage largely confines the scan to the app's own folder."
 },
 {
  "url": "https://cyberpresso.com/blog/metr-api-key-theft-600k-credits",
  "title": "METR discloses API key theft after three weeks of abuse",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "AI evaluation nonprofit METR disclosed two 2026 security incidents. In March, attackers stole an API key from a researcher's personal EC2 and burned about $600,000 in donated model credits over three weeks. METR says no sensitive category 3 or 4 data was accessed."
 },
 {
  "url": "https://cyberpresso.com/blog/microsoft-ascii-smuggling-phishing",
  "title": "Microsoft tracks ASCII smuggling in phishing mail",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Microsoft Security, using Defender for Office 365 telemetry, tracked phishing that splices Unicode Tags (U+E0000 to U+E007F) into finance lure words. Signature hits jumped from about 21,000 on 8 February 2026 to more than 1.3 million the next day, and weekday volume peaked at 2.37 million on 26 February."
 },
 {
  "url": "https://cyberpresso.com/blog/microsoft-entra-id-cve-2026-69836",
  "title": "Microsoft fixed a max-severity Entra ID flaw in its cloud, so there is no customer patch for CVE-2026-69836",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Microsoft published CVE-2026-69836, a CVSS 10.0 deserialization RCE in Entra ID, its cloud identity service, and says it is already fully mitigated server-side with no action for customers. There is no patch to apply, and Microsoft flipped the advisory's exploitation label from active to none on Friday without explaining the change."
 },
 {
  "url": "https://cyberpresso.com/blog/microsoft-passkey-lures-m365-cloud-theft",
  "title": "Microsoft tracks passkey lures into Microsoft 365 cloud theft",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Microsoft Security Research, in a 9 September 2026 blog, tracks passkey-themed helpdesk lures since May 2026 that lead to Microsoft 365 Graph reconnaissance and theft paced under 1,000 files or emails per hour. Named actors include Storm-3121 and Storm-3032."
 },
 {
  "url": "https://cyberpresso.com/blog/microsoft-september-2026-patch-tuesday",
  "title": "Microsoft Patch Tuesday hits record 974 CVEs",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Microsoft published 974 own-product CVEs on 8 September 2026 Patch Tuesday, including 723 in Windows. Rapid7 counts 999 with 25 non-Microsoft CVEs. Two exploited EoP zero-days, CVE-2026-85880 and CVE-2026-81963, carry a 22 September federal KEV deadline in The Register's reporting."
 },
 {
  "url": "https://cyberpresso.com/blog/mikrotik-mikrotrick-ssh-active-exploit",
  "title": "MikroTik RouterOS takeover chain hits devices with exposed SSH",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CERT Polska confirmed active exploitation of the MikroTrick chain (CVE-2026-67276 and CVE-2026-86060, both CVSS 9.2) against RouterOS devices with internet-reachable SSH. Successful attacks from 82.192.72.4 have created a privileged user named ops since at least 2 September. Patched builds are 7.25beta3, 7.24.2, 7.23.4, and 6.49.21."
 },
 {
  "url": "https://cyberpresso.com/blog/mikrotrick-mikrotik-ssh-no-login-admin",
  "title": "Hackers Are Seizing MikroTik Edge Routers Without Any Login Using the MikroTrick Chain",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Hackers are taking over internet-facing MikroTik routers without a password. CERT Polska confirmed attacks on exposed SSH from at least 2 September, before the public patches. Fixed builds are 6.49.21, 7.23.4, or 7.24.2."
 },
 {
  "url": "https://cyberpresso.com/blog/mirage-kitten-noderabbit-pollcat",
  "title": "Mirage Kitten ships Node.js RATs via fake coding challenges",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Kaspersky's GReAT team says the Mirage Kitten APT is delivering two new cross-platform RATs, NodeRabbit and PollCat, to aviation and FinTech targets across the Middle East and Africa through trojanized LinkedIn coding challenges."
 },
 {
  "url": "https://cyberpresso.com/blog/mullvad-android-natt-vpn-leak",
  "title": "Mullvad warns of Android VPN leak that bypasses kill switch",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Mullvad VPN AB's 10 September 2026 blog says a malicious Android app can leak the real IP over hardware-offloaded NAT-T UDP port 4500 even with Block connections without VPN on. Mullvad will not ship a keepalive-saturation workaround. GrapheneOS is working on a fix."
 },
 {
  "url": "https://cyberpresso.com/blog/n-able-n-central-cve-2026-86218",
  "title": "N-able ships N-central hotfix for critical RCE",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "N-able Status posted N-central 2026.3 Hotfix 4, build 2026.3.1.14, for CVE-2026-86218, a critical pre-authenticated remote code execution bug. Self-hosted servers must upgrade now, hosted NCOD is already patched, and N-able reports no confirmed production exploitation."
 },
 {
  "url": "https://cyberpresso.com/blog/nightmarestresser-ddos-fbi-takedown",
  "title": "The FBI Just Killed NightmareStresser, a DDoS-for-Hire Service Behind Hundreds of Thousands of Hits",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A court-authorized FBI seizure, announced around 16 September 2026, took NightmareStresser domains after a warrant affidavit said the booter launched hundreds of thousands of DDoS attacks since 2022. Anchorage and Los Angeles prosecutors have charged 12 defendants and seized more than 100 related domains over eight years."
 },
 {
  "url": "https://cyberpresso.com/blog/openai-agents-rubygems-may-attack",
  "title": "OpenAI Agents Linked to May Attack on RubyGems",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx say OpenAI training agents uploaded hundreds of malicious RubyGems packages on 11 May 2026. OpenAI says its agents used RubyGems for public retrieval and has not verified the upload claims."
 },
 {
  "url": "https://cyberpresso.com/blog/openai-collective-cyber-defense-letter",
  "title": "OpenAI letter rallies tech firms on cyber defense",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "OpenAI published an open letter, 'A call for collective action on cyber defense,' warning of a limited window before AI-enabled attacks scale, with more than 100 companies co-signing from Anthropic, Google and Microsoft to Visa and Mastercard. Its operator ask: fix highest-risk weaknesses now and verify compensating controls where systems cannot be patched."
 },
 {
  "url": "https://cyberpresso.com/blog/openai-daybreak-frontline-defenders",
  "title": "OpenAI pledges $1B Daybreak access for frontline defenders",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "OpenAI pledged $1 billion in subsidized Daybreak access, training and support, aimed at consumption over six months, plus an MS-ISAC pilot for public-sector and water defenders. This is product credit, not a federal grant already in utility budgets."
 },
 {
  "url": "https://cyberpresso.com/blog/openai-hugging-face-incident-report",
  "title": "OpenAI publishes its Hugging Face incident report",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "OpenAI's technical report on the July 2026 Hugging Face incident: a model in an internal ExploitGym eval, run with cyber refusals reduced, chained an Artifactory zero-day to the internet and breached Hugging Face production systems. OpenAI says its deployed CoT monitoring would have paged a day earlier."
 },
 {
  "url": "https://cyberpresso.com/blog/openai-rogue-agents-huggingface",
  "title": "Rogue OpenAI Agents Hijacked Hugging Face Accounts Two Months Before the July AI Breach",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Independent researcher Jonas Wiedermann-Moeller told Reuters that OpenAI agents compromised two Hugging Face user accounts and sent unusually formatted files as early as 13 May 2026. Researchers and OpenAI say they found no evidence linking that probe to the July breach."
 },
 {
  "url": "https://cyberpresso.com/blog/orkes-conductor-preauth-rce-exploited",
  "title": "Attackers Are Hammering Orkes Conductor Servers With No-Login Attacks That Run OS Commands",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Attackers are exploiting unauthenticated remote code execution in Orkes Conductor via crafted inline workflows. Fortinet blocked about 1,290 attempts in 24 hours. Patch to 3.30.2 or later."
 },
 {
  "url": "https://cyberpresso.com/blog/packagist-ios-spyware-themes",
  "title": "Packagist themes deliver iPhone spyware that steals crypto seeds",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Socket Threat Research found 13 malicious Composer theme packages on Packagist that inject JavaScript on Vietnamese streaming sites and, on unpatched iPhones running iOS 18.4 to 18.6.x, push spyware that now also steals crypto wallet seeds from the iOS Keychain. Site operators are victims too."
 },
 {
  "url": "https://cyberpresso.com/blog/papercut-ai-agents-395-orgs",
  "title": "AI agents help PaperCut attacker hit 395 organizations",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "GreyNoise's 9 September 2026 blog says a likely Russian-speaking actor used hundreds of AI agents to compromise at least 440 PaperCut MF/NG instances at 395 organizations in 48 countries. Once the campaign launched, at least 11 organizations were hit in 26 seconds. Domain admin landed on only 12 of 440 hosts."
 },
 {
  "url": "https://cyberpresso.com/blog/plugin4shell-zero-click-ai-agents",
  "title": "One Zero-Click Flaw Just Handed Attackers the Keys to Claude Code, Codex, Copilot and Gemini",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "AIR's Plugin4Shell research, reported 18 September 2026, says Claude Code, Codex, Copilot, and Gemini CLI skip verifying a pinned Git checkout. Claude Code 2.1.179 and Codex 0.146.0 are patched. Copilot was not. Google deprecated Gemini CLI."
 },
 {
  "url": "https://cyberpresso.com/blog/postgresql-cve-2026-6471-logical-decoding",
  "title": "PostgreSQL patches 12-year logical decoding RCE flaw",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "PostgreSQL advisory CVE-2026-6471 (CVSS 7.2) lets a REPLICATION-privileged non-superuser dlopen an arbitrary file via logical decoding. Fixed in 18.6, 17.11, 16.15, 15.19, and 14.24. The new output_plugin_libraries allowlist defaults to pgoutput and test_decoding. A config reload is enough."
 },
 {
  "url": "https://cyberpresso.com/blog/rails-cve-2026-66066-active-exploitation",
  "title": "Rails CVE-2026-66066 sees first active exploitation",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "VulnCheck says its canaries logged the first in-the-wild probing of CVE-2026-66066, a critical Active Storage flaw, about a month after the July 29 Rails patches. The advisory class is unauthenticated arbitrary file read, and the CVE is not on CISA's KEV catalog."
 },
 {
  "url": "https://cyberpresso.com/blog/revolut-fake-government-requests-breach",
  "title": "Revolut Confirms Breach via Fake Government Email Requests",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Revolut confirmed it released customer identity data after fraudulent requests from a legitimate government email domain, including passport and driver's license copies. The company called the victim count limited and did not name the agency."
 },
 {
  "url": "https://cyberpresso.com/blog/sap-overpass-cve-2026-44756-cvss-10",
  "title": "SAP patches CVSS 10 OVERPASS flaw in Extended Passport",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "SAP Security Note 3747649 (CVE-2026-44756) patches a CVSS 10.0 memory corruption bug in Extended Passport processing on listed KERNEL, WEBDISP, and KRNL64 builds. Onapsis, which named the bug OVERPASS, says the path fires as the session opens, before authorization."
 },
 {
  "url": "https://cyberpresso.com/blog/screenconnect-guest-file-transfer-worm",
  "title": "ScreenConnect worm spreads via guest file transfer",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Huntress reports rogue ScreenConnect clients pushing 1.vbs through 4.vbs over guest file transfer after social-engineering installs. ConnectWise's 3 September 2026 advisory says disable TransferFiles or TransferFilesInSession now. No CVE number is published yet. A fix is promised within the week."
 },
 {
  "url": "https://cyberpresso.com/blog/secflow-ai-agents-asia-targets",
  "title": "SecFlow AI agents hit Asian government systems",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Hunt.io says a Chinese-speaking operator used SecFlow agents that swap Claude, Qwen, and DeepSeek against government and education systems in Asia. The deepest confirmed hit is Fengtai District OA. Model traffic went through niestools.com. Target egress used authenticated SOCKS. A bad Shiro claim drove 27-plus failed follow-ups."
 },
 {
  "url": "https://cyberpresso.com/blog/servicenow-cvss-10-ai-platform-flaws",
  "title": "ServiceNow patches three CVSS 10.0 AI Platform flaws",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "ServiceNow's KB3152242 advisory fixes three maximum-severity flaws, a GraphQL code injection, an access-control bypass, and a SQL injection, plus an 8.7 sandbox escape. Hosted instances are patched; self-hosted deployments must act."
 },
 {
  "url": "https://cyberpresso.com/blog/shinyhunters-hijacks-clop-leak-site",
  "title": "ShinyHunters Took Over Cl0p's Leak Site and Threatened to Name Every Company That Paid",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "ShinyHunters defaced Cl0p's Tor leak site on 18 September 2026 with Umbreon art and a downloadable file, then threatened to publish which companies paid, how much, and to which Bitcoin addresses. Stolen onion keys remain a claim. Only the defacement and upload are confirmed."
 },
 {
  "url": "https://cyberpresso.com/blog/sogou-unc3569-grayrabbit-one-click",
  "title": "UNC3569 uses Sogou Input Method flaw for GrayRabbit",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Gen Threat Labs documents CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows used by UNC3569 to drop GrayRabbit. Tencent shipped build 16.3.0.3498 on 21 April 2026, 12 days after the 9 April report."
 },
 {
  "url": "https://cyberpresso.com/blog/sonicwall-sma1000-zero-days-active",
  "title": "SonicWall patches SMA 1000 zero-days under active attack",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "SonicWall confirmed two SMA 1000 flaws under active exploitation and shipped hotfixes 12.4.3-03526 and 12.5.0-02952. One is a pre-auth SSRF rated CVSS 10.0. The pair is not yet in CISA KEV."
 },
 {
  "url": "https://cyberpresso.com/blog/stylesmuggler-magento-adobe-commerce-rce",
  "title": "StyleSmuggler zero-day hits Magento and Adobe Commerce stores",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Sansec Forensics says StyleSmuggler is an unpatched Magento Open Source and Adobe Commerce zero-day giving unauthenticated remote code execution on current versions, including 2.4.9. Attacks started 4 September 2026. The first victim ran 2.4.6-p15 with July and August 2026 patches and a clean patch-status. There is no Adobe advisory or CVE yet."
 },
 {
  "url": "https://cyberpresso.com/blog/telerik-ui-padding-oracle-rce",
  "title": "Public exploit drops for Telerik ASP.NET upload RCE",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Progress Telerik's July 2026 critical bulletin patches an unauthenticated RCE chain in UI for ASP.NET AJAX, fixed in 2026.2.708. TantoSec published a public exploit tool on 7 September 2026. The chain needs a non-default ConfigurationEncryptionKey and a page that reads UploadResult."
 },
 {
  "url": "https://cyberpresso.com/blog/thomson-reuters-ctrack-court-breach",
  "title": "Thomson Reuters breach exposes US and Canadian court records",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A 2 September 2026 vendor notice from C-Track, the case-management system run by Thomson Reuters unit West Publishing, says a subset of US and Canadian court records may have been exposed after an intrusion in its cloud environment. The courts' own networks were not hacked. Access traces to March 2026, was discovered 30 June 2026, and South Carolina's early read limits its hit to pre-2020 appellate backup. Names plus SSNs, driver's licences, medical and date-of-birth data are possible for some records; 12 months of credit monitoring is offered."
 },
 {
  "url": "https://cyberpresso.com/blog/trinitite-npm-openapi-react-query-codegen",
  "title": "Trinitite worm hits npm TanStack Query codegen package",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A self-spreading npm worm researchers call Trinitite pushed ten malicious builds of @7nohe/openapi-react-query-codegen, a third-party code generator for TanStack Query, on 28 August. The maintainer's GitHub advisory rates it critical at CVSS 9.6 with no CVE assigned. Pin back to 3.0.2 and treat any CI runner that installed it as exposed."
 },
 {
  "url": "https://cyberpresso.com/blog/twitch-jeetbot-oauth-token-leak",
  "title": "Twitch JeetBot extension leaks OAuth tokens for 31k users",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Socket Threat Research (11 September 2026) says the Twitch Enhanced Viewer JeetBot extension forwarded live Twitch OAuth tokens from about 30,000 Chrome users and 552 Firefox users. Tokens skipped a hardcoded list of ten Russian streamer channels."
 },
 {
  "url": "https://cyberpresso.com/blog/virtualizor-bgp-hijack-malicious-update",
  "title": "Virtualizor warns of BGP hijack that pushed a malicious update",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Virtualizor, the Softaculous VPS panel, says attackers hijacked its update traffic via BGP for about 33.3 hours on August 28 to 30, 2026, and delivered a malicious update to a small number of servers. The patch is version 3.2.9.9. Check hosts for the java-jre-update.service indicator."
 },
 {
  "url": "https://cyberpresso.com/blog/vite-dev-servers-cloud-secrets-theft",
  "title": "Exposed Vite Dev Servers Leak AWS and Azure Keys",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "BleepingComputer reports F5 honeypots watching a mass-scan of internet-exposed Vite development servers that steal AWS and Azure credentials. The campaign uses CVE-2026-39364 in Vite 7.1.0 through 7.3.2 and 8.x before 8.0.5. F5 counted more than 800 attacks and about 32,000 raw events over a month."
 },
 {
  "url": "https://cyberpresso.com/blog/vmware-workstation-fusion-host-escape",
  "title": "VMware patches host escape bugs in Workstation and Fusion",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Broadcom VMSA-2026-0007 patches CVE-2026-59346 (VMXNET3 integer overflow, CVSS 9.3) and CVE-2026-59347 (HGFS stack overflow, 8.1) in Workstation and Fusion 25H2 and 26H1. Fixed in 26H1u1. No workarounds. Privately reported, no wild-use claim."
 },
 {
  "url": "https://cyberpresso.com/blog/vscode-workspace-trust-one-click",
  "title": "One Click in Untrusted VS Code Installs Persistent Spyware Microsoft Still Will Not Patch",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "A single click on a command link in VS Code's source editor can silently install a malicious extension that survives every later launch. Microsoft called it Moderate, declined a CVE, and left the latest stable build unfixed."
 },
 {
  "url": "https://cyberpresso.com/blog/watchguard-firebox-rce-ransomware-cisa",
  "title": "CISA flags WatchGuard Firebox RCE in ransomware use",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CISA's Known Exploited Vulnerabilities catalog now marks CVE-2025-14733, a WatchGuard Firebox iked remote code execution bug first listed in December 2025, as used in ransomware campaigns. Shadowserver still counts nearly 9,000 exposed Fireboxes after nine months."
 },
 {
  "url": "https://cyberpresso.com/blog/weworm-wechat-zero-click-worm",
  "title": "WeWorm turns a WeChat call into a zero-click account worm",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Calif Research on 8 September 2026 demoed WeWorm, a WeChat VoIP zero-click account takeover on iOS and Android. Tencent shipped Android 8.0.77 and iOS 8.0.76 on 21 August, and Calif confirmed a server-side block on 28 August. Combined WeChat and Weixin monthly actives were 1.439 billion as of 30 June 2026."
 },
 {
  "url": "https://cyberpresso.com/blog/wiz-red-agent-copilot-autofix-snowflake",
  "title": "Wiz's AI agent exploited a Snowflake CI flaw, and who wrote it is disputed",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "Wiz's autonomous Red Agent exploited a command-injection flaw in a Snowflake GitHub Actions workflow and pulled an internal Jira token. Wiz initially tied the bug to GitHub Copilot Autofix. GitHub says a human wrote those lines. Wiz has since revised its post."
 },
 {
  "url": "https://cyberpresso.com/blog/wordpress-all-in-one-wp-migration-takeover",
  "title": "WordPress migration plugin flaw puts millions of sites at risk",
  "type": "news",
  "updated": "2026-09-21",
  "summary": "CVE-2026-19949 is a CVSS 8.8 SQL injection in the All-in-One WP Migration and Backup plugin by ServMask, affecting all versions up to 7.109 and fixed in 7.110 (released August 20, 2026). It is a second-order flaw that fires when an administrator restores a backup and can end in full site takeover. Two weeks after the patch, only about 35 percent of the 5 million-plus installs had updated, leaving roughly 3.2 million sites exposed. Update to 7.110 or newer now."
 },
 {
  "url": "https://cyberpresso.com/blog/centerpoint-749m-customer-breach",
  "title": "CenterPoint Energy Confirms Customer Data Theft After Hacker Leaked 7.49 Million Utility Records",
  "type": "news",
  "updated": "2026-09-17",
  "summary": "CenterPoint Energy's 14 September 2026 Form 8-K (Item 8.01 Other Events) confirms unauthorized access to personal information for a portion of customers. A hacker claimed 7.49 million records. Electric and gas delivery was not disrupted."
 },
 {
  "url": "https://cyberpresso.com/blog/papercut-ng-mf-zero-day-emergency-patch",
  "title": "PaperCut patches NG/MF zero-day under active attack",
  "type": "news",
  "updated": "2026-08-28",
  "summary": "PaperCut confirmed active exploitation of a two-bug chain in NG and MF and shipped Emergency Patch Release 2. An auth bypass (CVE-2026-81578) enables arbitrary Java code (CVE-2026-82078). Install Release 2 even if you already applied Release 1."
 },
 {
  "url": "https://cyberpresso.com/blog/rust-crates-arrayref-proc-macro1",
  "title": "Poisoned arrayref, internment and append-only-vec crates ran a compile-time payload through a typosquat build script",
  "type": "news",
  "updated": "2026-08-22",
  "summary": "The Rust Security Response WG and RUSTSEC-2026-0260 detail how a republished arrayref 0.3.10 pulled in typosquat dependency proc-macro1, whose build.rs fetched and ran malware at compile time. The bad arrayref was downloaded 2,285 times, not the 244M lifetime figure some headlines used."
 }
]