{
    "generated_at": "2026-10-18T01:34:15+00:00",
    "count": 30,
    "articles": [
        {
            "id": 5129,
            "title": "North Korean IT Workers Used Stolen US Identities to Earn $3 Million",
            "url": "https://securityaffairs.com/201193/intelligence/north-korean-it-workers-used-stolen-us-identities-to-earn-3-million.html",
            "author": "Pierluigi Paganini",
            "summary": "The FBI raided 40 Texas homes over a North Korean scheme that used fake IT workers to target 70 US companies and generate $3 million. The Justice Department (DoJ) announced coordinated enforcement actions this week targeting North Korea’s long-running scheme to place fake IT workers inside American companies. Two US nationals were arrested, 14 people […]",
            "published_at": "2026-10-17 16:29:10",
            "discovered_at": "2026-10-17 16:45:06",
            "updated_at": null,
            "priority_score": 0,
            "source": "Security Affairs",
            "source_group": "Other",
            "categories": [
                "Law Enforcement"
            ],
            "cves": []
        },
        {
            "id": 5128,
            "title": "Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack",
            "url": "https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/",
            "author": "Ionut Ilascu",
            "summary": "ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]",
            "published_at": "2026-10-17 15:18:51",
            "discovered_at": "2026-10-17 15:25:07",
            "updated_at": null,
            "priority_score": 0,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "categories": [
                "Microsoft"
            ],
            "cves": []
        },
        {
            "id": 5127,
            "title": "Drupal patches critical RCE flaws, warns exploits may emerge soon",
            "url": "https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/",
            "author": "Bill Toulas",
            "summary": "Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]",
            "published_at": "2026-10-17 14:32:48",
            "discovered_at": "2026-10-17 14:45:06",
            "updated_at": null,
            "priority_score": 15,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "categories": [
                "Cloud Security",
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 5126,
            "title": "MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon",
            "url": "https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html",
            "author": "info@thehackernews.com (The Hacker News)",
            "summary": "Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of",
            "published_at": "2026-10-17 11:11:56",
            "discovered_at": "2026-10-17 11:40:03",
            "updated_at": null,
            "priority_score": 0,
            "source": "The Hacker News",
            "source_group": "Security Journalism",
            "categories": [
                "Microsoft",
                "Security Research"
            ],
            "cves": []
        },
        {
            "id": 5125,
            "title": "Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel",
            "url": "https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/",
            "author": "Ionut Arghire",
            "summary": "Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.",
            "published_at": "2026-10-17 11:00:00",
            "discovered_at": "2026-10-17 11:10:09",
            "updated_at": null,
            "priority_score": 0,
            "source": "Security Week",
            "source_group": "Security Journalism",
            "categories": [
                "Threat Actors"
            ],
            "cves": []
        },
        {
            "id": 5123,
            "title": "U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog",
            "url": "https://securityaffairs.com/201178/security/u-s-cisa-adds-fortinet-multiple-products-and-beyondtrust-remote-support-flaws-to-its-known-exploited-vulnerabilities-catalog.html",
            "author": "Pierluigi Paganini",
            "summary": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: This week, Palo Alto Netwoks researchers reported that PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, […]",
            "published_at": "2026-10-17 10:35:48",
            "discovered_at": "2026-10-17 11:10:09",
            "updated_at": null,
            "priority_score": 30,
            "source": "Security Affairs",
            "source_group": "Other",
            "categories": [
                "Cloud Security",
                "Malware",
                "Network Security"
            ],
            "cves": []
        },
        {
            "id": 5124,
            "title": "BAE Systems Cyber Incident Takes US Bankruptcy Noticing Center Offline for a Week",
            "url": "https://securityaffairs.com/201166/security/bae-systems-cyber-incident-takes-us-bankruptcy-noticing-center-offline-for-a-week.html",
            "author": "Pierluigi Paganini",
            "summary": "A cyber incident at a BAE Systems subsidiary just stopped every bankruptcy court in the US from sending notices, and the problem started a week ago. A security incident at BAE Systems Inc., the US subsidiary of British defense contractor BAE Systems, has taken the Bankruptcy Noticing Center offline since October 9. The Bankruptcy Noticing […]",
            "published_at": "2026-10-17 10:08:42",
            "discovered_at": "2026-10-17 11:10:09",
            "updated_at": null,
            "priority_score": 0,
            "source": "Security Affairs",
            "source_group": "Other",
            "categories": [],
            "cves": []
        },
        {
            "id": 5122,
            "title": "AI Agents Accessed Indian Organizations Without Authorization, CERT-In Warns",
            "url": "https://securityaffairs.com/201130/ai/ai-agents-accessed-indian-organizations-without-authorization-cert-in-warns.html",
            "author": "Pierluigi Paganini",
            "summary": "India’s CERT-In warns AI agents accessed confidential data undetected, while attackers used offensive AI frameworks to accelerate cyberattacks. CERT-In, India’s national cyber response team, published a critical-severity advisory 15 documenting two distinct categories of AI-related incidents. In one, AI models under research and evaluation exceeded their assigned tasks and accessed live Indian systems without authorization. […]",
            "published_at": "2026-10-17 08:55:55",
            "discovered_at": "2026-10-17 09:20:02",
            "updated_at": null,
            "priority_score": 0,
            "source": "Security Affairs",
            "source_group": "Other",
            "categories": [
                "AI Security"
            ],
            "cves": []
        },
        {
            "id": 5119,
            "title": "Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants",
            "url": "https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html",
            "author": "info@thehackernews.com (The Hacker News)",
            "summary": "Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs",
            "published_at": "2026-10-17 06:16:46",
            "discovered_at": "2026-10-17 06:45:04",
            "updated_at": null,
            "priority_score": 0,
            "source": "The Hacker News",
            "source_group": "Security Journalism",
            "categories": [
                "Microsoft",
                "Security Research",
                "Threat Actors"
            ],
            "cves": []
        },
        {
            "id": 5120,
            "title": "ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks",
            "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
            "author": null,
            "summary": "ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.",
            "published_at": "2026-10-16 23:00:00",
            "discovered_at": "2026-10-17 07:45:02",
            "updated_at": null,
            "priority_score": 0,
            "source": "Huntress",
            "source_group": "Security Journalism",
            "categories": [
                "Microsoft"
            ],
            "cves": []
        },
        {
            "id": 5113,
            "title": "BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs",
            "url": "https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs",
            "author": "Nate Nelson",
            "summary": "Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.",
            "published_at": "2026-10-16 20:34:37",
            "discovered_at": "2026-10-16 20:55:04",
            "updated_at": null,
            "priority_score": 25,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "categories": [
                "Network Security",
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 5112,
            "title": "Critical BlockStrap flaw lets hackers run code on Magento servers",
            "url": "https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/",
            "author": "Bill Toulas",
            "summary": "Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]",
            "published_at": "2026-10-16 20:00:59",
            "discovered_at": "2026-10-16 20:15:02",
            "updated_at": null,
            "priority_score": 5,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "categories": [
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-103849"
            ]
        },
        {
            "id": 5111,
            "title": "Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk",
            "url": "https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk",
            "author": "Rob Wright",
            "summary": "Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.",
            "published_at": "2026-10-16 19:49:30",
            "discovered_at": "2026-10-16 20:10:11",
            "updated_at": null,
            "priority_score": 0,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "categories": [],
            "cves": []
        },
        {
            "id": 5110,
            "title": "Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform",
            "url": "https://www.darkreading.com/data-privacy/biomemory-launches-dna-shield",
            "author": null,
            "summary": "The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.",
            "published_at": "2026-10-16 19:22:12",
            "discovered_at": "2026-10-16 19:40:04",
            "updated_at": null,
            "priority_score": 0,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "categories": [],
            "cves": []
        },
        {
            "id": 5109,
            "title": "Enterprise AI Enters Risk Management Phase as Security Concerns Rise",
            "url": "https://www.darkreading.com/cyber-risk/enterprise-ai-risk-management-phase-security-concerns-rise",
            "author": null,
            "summary": "Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.",
            "published_at": "2026-10-16 19:13:59",
            "discovered_at": "2026-10-16 19:25:05",
            "updated_at": null,
            "priority_score": 0,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "categories": [],
            "cves": []
        },
        {
            "id": 5108,
            "title": "AI Takes Control of Robotic Arm in 16 Minutes Flat",
            "url": "https://www.darkreading.com/ics-ot-security/ai-takes-control-robotic-arm-16-minutes",
            "author": "Robert Lemos",
            "summary": "Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.",
            "published_at": "2026-10-16 18:37:50",
            "discovered_at": "2026-10-16 18:55:05",
            "updated_at": null,
            "priority_score": 0,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "categories": [],
            "cves": []
        },
        {
            "id": 5107,
            "title": "Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug",
            "url": "https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html",
            "author": "info@thehackernews.com (The Hacker News)",
            "summary": "A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped",
            "published_at": "2026-10-16 17:48:45",
            "discovered_at": "2026-10-16 18:40:03",
            "updated_at": "2026-10-17 18:00:07",
            "priority_score": 10,
            "source": "The Hacker News",
            "source_group": "Security Journalism",
            "categories": [
                "Cloud Security",
                "Linux",
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 5106,
            "title": "Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026",
            "url": "https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/",
            "author": "Unit 42",
            "summary": "Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.",
            "published_at": "2026-10-16 17:47:54",
            "discovered_at": "2026-10-16 18:15:03",
            "updated_at": null,
            "priority_score": 0,
            "source": "Palo Alto Networks Unit 42",
            "source_group": "Vendor Research",
            "categories": [
                "Phishing"
            ],
            "cves": []
        },
        {
            "id": 405,
            "title": "CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-064-aws/",
            "author": "aws@amazon.com",
            "summary": null,
            "published_at": "2026-10-16 17:37:32",
            "discovered_at": "2026-08-15 18:58:22",
            "updated_at": "2026-10-16 18:35:02",
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Cloud Security",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-16756"
            ]
        },
        {
            "id": 406,
            "title": "Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-066-aws/",
            "author": "aws@amazon.com",
            "summary": null,
            "published_at": "2026-10-16 17:37:32",
            "discovered_at": "2026-08-15 18:58:22",
            "updated_at": "2026-10-16 18:35:02",
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Cloud Security",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2025-4318"
            ]
        },
        {
            "id": 413,
            "title": "CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-062-aws/",
            "author": "aws@amazon.com",
            "summary": null,
            "published_at": "2026-10-16 17:37:32",
            "discovered_at": "2026-08-15 18:58:22",
            "updated_at": "2026-10-16 18:35:03",
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-16317",
                "CVE-2026-16318"
            ]
        },
        {
            "id": 435,
            "title": "CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-069-aws/",
            "author": "aws@amazon.com",
            "summary": null,
            "published_at": "2026-10-16 17:37:32",
            "discovered_at": "2026-08-15 18:58:22",
            "updated_at": "2026-10-16 18:35:03",
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-18394"
            ]
        },
        {
            "id": 446,
            "title": "CVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-067-aws/",
            "author": "aws@amazon.com",
            "summary": null,
            "published_at": "2026-10-16 17:37:32",
            "discovered_at": "2026-08-15 18:58:22",
            "updated_at": "2026-10-16 18:35:03",
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Cloud Security",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-18140"
            ]
        },
        {
            "id": 459,
            "title": "CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-065-aws/",
            "author": "aws@amazon.com",
            "summary": null,
            "published_at": "2026-10-16 17:37:32",
            "discovered_at": "2026-08-15 18:58:22",
            "updated_at": "2026-10-16 18:35:03",
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Cloud Security",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-16796"
            ]
        },
        {
            "id": 468,
            "title": "CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Failure",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-063-aws/",
            "author": "aws@amazon.com",
            "summary": null,
            "published_at": "2026-10-16 17:37:32",
            "discovered_at": "2026-08-15 18:58:22",
            "updated_at": "2026-10-16 18:35:03",
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Cloud Security",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-16584"
            ]
        },
        {
            "id": 5100,
            "title": "CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/",
            "author": "aws@amazon.com",
            "summary": "Bulletin ID: 2026-139-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:15 AM PDT Description: FreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions. CVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled. CVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name. Impacted versions: - CVE-2026-102551 (Router Advertisement):",
            "published_at": "2026-10-16 17:34:49",
            "discovered_at": "2026-10-16 17:40:02",
            "updated_at": null,
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Cloud Security",
                "Linux",
                "Network Security",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-102551",
                "CVE-2026-102552"
            ]
        },
        {
            "id": 5101,
            "title": "CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel",
            "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-138-aws/",
            "author": "aws@amazon.com",
            "summary": "Bulletin ID: 2026-138-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:00 AM PDT Description: FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. AWS identified two issues with the FreeRTOS-Kernel Arm Cortex-R82 (Armv8-R AArch64) MPU port, affecting multiple versions. CVE-2026-109587: incorrect authorization in the Arm Cortex-R82 MPU port. On MPU-enabled builds, the port does not correctly enforce the memory-region boundaries assigned to an unprivileged task when it passes a buffer argument to an MPU system call. Under certain conditions, an unprivileged task might read and write privileged kernel memory outside the regions assigned to it. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected. CVE-2026-109588: numeric truncation in the MPU buffer authorization check on the Arm Cortex-R82 MPU port. On MPU-enabled builds, the buffer-length validation does not correctly account for the full length of a buffer passed to a stream buffer system call. Under certain conditions, an unprivileged task might read or write privileged kernel memory beyond the validated buffer window. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected. Impacted versions: - CVE-2026-109587 (MPU region authorization): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1) - CVE-2026-109588 (MPU buffer length truncation): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.",
            "published_at": "2026-10-16 17:34:49",
            "discovered_at": "2026-10-16 17:40:02",
            "updated_at": null,
            "priority_score": 5,
            "source": "AWS Security Bulletins",
            "source_group": "Vendor Research",
            "categories": [
                "Cloud Security",
                "Linux",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2026-109587",
                "CVE-2026-109588"
            ]
        },
        {
            "id": 5098,
            "title": "Targeted ads installed Candiru spyware in zero-click attacks",
            "url": "https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/",
            "author": "Bill Toulas",
            "summary": "Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]",
            "published_at": "2026-10-16 17:20:03",
            "discovered_at": "2026-10-16 17:25:03",
            "updated_at": "2026-10-16 19:15:03",
            "priority_score": 0,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "categories": [],
            "cves": []
        },
        {
            "id": 5105,
            "title": "Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor",
            "url": "https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html",
            "author": "info@thehackernews.com (The Hacker News)",
            "summary": "Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis",
            "published_at": "2026-10-16 16:43:39",
            "discovered_at": "2026-10-16 17:55:02",
            "updated_at": null,
            "priority_score": 0,
            "source": "The Hacker News",
            "source_group": "Security Journalism",
            "categories": [
                "Malware",
                "Microsoft",
                "Threat Intelligence"
            ],
            "cves": []
        },
        {
            "id": 5097,
            "title": "UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing",
            "url": "https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html",
            "author": "info@thehackernews.com (The Hacker News)",
            "summary": "Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by",
            "published_at": "2026-10-16 16:16:44",
            "discovered_at": "2026-10-16 16:40:19",
            "updated_at": null,
            "priority_score": 0,
            "source": "The Hacker News",
            "source_group": "Security Journalism",
            "categories": [
                "Phishing",
                "Security Research"
            ],
            "cves": []
        }
    ]
}