<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:dc="http://purl.org/dc/elements/1.1/"
     xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
     xmlns:admin="http://webns.net/mvcb/"
     xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:content="http://purl.org/rss/1.0/modules/content/"
     xmlns:media="http://search.yahoo.com/mrss/">
<channel>
<title>TeqManch &#45; Raghib Awan</title>
<link>https://teqmanch.com/rss/author/raghib</link>
<description>TeqManch &#45; Raghib Awan</description>
<dc:language>en</dc:language>

<item>
<title>Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation</title>
<link>https://teqmanch.com/xandr-fined-a-record-86-million-for-relaying-grindr-data-revealing-sexual-orientation</link>
<guid>https://teqmanch.com/xandr-fined-a-record-86-million-for-relaying-grindr-data-revealing-sexual-orientation</guid>
<description><![CDATA[ The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users&#039; sensitive data to advertisers.

The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the &quot;very serious&quot; nature of the breach. The infringements ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGjfJJaKUMdLoNBTH2AYUmelL_XonLcf93p8hSgMXRbLGJwReAYV-BUZ2jpBPuvUQktW0PTKi1-21oFnBJF8PfECgT7t5r-S-iMUxjrdoWPf3EDxa2IVrQYjT98HG6s-LfPlJqm8mArrfEOEZS_scT7EYG8eXxMrUaII0UaQ3kAmWDJ3mRTR4JyIJhj-5S/s1600/grindr-data.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Xandr, Fined, Record, €8.6, Million, for, Relaying, Grindr, Data, Revealing, Sexual, Orientation</media:keywords>
</item>

<item>
<title>[Webinar] How to Stop AI&#45;Driven Privilege Escalation With Runtime Identity Controls</title>
<link>https://teqmanch.com/webinar-how-to-stop-ai-driven-privilege-escalation-with-runtime-identity-controls</link>
<guid>https://teqmanch.com/webinar-how-to-stop-ai-driven-privilege-escalation-with-runtime-identity-controls</guid>
<description><![CDATA[ The dangerous part of a stolen identity isn&#039;t always the initial login. It&#039;s what an attacker can do with that access next.

With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIhyphenhyphenHu3P6G99-W2G5NryBVw_aHrwdzZeMvGjoMkyUiKFOtwD_fqUvdytUAQuhg9gPZzpsWSFatNS2LcMylaW4jsMmRR-tmAXkZxokH4WcEqnXTlFnBFgg8-20j4LsTCQMaKRJY-ysNuH8uXg_D3Zb626eqIdGeTkkmvyh95PERJ_mnaPNnnv2maV0q4F2-/s1600/silverfort.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Webinar, How, Stop, AI-Driven, Privilege, Escalation, With, Runtime, Identity, Controls</media:keywords>
</item>

<item>
<title>LG Smart TVs Vulnerable to Pre&#45;Auth Root Takeover From Local Network</title>
<link>https://teqmanch.com/lg-smart-tvs-vulnerable-to-pre-auth-root-takeover-from-local-network</link>
<guid>https://teqmanch.com/lg-smart-tvs-vulnerable-to-pre-auth-root-takeover-from-local-network</guid>
<description><![CDATA[ Three vulnerabilities in LG&#039;s webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.

LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.

The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgs2Z0M9u8vYqE8SBNBzfOGoc4Crog-_PBWeZNY8IprfYaa08ZyZ_PTfMhosBFrQNS_f1JecVbl_HEq7sutExV_92yaZWVIA51YD59JOFa_fKZQyEvpZNUxai8pgDrQX_Kp_wQqJoEFFQIFEwa2c3vhyphenhyphenQtU0U9w5XDwjSAij3BPz_qRs7-t0eu8ZssOZuE/s1600/lg-tv.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Smart, TVs, Vulnerable, Pre-Auth, Root, Takeover, From, Local, Network</media:keywords>
</item>

<item>
<title>Product Walkthrough: Bitdefender AI Visibility and Control</title>
<link>https://teqmanch.com/product-walkthrough-bitdefender-ai-visibility-and-control</link>
<guid>https://teqmanch.com/product-walkthrough-bitdefender-ai-visibility-and-control</guid>
<description><![CDATA[ A user opens a browser tab, pastes data into a chat assistant, and nothing is installed.

A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list.

Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkLz0n_kNY4YMLYNTi1KElj3dkaig5LqA6Koy92X4ndKfwBO8ctC5bNVyII81TUHljc7MGrpMZBsUX5j4126sBd3Sk5fX_DGjIo-yz5qGrRsHgi2qiLNUUbfCSvOHcE-KoYqGzNLBvTVzwEKDt2hZ4dvGK8YYOTeA-f6FHX49GA0myiau9Mqgc_LT7D1k/s1600/bit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Product, Walkthrough:, Bitdefender, Visibility, and, Control</media:keywords>
</item>

<item>
<title>Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers</title>
<link>https://teqmanch.com/attackers-heat-french-supermarket-fridges-up-to-50c-by-hijacking-danfoss-controllers</link>
<guid>https://teqmanch.com/attackers-heat-french-supermarket-fridges-up-to-50c-by-hijacking-danfoss-controllers</guid>
<description><![CDATA[ Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said.

The attackers reached them through the controller that runs all of a store&#039;s fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh64tQNgn3aqDhyphenhyphengoK8NxQG3DPvWWi0fP185meJUr14eUmcX18mKJdkUz6QsMU6bTxmwAtHrd8I0J5FQjvTENA1-N1F60zsR1x2iDzaJNhPbg_6iGYTELpBOwiTbBiaMWLmWQ4naaMfCLCcThNEfC302zF-YCjlev6138DvUrXfr5noGCpZaT9JnGd7hUw/s1600/supermarket.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Attackers, Heat, French, Supermarket, Fridges, 50°C, Hijacking, Danfoss, Controllers</media:keywords>
</item>

<item>
<title>Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control</title>
<link>https://teqmanch.com/two-critical-marklogic-flaws-could-give-delegated-managers-persistent-admin-control</link>
<guid>https://teqmanch.com/two-critical-marklogic-flaws-could-give-delegated-managers-persistent-admin-control</guid>
<description><![CDATA[ Two of 31 newly disclosed flaws in Progress Software&#039;s MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.

Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.

Affected ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvGRzVYOU1S12WE6ja5ZSrhInOGaNdwCGGwWch1oJn_SDtoy90ycGVjd-JeDjwSSH8XDzKlkoKsu_vlND1iW0aWJgEqf3Ti18goDI0yXeaLbF2DHrokj8Qdvm1kHEi8wqdm6_axRi17PVBqtlgFWLpZnv6Eufx_bFMkpWcnz6ymbQI4IDB7lgYi3QrZ7w/s1600/amrk.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Two, Critical, MarkLogic, Flaws, Could, Give, Delegated, Managers, Persistent, Admin, Control</media:keywords>
</item>

<item>
<title>GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code</title>
<link>https://teqmanch.com/gitlab-patches-cvss-100-flaw-that-could-let-unauthenticated-users-run-server-code</link>
<guid>https://teqmanch.com/gitlab-patches-cvss-100-flaw-that-could-let-unauthenticated-users-run-server-code</guid>
<description><![CDATA[ GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.

&quot;GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOWNiMkzMghhERT5BPyrVI9JdCWExRLtDNHIHPjmT_WnGhLHyWhahW3xPurPPQJUn7Yz0_g9Nk0zWinEKh4J71g9viLtNVx2fM2anNzhA514PAgZBxobRfeP1jSsovLI6iVi9HIUXxv_dLvK8DrKy5vZktoxrxyd0riB83XCR2dlne7lEgTqdXW1Rwhekz/s1600/gitlab-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>GitLab, Patches, CVSS, 10.0, Flaw, That, Could, Let, Unauthenticated, Users, Run, Server, Code</media:keywords>
</item>

<item>
<title>Low&#45;Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies</title>
<link>https://teqmanch.com/low-cost-android-phones-ship-with-preinstalled-malware-that-turns-them-into-residential-proxies</link>
<guid>https://teqmanch.com/low-cost-android-phones-ship-with-preinstalled-malware-that-turns-them-into-residential-proxies</guid>
<description><![CDATA[ Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.

The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa.

The preinstalled ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWazS9FTiMttWg9JuwySbOkXe9WBGk6EnDbYXfmFzGaoTsXD3FQKLo7YxjnYk9MIZlfmdt08nW3qRKbLggGv2H7ondflK4CbpXu98CiCxnccJfwnrvUwEhMVIHUdt7GO198VkHXASs12AKWj4r44vpT5mF5BHLqX9spJT24dZmpMGqOKyuqoh25f1UuqpY/s1600/android-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Low-Cost, Android, Phones, Ship, With, Preinstalled, Malware, That, Turns, Them, Into, Residential, Proxies</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Helpdesk 0&#45;Days, Rogue Certs, ShinyHunters Arrest, AI&#45;Fooling Malware and More</title>
<link>https://teqmanch.com/weekly-recap-helpdesk-0-days-rogue-certs-shinyhunters-arrest-ai-fooling-malware-and-more</link>
<guid>https://teqmanch.com/weekly-recap-helpdesk-0-days-rogue-certs-shinyhunters-arrest-ai-fooling-malware-and-more</guid>
<description><![CDATA[ Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That&#039;s not much time to read the warning, let alone do something about it.

But speed is only part of the problem. A secure connection didn&#039;t always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiv97S5d5aYZZRto-_3AfPjT2TmAcI0KYQm4zY7cXyf1hz-GHIcmuL9wF5IIzmg3D7_F-yh6Z9qtamVwEikSKd3tuy5eGo_mN2Qw-O602x4Abiwuf5Q9G72nX4ZOeFRly8woPJ8EBn2USmFIdDUVg6P-3f8nUPDTbcqrAF5JWsu_NRWTvz6EF5YVVqPrbvY/s1600/cy-cap.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Helpdesk, 0-Days, Rogue, Certs, ShinyHunters, Arrest, AI-Fooling, Malware, and, More</media:keywords>
</item>

<item>
<title>Bring Your Own Agent: Your Employees&amp;apos; Assistants Are Already Logged In</title>
<link>https://teqmanch.com/bring-your-own-agent-your-employees-assistants-are-already-logged-in</link>
<guid>https://teqmanch.com/bring-your-own-agent-your-employees-assistants-are-already-logged-in</guid>
<description><![CDATA[ The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta&#039;s Muse because it doesn&#039;t identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up.

Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyfIDT5M3MmWcxPZrWKZ_8EOy_WZY9iQHv9CQrAKcSZ7_EAadHyWzg9Aa5zQizJiwjNNLp6TDGShed4uvK0iq0d5TQHOV4wqah_jnbuJK-gFuObDCjO_bhwobK9PlO-CmK92s9PueGqpPI_puFGDAS_t4evoyjokLRlaXbql9cGN3d7POdsiXyUYvicVs/s1600/bring.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Bring, Your, Own, Agent:, Your, Employees, Assistants, Are, Already, Logged</media:keywords>
</item>

<item>
<title>Ledger Finds Unauthorized Hardware Implant in CryptoBilis&#45;Sold Wallet Amid Fund Theft Reports</title>
<link>https://teqmanch.com/ledger-finds-unauthorized-hardware-implant-in-cryptobilis-sold-wallet-amid-fund-theft-reports</link>
<guid>https://teqmanch.com/ledger-finds-unauthorized-hardware-implant-in-cryptobilis-sold-wallet-amid-fund-theft-reports</guid>
<description><![CDATA[ Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.

On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4nzJQQovkKtR-dl3ihW4VRAfIxiKwNwwVEHyH06we8iIkQbaxVqhryWIwB9MflLHfBYAd_opklCfnkLxg-GKqB2yt4CisdNcf2lRvOoaYHo9Pa6m1OWatzNsFHmY1ICBH_0P2XX4ykgFE7Gqviz0C0_8J0Qqz36_3gygDyHbot9z5obuYEHunIFsZmPQV/s1600/ledgers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Ledger, Finds, Unauthorized, Hardware, Implant, CryptoBilis-Sold, Wallet, Amid, Fund, Theft, Reports</media:keywords>
</item>

<item>
<title>Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch</title>
<link>https://teqmanch.com/critical-sonicwall-sma-1000-flaw-targeted-in-135-exploitation-attempts-after-patch</link>
<guid>https://teqmanch.com/critical-sonicwall-sma-1000-flaw-targeted-in-135-exploitation-attempts-after-patch</guid>
<description><![CDATA[ Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.

The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker &quot;to direct the appliance to issue requests on their ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglEbu7YOWX4lrTm_x8p2FnL6B7z2hhGC0fKWPBSCVJqTt8l0rbcXFhQinT3ja0sVyx7hObbCQlmem9y4-wsxrwU6mtgsBIJjvH7rgC8n5w8DpEcv7G1N_u4dtOzA3qxVk22FPvly-ZmjsLJKdJqgTsKPtMHpit1oq-fk7jPFN1gTHLeJdF2JQRZ8yuwjxv/s1600/sonics.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Critical, SonicWall, SMA, 1000, Flaw, Targeted, 135, Exploitation, Attempts, After, Patch</media:keywords>
</item>

<item>
<title>Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE</title>
<link>https://teqmanch.com/attackers-exploit-cvss-100-bricksforge-wordpress-flaw-enabling-unauthenticated-rce</link>
<guid>https://teqmanch.com/attackers-exploit-cvss-100-bricksforge-wordpress-flaw-enabling-unauthenticated-rce</guid>
<description><![CDATA[ A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.

The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrKeT1xQm0N8zjNRqWwsoqMm3kESRMqYnUJ9Wy6x9dEKlRVgZYDVqKqhu_2ZT7ZcCNd_RegNu2LtnUUQgL8R2OlK5LTyu9vKaCBRGTVrp05hGdB5wQrxFNi_eHnGxx-8yFR7maKT3tD_WBMVVBSeTyuku392tKdoOHIgvnj1tKQYU_Yq9anT5OKxUun4GW/s1600/wp-php.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Attackers, Exploit, CVSS, 10.0, Bricksforge, WordPress, Flaw, Enabling, Unauthenticated, RCE</media:keywords>
</item>

<item>
<title>CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records</title>
<link>https://teqmanch.com/cyberxero-uses-claude-code-in-campaign-that-stole-over-628000-ukrainian-records</link>
<guid>https://teqmanch.com/cyberxero-uses-claude-code-in-campaign-that-stole-over-628000-ukrainian-records</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.

The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic&#039;s Claude Code, has been attributed ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCjQWPc2H2EsKbjYztfxdp2ffZz6TGQNJ9BuALJB44sWqXbCxEa61fu5CZ4w1rS0llVr3hQP4H_Vg5Fj87Jrs5IoUDpBmochh3rA5bMMr3V4hUT22HTPgLUeX9WhGIQuFm4zF-Kf3zIzSNsQGQlP_gkSSSV-hu5rp5CHX_1T83TOeWsYia_xbuHLlwAxDv/s1600/claude-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>CyberXero, Uses, Claude, Code, Campaign, That, Stole, Over, 628, 000, Ukrainian, Records</media:keywords>
</item>

<item>
<title>P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands</title>
<link>https://teqmanch.com/p7-darksword-ios-exploit-kit-adds-crypto-wallet-data-theft-and-remote-commands</link>
<guid>https://teqmanch.com/p7-darksword-ios-exploit-kit-adds-crypto-wallet-data-theft-and-remote-commands</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.

&quot;Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker&#039;s infrastructure,&quot; iVerify said in a new report published Thursday.

The name ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT-SCb1qpP1Z0zyo_WOtyHzQKUiqJ3RudpC9uowSePmGcLZ9sPHcE-lvDGMZTHeB7YckgDmaBA775L13GvrYHl_gAVSg46-5sUJWzcA7Q3ec5h8WIuKO5l0Td2CCk5nlSvNByqPL22qlTNwHms3rbdXsJYoEe7gRqHiqmM8DHtvEkKniOP4Q70Dq_5Dr8I/s1600/ios.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>DarkSword, iOS, Exploit, Kit, Adds, Crypto, Wallet, Data, Theft, and, Remote, Commands</media:keywords>
</item>

<item>
<title>Ivanti warns of Connect Secure zero&#45;day exploited in attacks</title>
<link>https://teqmanch.com/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks</link>
<guid>https://teqmanch.com/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks</guid>
<description><![CDATA[ Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/10/13/Ivanti.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Ivanti, warns, Connect, Secure, zero-day, exploited, attacks</media:keywords>
</item>

<item>
<title>Docker Hub flaw let attackers impersonate users, tamper with images</title>
<link>https://teqmanch.com/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images</link>
<guid>https://teqmanch.com/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images</guid>
<description><![CDATA[ Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user&#039;s container repositories using a personal access token (PAT). [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/10/13/docker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Docker, Hub, flaw, let, attackers, impersonate, users, tamper, with, images</media:keywords>
</item>

<item>
<title>The MFA Gaps Attackers are Still Exploiting</title>
<link>https://teqmanch.com/the-mfa-gaps-attackers-are-still-exploiting</link>
<guid>https://teqmanch.com/the-mfa-gaps-attackers-are-still-exploiting</guid>
<description><![CDATA[ Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn&#039;t enough and how organizations can close these authentication gaps. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/10/06/specops-mfa-gaps.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>The, MFA, Gaps, Attackers, are, Still, Exploiting</media:keywords>
</item>

<item>
<title>SAP warns of maximum severity OAuth2 SSRF security flaw</title>
<link>https://teqmanch.com/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw</link>
<guid>https://teqmanch.com/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw</guid>
<description><![CDATA[ SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/07/14/SAP.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>SAP, warns, maximum, severity, OAuth2, SSRF, security, flaw</media:keywords>
</item>

<item>
<title>Norway fines Microsoft ad firm $9.6 million over Grindr data sharing</title>
<link>https://teqmanch.com/norway-fines-microsoft-ad-firm-96-million-over-grindr-data-sharing</link>
<guid>https://teqmanch.com/norway-fines-microsoft-ad-firm-96-million-over-grindr-data-sharing</guid>
<description><![CDATA[ Norway&#039;s Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/08/25/0_norway.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Norway, fines, Microsoft, firm, 9.6, million, over, Grindr, data, sharing</media:keywords>
</item>

<item>
<title>Yandex confirms service outage as users lose access to cloud files</title>
<link>https://teqmanch.com/yandex-confirms-service-outage-as-users-lose-access-to-cloud-files</link>
<guid>https://teqmanch.com/yandex-confirms-service-outage-as-users-lose-access-to-cloud-files</guid>
<description><![CDATA[ Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/10/12/Yandex.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Yandex, confirms, service, outage, users, lose, access, cloud, files</media:keywords>
</item>

<item>
<title>Anthropic takes risky AI tests offline after models breach govt sites</title>
<link>https://teqmanch.com/anthropic-takes-risky-ai-tests-offline-after-models-breach-govt-sites</link>
<guid>https://teqmanch.com/anthropic-takes-risky-ai-tests-offline-after-models-breach-govt-sites</guid>
<description><![CDATA[ Anthropic announced that its internal AI models undergoing &quot;high-risk and cybersecurity evaluations&quot; no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/10/12/anthropic.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Anthropic, takes, risky, tests, offline, after, models, breach, govt, sites</media:keywords>
</item>

<item>
<title>Ledger confirms spy chip implant behind wallet crypto thefts</title>
<link>https://teqmanch.com/ledger-confirms-spy-chip-implant-behind-wallet-crypto-thefts</link>
<guid>https://teqmanch.com/ledger-confirms-spy-chip-implant-behind-wallet-crypto-thefts</guid>
<description><![CDATA[ Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users&#039; cryptocurrency wallets. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/10/12/Ledger.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Ledger, confirms, spy, chip, implant, behind, wallet, crypto, thefts</media:keywords>
</item>

<item>
<title>Cyberattack shuts down refrigerators at French supermarkets</title>
<link>https://teqmanch.com/cyberattack-shuts-down-refrigerators-at-french-supermarkets</link>
<guid>https://teqmanch.com/cyberattack-shuts-down-refrigerators-at-french-supermarkets</guid>
<description><![CDATA[ Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/10/13/empty-supermarket-shelves.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Cyberattack, shuts, down, refrigerators, French, supermarkets</media:keywords>
</item>

<item>
<title>Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption</title>
<link>https://teqmanch.com/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption</link>
<guid>https://teqmanch.com/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption</guid>
<description><![CDATA[ A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/10/08/avisloader.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 13 Oct 2026 21:40:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Inside, AvisLoader:, Windows, Malware, Loader, Built, Resist, Disruption</media:keywords>
</item>

<item>
<title>MI5 Says China’s MSS Funded Research Involving 100+ U.K.&#45;Linked Academics</title>
<link>https://teqmanch.com/mi5-says-chinas-mss-funded-research-involving-100-uk-linked-academics</link>
<guid>https://teqmanch.com/mi5-says-chinas-mss-funded-research-involving-100-uk-linked-academics</guid>
<description><![CDATA[ The U.K.&#039;s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering efforts on behalf of Beijing&#039;s state security service.

In a &quot;Security Service Espionage Alert&quot; issued on September 30, 2026, MI5 said the &quot;primary purpose of the China General Technology Research Institute (CGTRI) 中国通用技术研究院 is to fund research that ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8KoVLnFX9RE7BlsBeUJOBw_ZTBGsbwsb8-BY7UjzndcwMCcGmakXl6gOYzYAf_D46lO0rs6ud3i8PmehY4hbb4B8lcXCMUj4UtcZpzaox7_y3waVRwVPmRYvOd-dB5AaIXL3lmBAkQp0ZIwcES5__hiZlqeoqkp0IjqjRWe2mUUY1HiYVYVtK7bs9oPYJ/s1600/china-fund.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>MI5, Says, China’s, MSS, Funded, Research, Involving, 100, U.K.-Linked, Academics</media:keywords>
</item>

<item>
<title>Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware</title>
<link>https://teqmanch.com/warlock-exploits-sharepoint-flaws-to-disable-security-tools-and-deploy-ransomware</link>
<guid>https://teqmanch.com/warlock-exploits-sharepoint-flaws-to-disable-security-tools-and-deploy-ransomware</guid>
<description><![CDATA[ The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries.

The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations.

&quot;In the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCZSaqs29yWFrct8zgOikM9e4CS0xuAXppzGJ1tskKpKC2gbGuITsYlHYNcnXDMvrFpPuAVS_ZlyEF8Obp7Mgw7CUXe4UsKP3pNEvZWNfszKQVxogslYpoWBZG-QQbEvmS6SDcbgVtXiFFGIEjreD_HSkCYZTfcwL1Rt90qDbbPj946SbMX0FR5CEKRt_H/s1600/sharepoint-ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Warlock, Exploits, SharePoint, Flaws, Disable, Security, Tools, and, Deploy, Ransomware</media:keywords>
</item>

<item>
<title>The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations</title>
<link>https://teqmanch.com/the-state-of-cybersecurity-in-2026key-segments-insights-and-innovations</link>
<guid>https://teqmanch.com/the-state-of-cybersecurity-in-2026key-segments-insights-and-innovations</guid>
<description><![CDATA[ Featuring:

Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale.

This report examines how core areas of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT6JJFsgFmlQyQC0ZFye5jB8OydQuNv7BQYFdVh0meweGiJD5bXisFLalhMTHPTfkPkbOewEeAepAz9Pd1mOIRy_1q67d4J-ougj5reZ4j9PjmpzIgk7wAr8HGlY4Mk8o3js2s_6Wpa0z4IC55ozyl4Yc60OEFjU1U8FXz8562V3IYFnoikN16KsrVu1w/s1600/py-report.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>The, State, Cybersecurity, 2026: Key, Segments, Insights, and, Innovations</media:keywords>
</item>

<item>
<title>GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self&#45;Hosted Servers</title>
<link>https://teqmanch.com/gitlab-patches-critical-99-ai-gateway-flaw-allowing-command-execution-on-self-hosted-servers</link>
<guid>https://teqmanch.com/gitlab-patches-critical-99-ai-gateway-flaw-allowing-command-execution-on-self-hosted-servers</guid>
<description><![CDATA[ A critical flaw in GitLab&#039;s AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory.

The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1.

The flaw ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXhnbLdlAtkMBrrXYLiOxfbEdXI4PrEIq6dy3SL8Xa5SzPF6if9sf8GGu4PtkUTI3EYQHqBde4cDp4Y60OjgQBmqtZHTlL_gvgvlxNSeZ6nrRnriOmH3m23vq7f2bpylilVl39c_X-RNpvYQlRrC91gU_oHbk6e_ZbZ-7_fglpsQCFoLFp3sHkcn44960/s1600/gitlab-rce.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>GitLab, Patches, Critical, 9.9, Gateway, Flaw, Allowing, Command, Execution, Self-Hosted, Servers</media:keywords>
</item>

<item>
<title>Antino Backdoor Uses Outlook and OneDrive for C2 in China&#45;Nexus Espionage Campaign</title>
<link>https://teqmanch.com/antino-backdoor-uses-outlook-and-onedrive-for-c2-in-china-nexus-espionage-campaign</link>
<guid>https://teqmanch.com/antino-backdoor-uses-outlook-and-onedrive-for-c2-in-china-nexus-espionage-campaign</guid>
<description><![CDATA[ Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor.

The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor codenamed Antino. Cisco Talos is tracking the cluster ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjE3s79KuB4kHE3Kf6kjA84HqdcQ2TTVyJCgIkLcSnpbMr6vCwjaLjJVE1KiXT2lZfcx_CbKlHjiX9PrEppf53uaTvQ_Vyicl447mGIkdz1ZOzmGR1hPJzgODM2J_lnsbKPhTBvvTgdDcSS4V1JzJ-feSpyJFDyDkKS0BfK7AXTCNWaL9DZ60tmWVysyVo0/s1600/ms-cyber.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Antino, Backdoor, Uses, Outlook, and, OneDrive, for, China-Nexus, Espionage, Campaign</media:keywords>
</item>

<item>
<title>Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes</title>
<link>https://teqmanch.com/dell-csm-flaws-enable-unauthenticated-admin-access-and-root-on-kubernetes-nodes</link>
<guid>https://teqmanch.com/dell-csm-flaws-enable-unauthenticated-admin-access-and-root-on-kubernetes-nodes</guid>
<description><![CDATA[ Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors to take over susceptible systems.

The vulnerabilities are listed below -


  CVE-2026-63688 (CVSS score: 10.0) - A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiypcfC3W6keUc31zSJympZfpI6eLwDhyphenhyphen4uy_0M3VFljfoSn2pjzBmS3yyAZTzILPxi_sXeOx2jyeu6mdSPKqjiFv7LAMd2mn6Q8GvIRq6yVXUoQm5MiXeEs96i9IT-ZCP2W7hAzR08B9JOuOJv8NNI7o7DfCSa7cplzrsT_x_0R0dPVSQxKmdLP8NvAsnp/s1600/dell.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Dell, CSM, Flaws, Enable, Unauthenticated, Admin, Access, and, Root, Kubernetes, Nodes</media:keywords>
</item>

<item>
<title>OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling</title>
<link>https://teqmanch.com/openai-parts-ways-with-three-safety-researchers-over-sensitive-information-mishandling</link>
<guid>https://teqmanch.com/openai-parts-ways-with-three-safety-researchers-over-sensitive-information-mishandling</guid>
<description><![CDATA[ OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street Journal reported.

&quot;We have parted ways with three individuals for violating our policies on accessing and handling sensitive company information,&quot; a spokesperson for the company was quoted as saying. &quot;Our investigation confirmed that these ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvjuuIAEhjBjrbXQna97zki-AKSZ9hVcu2CHSFRronvsVxEcHsfg66bldy7UzBETlNj1wTjKhkE11aFSmOxTjmR-XVp7qwzM2rBM745vy0Jy2n_CDoWQowbrzcQ7pVMubxWXNxVhOptHQiV5nMSGf24ZpI2wdpr40A0ez16cO3IH6peI6A2L07_UuOHbaJ/s1600/openai-servers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>OpenAI, Parts, Ways, With, Three, Safety, Researchers, Over, Sensitive, Information, Mishandling</media:keywords>
</item>

<item>
<title>Why CISOs Struggle to Answer the Board&amp;apos;s Three Hardest Questions, and How to Fix the Report</title>
<link>https://teqmanch.com/why-cisos-struggle-to-answer-the-boards-three-hardest-questions-and-how-to-fix-the-report</link>
<guid>https://teqmanch.com/why-cisos-struggle-to-answer-the-boards-three-hardest-questions-and-how-to-fix-the-report</guid>
<description><![CDATA[ The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides.

Then a board member asks three questions:


  How secure is the organization, overall?
  What is ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0hKMtHvRqPQiVRgaUAvYQ1XOUA_EToiZ3Tx-v7pSvbqwlnoo7qr5jQ_5KJuYpRFW0MzE3bLPePNT-rn4m8bEz7eTMVysO0OcfFwNKKFgKIo6tiT0JKKauf9MFxYTet3LiqJ2lXxfxVuKzRIPloaGR-_bOUEXOz_-ONc3AXfHKZV-PhAW8wEfayC-iwZE/s1600/ciso-ready.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Why, CISOs, Struggle, Answer, the, Boards, Three, Hardest, Questions, and, How, Fix, the, Report</media:keywords>
</item>

<item>
<title>Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools</title>
<link>https://teqmanch.com/android-17-advanced-protection-locks-accessibility-services-to-verified-accessibility-tools</link>
<guid>https://teqmanch.com/android-17-advanced-protection-locks-accessibility-services-to-verified-accessibility-tools</guid>
<description><![CDATA[ Google has announced a new security measure that limits access to Android&#039;s accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled.

With malicious Android applications abusing the API serving as the main conduit for malware and financial fraud, the tech giant said the move would block a major attack pathway. Advanced Protection is a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5MS0sgdeAX_o_HWccABZaieMupy9x1vp2YHXeUfCod9bQMOAfEufGcm59eXhz4cQnwur_AjUhL1ER6FkR4nacwK2pn8K8ojfyZ254B_1Jfjk1OXwBi4VzqhPXgHukmnvVP5ItRHUeez8TcJVXvPlXRBIj0-h6YrI0rhn1G6RFyeZPT9jJf6y4Ng8D_1OD/s1600/android17.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Android, Advanced, Protection, Locks, Accessibility, Services, Verified, Accessibility, Tools</media:keywords>
</item>

<item>
<title>Critical FortiMail Zero&#45;Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes</title>
<link>https://teqmanch.com/critical-fortimail-zero-day-flaw-exploited-in-attacks-allows-unauthenticated-arbitrary-file-writes</link>
<guid>https://teqmanch.com/critical-fortimail-zero-day-flaw-exploited-in-attacks-allows-unauthenticated-arbitrary-file-writes</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.

The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.

&quot;An improper ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhcZguz-U3FsSD6t4YQ45EeFbgnWAy9lM28OAFydsLXZYzOS00aOD7pxUZcgvLMfMAO3SJV_Amu9SoNezLNQOvx823Z92CpqC5ow9XO3d7HJhEKZlwQt4H4Z7kirDwGcSrUyi1ONs_PuULNYjEjzae2c1mncDviOT9iqxD-PhmXCYpulTUNO2rtW5c9AAx/s1600/fortimail.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Critical, FortiMail, Zero-Day, Flaw, Exploited, Attacks, Allows, Unauthenticated, Arbitrary, File, Writes</media:keywords>
</item>

<item>
<title>Police Arrest 16&#45;Year&#45;Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers</title>
<link>https://teqmanch.com/police-arrest-16-year-old-suspected-of-running-killsec-seize-ransomware-leak-site-and-servers</link>
<guid>https://teqmanch.com/police-arrest-16-year-old-suspected-of-running-killsec-seize-ransomware-leak-site-and-servers</guid>
<description><![CDATA[ Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid.

The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site.

Investigators identified him as KillSec&#039;s suspected ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy6XYYOXNZNjc51viw5FvCk49pWIXCCRS6yr_hl0ZKdwhBWRfYrCQ7bM6AJZJdmI_W3AEz1V3X0DAP6k39KfgjlKFfB5JcFaKN9zzIl1-7c49Vnuaz55yhRXjdmY5K2kIPuY_-7624KyVHqkHzikJIi11iClljnXv_3i2X21JiRCMU8ElmiHiZdHVQ7ws/s1600/killsec-ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Police, Arrest, 16-Year-Old, Suspected, Running, KillSec, Seize, Ransomware, Leak, Site, and, Servers</media:keywords>
</item>

<item>
<title>ThreatsDay: AI&#45;Powered Zero&#45;Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories</title>
<link>https://teqmanch.com/threatsday-ai-powered-zero-day-chain-543k-live-secrets-model-inspection-rce-and-13-more-stories</link>
<guid>https://teqmanch.com/threatsday-ai-powered-zero-day-chain-543k-live-secrets-model-inspection-rce-and-13-more-stories</guid>
<description><![CDATA[ This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years.

That is the lesson running through the list. Attackers do not always need a brilliant new trick. They can ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOZPv0LS8-qPBgL_d1m8BLNikw8psPt9qtB_HiFNoYnVwBacYvwz4DdEixukdlHcy7IXmUB9dI9E_Hcx48HJIL7sQzmDeextP-Y_tHO9SX51i_SditMkVsRgWxyMekufW3yZFn2jI9nf29y3JEM2a_yFv8iTLDb6d3r1roNsea_Yk5TWCiMcvkmE5ZbP6B/s1600/oct-threatsday.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>ThreatsDay:, AI-Powered, Zero-Day, Chain, 543K, Live, Secrets, Model, Inspection, RCE, and, More, Stories</media:keywords>
</item>

<item>
<title>WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory</title>
<link>https://teqmanch.com/wordpress-backdoor-rebuilds-itself-after-cleanup-using-files-database-and-shared-memory</link>
<guid>https://teqmanch.com/wordpress-backdoor-rebuilds-itself-after-cleanup-using-files-database-and-shared-memory</guid>
<description><![CDATA[ Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again.

The backdoor has been codenamed SC after the &quot;SC_&quot; markers present in the injected content. Sucuri has described the malware as a &quot;self-healing mesh&quot; that&#039;s ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbdAzWwJ7WC6PL7vtBZDUWfVyYu9iIBlT3X5gZn-Yl9aRuZAEeW3RjEU81RQWsvH_7og6v7-somVgG-fR35drKy6bxLMcHdpJQAi6ydXw-m3oMxZ1hlDC7kr8Wsu0dOfRt6ZLEasAsYNGq-pzmQiBNWMbEBzqa9zYdAu16NtgIfDe3PpOvCVzGj6yFqmet/s1600/wordpress-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>WordPress, Backdoor, Rebuilds, Itself, After, Cleanup, Using, Files, Database, and, Shared, Memory</media:keywords>
</item>

<item>
<title>How Financial Services Companies Can Modernize Their Software Supply Chain</title>
<link>https://teqmanch.com/how-financial-services-companies-can-modernize-their-software-supply-chain</link>
<guid>https://teqmanch.com/how-financial-services-companies-can-modernize-their-software-supply-chain</guid>
<description><![CDATA[ Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else raises the change-freeze calendar. The finding gets an exception, a compensating control, and a date ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwJsDvv_9QEV86mmDsIBPpGS2Kt2o8WPu2L6kUb9IExDqX-2lDKksEMMJp3NqFwDUqplX6JCeUpJfI_8rt_febX1CjMorRii_RpDccPPynWQHW_abdrNSWj774Ad0XH-RmiP-Lzki-Btsu6mh1cUsIffeSIOfUQ29qEJJwBTsaL-olM3GK18D2LYoxJlg/s1600/chain.png.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>How, Financial, Services, Companies, Can, Modernize, Their, Software, Supply, Chain</media:keywords>
</item>

<item>
<title>OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates</title>
<link>https://teqmanch.com/openai-disrupts-reasoning-extraction-campaign-linked-to-moonshot-ai-associates</link>
<guid>https://teqmanch.com/openai-disrupts-reasoning-extraction-campaign-linked-to-moonshot-ai-associates</guid>
<description><![CDATA[ OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models.

A &quot;core cluster of the activity,&quot; going back to the first week of July, has been attributed to individuals associated with Moonshot AI, a Chinese AI company based in Beijing. It did not cite any ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVoOullmVukPDhwbQ10zXHA-IqDVeMp55dybdLAhT-kkPDdJADbw8BETggWjHN3WF4HHpXLV8RDk4jHLVYlS9wWxZcbHMtEGGfGu-dGv2lFRzv3lJ1csgozieAguSQeE2Nhw5ZXBi1YIjaBbF5Al_kakh4wNXfjr4PJ-Q4QZxaHm4_Lha_aMxdQ3NPKRm0/s1600/moonshot.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>OpenAI, Disrupts, Reasoning, Extraction, Campaign, Linked, Moonshot, Associates</media:keywords>
</item>

<item>
<title>Google Gemini could soon get full access to your Mac’s files, apps and the web</title>
<link>https://teqmanch.com/google-gemini-could-soon-get-full-access-to-your-macs-files-apps-and-the-web</link>
<guid>https://teqmanch.com/google-gemini-could-soon-get-full-access-to-your-macs-files-apps-and-the-web</guid>
<description><![CDATA[ Google&#039;s Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/08/13/Gemini.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Google, Gemini, could, soon, get, full, access, your, Mac’s, files, apps, and, the, web</media:keywords>
</item>

<item>
<title>ShinyHunters hacker reportedly detained in Jordan, aiding FBI</title>
<link>https://teqmanch.com/shinyhunters-hacker-reportedly-detained-in-jordan-aiding-fbi</link>
<guid>https://teqmanch.com/shinyhunters-hacker-reportedly-detained-in-jordan-aiding-fbi</guid>
<description><![CDATA[ A suspected ShinyHunters hacking group member known online as &quot;Rey&quot; has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/01/25/Hacker_prison.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>ShinyHunters, hacker, reportedly, detained, Jordan, aiding, FBI</media:keywords>
</item>

<item>
<title>Danish university DTU breach exposes data of up to 200,000 people</title>
<link>https://teqmanch.com/danish-university-dtu-breach-exposes-data-of-up-to-200000-people</link>
<guid>https://teqmanch.com/danish-university-dtu-breach-exposes-data-of-up-to-200000-people</guid>
<description><![CDATA[ The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/10/03/DTU.png" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Danish, university, DTU, breach, exposes, data, 200, 000, people</media:keywords>
</item>

<item>
<title>Frontline Education breach exposes school district employee data</title>
<link>https://teqmanch.com/frontline-education-breach-exposes-school-district-employee-data</link>
<guid>https://teqmanch.com/frontline-education-breach-exposes-school-district-employee-data</guid>
<description><![CDATA[ Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/10/15/School-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Frontline, Education, breach, exposes, school, district, employee, data</media:keywords>
</item>

<item>
<title>Warlock ransomware breach SharePoint in water, telecom operator attacks</title>
<link>https://teqmanch.com/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks</link>
<guid>https://teqmanch.com/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks</guid>
<description><![CDATA[ The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/08/26/Microsoft-SharePoint.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Warlock, ransomware, breach, SharePoint, water, telecom, operator, attacks</media:keywords>
</item>

<item>
<title>GitLab warns of critical RCE vulnerability in AI Gateway service</title>
<link>https://teqmanch.com/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service</link>
<guid>https://teqmanch.com/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service</guid>
<description><![CDATA[ GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/14/GitLab.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>GitLab, warns, critical, RCE, vulnerability, Gateway, service</media:keywords>
</item>

<item>
<title>US sanctions Tren de Aragua gang members in ATM hacks crackdown</title>
<link>https://teqmanch.com/us-sanctions-tren-de-aragua-gang-members-in-atm-hacks-crackdown</link>
<guid>https://teqmanch.com/us-sanctions-tren-de-aragua-gang-members-in-atm-hacks-crackdown</guid>
<description><![CDATA[ The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/01/09/US_Treasury.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>sanctions, Tren, Aragua, gang, members, ATM, hacks, crackdown</media:keywords>
</item>

<item>
<title>The EDR blind spot: 3 ways browser attacks evade endpoint telemetry</title>
<link>https://teqmanch.com/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry</link>
<guid>https://teqmanch.com/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry</guid>
<description><![CDATA[ Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/27/nord-radar-header.png" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>The, EDR, blind, spot:, ways, browser, attacks, evade, endpoint, telemetry</media:keywords>
</item>

<item>
<title>Dell asks admins to patch max severity CSM flaws as soon as possible</title>
<link>https://teqmanch.com/dell-asks-admins-to-patch-max-severity-csm-flaws-as-soon-as-possible</link>
<guid>https://teqmanch.com/dell-asks-admins-to-patch-max-severity-csm-flaws-as-soon-as-possible</guid>
<description><![CDATA[ Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/05/14/Dell.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Dell, asks, admins, patch, max, severity, CSM, flaws, soon, possible</media:keywords>
</item>

<item>
<title>Microsoft’s X account hacked in crypto pump&#45;and&#45;dump scheme</title>
<link>https://teqmanch.com/microsofts-x-account-hacked-in-crypto-pump-and-dump-scheme</link>
<guid>https://teqmanch.com/microsofts-x-account-hacked-in-crypto-pump-and-dump-scheme</guid>
<description><![CDATA[ On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/10/02/Microsoft-X.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 04 Oct 2026 10:58:36 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft’s, account, hacked, crypto, pump-and-dump, scheme</media:keywords>
</item>

<item>
<title>French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks</title>
<link>https://teqmanch.com/french-tax-data-theft-using-stolen-staff-passwords-went-undetected-for-seven-weeks</link>
<guid>https://teqmanch.com/french-tax-data-theft-using-stolen-staff-passwords-went-undetected-for-seven-weeks</guid>
<description><![CDATA[ An attacker used stolen passwords of staff at France&#039;s tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July.

Neither the tax administration nor France&#039;s national cybersecurity agency saw the data leave. The attack was not sophisticated, the agency, ANSSI, says in a report (in French) published on Tuesday: it worked because of weak ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9h550xeoGqzMnMqY6B6Ejo9xeSvbx4fnnu1OmLWvhYAvYeLNB1zeik8F8yYB82oW685qieusoRaI27P68ugA34Vg0720ZZdLfQUJtuIjxkUYRgq_hQtivtsopRYYoddpwb4mICLERqQrVKtZv5EHg78rU14dlQmgevB0KsOR0ePvG4E8cpqKB1TyliaE/s1600/france.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>French, Tax, Data, Theft, Using, Stolen, Staff, Passwords, Went, Undetected, for, Seven, Weeks</media:keywords>
</item>

<item>
<title>New Spectre&#45;v2 BTR Attack Leaks Linux Memory Despite Existing Defenses</title>
<link>https://teqmanch.com/new-spectre-v2-btr-attack-leaks-linux-memory-despite-existing-defenses</link>
<guid>https://teqmanch.com/new-spectre-v2-btr-attack-leaks-linux-memory-despite-existing-defenses</guid>
<description><![CDATA[ A group of academics from VUSec and Scuola Superiore Sant&#039;Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors.

The new Spectre-v2 variant has been codenamed Branch Target Reuse (BTR).

&quot;The key insight is that, while modern CPUs ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCNHT9zDz8oOamcA5EH8a3KGAtk9R9bE_UxGY_uPThgxZJu9vX-YG1olbgiX5WBVdwDd52LpDfSyryC6GZ45tUi2bKLe_aWnbj0Ir3WQZeGYF8Vr7U7icoPn4tcuwfpOZagVfry-KG5_jzLPb-fbPiFBlv142UOgqAPpC193t6BslvCE1l1XWo2z5_mFYV/s1600/linux-intel.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>New, Spectre-v2, BTR, Attack, Leaks, Linux, Memory, Despite, Existing, Defenses</media:keywords>
</item>

<item>
<title>Russia&amp;apos;s Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor</title>
<link>https://teqmanch.com/russias-star-blizzard-targets-100-organizations-with-fake-event-invites-to-deliver-backdoor</link>
<guid>https://teqmanch.com/russias-star-blizzard-targets-100-organizations-with-fake-event-invites-to-deliver-backdoor</guid>
<description><![CDATA[ Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft.

The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K. At least one computer was infected, but the number of breached ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQDuuJUT-WU7XzUYYoKEDtFKt7QAra8I4G0ptQRyveku8G6fD6R0aSWw32hi-2fd0L28qUxjqJoTlQoJbLiBYH6NBOVYirQZ9LfH-UvD8JG5uiL_m4ZkBVnPLiArcivCsdMNegW1XGxFEzas4cwkzFVeY4r22qTqSp2U1Fo3Nw7urOlnWRKGFHW8pW91E/s1600/ms-invite.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Russias, Star, Blizzard, Targets, 100, Organizations, With, Fake, Event, Invites, Deliver, Backdoor</media:keywords>
</item>

<item>
<title>Kiteworks Fixes Critical Flaw Found During Nine&#45;Hour Precautionary Shutdown</title>
<link>https://teqmanch.com/kiteworks-fixes-critical-flaw-found-during-nine-hour-precautionary-shutdown</link>
<guid>https://teqmanch.com/kiteworks-fixes-critical-flaw-found-during-nine-hour-precautionary-shutdown</guid>
<description><![CDATA[ Kiteworks on Monday said it worked with federal intelligence authorities over the weekend as it identified and addressed a critical security vulnerability during the scheduled precautionary shutdown.

&quot;During the shutdown, this activity led to the discovery of a previously unknown critical vulnerability confined to a capability that is enabled for less than 1% of the customer base,&quot; the company ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjv9oZ7uWtniIGlzNM3FXdS2v4WjdHi8ajTw0evMWbzhC9ihnkOwrxAqV7sgJou4SMDrJo2z5uDOQPRX1Bb0Hx1P1Str7iZQ4wssATmqsb6o0IfOPafzmnX6UXgkweBDB_QKqBVJZsNdMibEvAykjIzluSiJEnxnhFehzw-q2bhZ7heCFv97on69dZMjPrb/s1600/kiteworks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Kiteworks, Fixes, Critical, Flaw, Found, During, Nine-Hour, Precautionary, Shutdown</media:keywords>
</item>

<item>
<title>101 Malicious npm Packages Add Developers&amp;apos; WhatsApp Accounts to Groups Without Consent</title>
<link>https://teqmanch.com/101-malicious-npm-packages-add-developers-whatsapp-accounts-to-groups-without-consent</link>
<guid>https://teqmanch.com/101-malicious-npm-packages-add-developers-whatsapp-accounts-to-groups-without-consent</guid>
<description><![CDATA[ Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed PhantomSub.

&quot;The malicious packages abuse the &#039;Baileys&#039; WhatsApp open source project to add the victims to groups without their consent,&quot; OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko said in a technical ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhUmW5o4XCEsBlPE2MKecTG-IHCrk1WHeLajiNnRTpGtT-DDhpYVID3Pon7cseFiJN24GulDnjR7TPRe6h-kQEuJBPRl87atgBytMvKbiRV4h_DHWtxQEtogyy3U-aAD6ErNCrYiOQV-tHvHcw_P4W8z37PpR-jo70sePvtLIvMwKx7MJuE8Fazhyphenhyphen7_KI5/s1600/npm-whatsapp.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>101, Malicious, npm, Packages, Add, Developers, WhatsApp, Accounts, Groups, Without, Consent</media:keywords>
</item>

<item>
<title>Dutch Police Arrest 24&#45;Year&#45;Old Amsterdam Man in ShinyHunters Investigation</title>
<link>https://teqmanch.com/dutch-police-arrest-24-year-old-amsterdam-man-in-shinyhunters-investigation</link>
<guid>https://teqmanch.com/dutch-police-arrest-24-year-old-amsterdam-man-in-shinyhunters-investigation</guid>
<description><![CDATA[ Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group.

&quot;It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters,&quot; the Politie Landelijke Opsporing en Interventies said in an X post Monday.

Police said the individual is expected to appear before the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWsGNpV8Y5_YLcyxRYju8E3caiN3I3Zttrlvxhz5iXfzVIR_Ayp_d_Zn2Wk12ZBkz5nW4eYfKeEs-xxs9kYuS_paAwO3wJleeUxdMRbrbU_lXwWVuG7ajiFH0UOEcoj3almps5b54DXt-mGy73GhXjCQzGsNNDJkhdfJXRI9XWeFF5hfsr4zjQty-Wued5/s1600/1000111943.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Dutch, Police, Arrest, 24-Year-Old, Amsterdam, Man, ShinyHunters, Investigation</media:keywords>
</item>

<item>
<title>Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials</title>
<link>https://teqmanch.com/official-mcp-python-sdk-flaw-can-let-malicious-servers-steal-oauth-credentials</link>
<guid>https://teqmanch.com/official-mcp-python-sdk-flaw-can-let-malicious-servers-steal-oauth-credentials</guid>
<description><![CDATA[ A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK&#039;s maintainers said in a security advisory.

Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the attacker controlled. The fix is in versions 1.30.0 and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2N5owhsoQXHTQV74afwfngdyitjwcW37BHLX2QKkq6xZAxP8_AOXAh1ODPj5DyvvmMUq3mKH9eR2B1r7owc6djzLViK2U4BY_hw3rTWmaHjhFEyyh8LPlUMPZ7MdWkqN7bjtQyMByBLrsI5m0mAU9y-IbrsAe9OPhZXHN63AWwuv_1OB5MSrpRdVZ9CM/s1600/mcp-python.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Official, MCP, Python, SDK, Flaw, Can, Let, Malicious, Servers, Steal, OAuth, Credentials</media:keywords>
</item>

<item>
<title>OpenAI Shelves GPT&#45;6.1 Astra After Tests Find Deception and Unauthorized Actions</title>
<link>https://teqmanch.com/openai-shelves-gpt-61-astra-after-tests-find-deception-and-unauthorized-actions</link>
<guid>https://teqmanch.com/openai-shelves-gpt-61-astra-after-tests-find-deception-and-unauthorized-actions</guid>
<description><![CDATA[ OpenAI on Monday shelved plans to release GPT-6.1 Astra, a next-generation artificial intelligence (AI) model that was planned for an October launch, after it failed internal safety and alignment audits.

The development was first reported by The Wall Street Journal. The move &quot;marks a rare case of a major AI developer ditching a new release because of safety concerns,&quot; the news publication said. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeiHpQjvEicRlkD9F-pR6I5h9MLRWRtX0Wd84u8ThZ5XIsZ-TZwHjTyXj93Z6GV0-5MNhAO2bCQCGfMHuoW7-0ovwpXFwxTy-gvBNJ3iCrlDjBAimAS-ayH7ZfzIL9kzMaV5Wn8FwBR17ehonB72Yvweyp4msb6uPEZxvnEj0QDMF2BDFYkPfU9_GGakFi/s1600/astra.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>OpenAI, Shelves, GPT-6.1, Astra, After, Tests, Find, Deception, and, Unauthorized, Actions</media:keywords>
</item>

<item>
<title>OpenAI Pauses Tool Use After Agent Bypasses Internet Controls to Reach External Chatbot</title>
<link>https://teqmanch.com/openai-pauses-tool-use-after-agent-bypasses-internet-controls-to-reach-external-chatbot</link>
<guid>https://teqmanch.com/openai-pauses-tool-use-after-agent-bypasses-internet-controls-to-reach-external-chatbot</guid>
<description><![CDATA[ OpenAI said it has made the decision to pause training of its most powerful models after one of its agents during reinforcement learning (RL) training contacted an external chatbot by exploiting a loophole in its internet-access restrictions.

&quot;An agent attempting to complete a search-based training task queried a public chatbot service through a gap in our internet-access restrictions: ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2NfY2zvkkU95qQwwR7N_yQQf_H2AjYcXccbK2yH7xzzeAqmu3mH9ItszzC14M2suvDnfz6EBB-QzMkCTUBIgaoX9teGfhmBIBvU9R-wsKQBcC90f5lytvP-hYfCy8o-YTDTh8rIqz8mj1NIikN27BE2vsWyaRgiKPeAe3zbmrkdy6Dkg8htztnoyJwS4o/s1600/openai-chatbot.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>OpenAI, Pauses, Tool, Use, After, Agent, Bypasses, Internet, Controls, Reach, External, Chatbot</media:keywords>
</item>

<item>
<title>Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks</title>
<link>https://teqmanch.com/apple-patches-coregraphics-flaw-possibly-exploited-in-targeted-attacks</link>
<guid>https://teqmanch.com/apple-patches-coregraphics-flaw-possibly-exploited-in-targeted-attacks</guid>
<description><![CDATA[ Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.

The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file.

The iPhone maker said the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO5I5gnKOqAs0ZCjgQnQirUHdSjRqGZRMp-Fioy684EzZWuQm72wSrCW1hWZEYlvvOXoCtkQyr3sB48AoZ71PM6tMCsz_AGZmEYZz8u2AbrH1gpjutU-mFtDQpuJcI_pKEG9q4-cZEo7T3Yp7hyphenhyphen4_MCZvloRnVKszE7rjTDUKZBaH1eQ47-K0fPno50T3S/s1600/apple-0day.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Apple, Patches, CoreGraphics, Flaw, Possibly, Exploited, Targeted, Attacks</media:keywords>
</item>

<item>
<title>Hackers Use NeedyMantis to Maintain Long&#45;Term Access in Breached Networks</title>
<link>https://teqmanch.com/hackers-use-needymantis-to-maintain-long-term-access-in-breached-networks</link>
<guid>https://teqmanch.com/hackers-use-needymantis-to-maintain-long-term-access-in-breached-networks</guid>
<description><![CDATA[ Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis.

The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Its use goes back to at least ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJgqNtFBBtX_6em5nY1VC9Q4M6HMG7gzxiQspFHsQRfQgm3LK5kTsHi-9SbwEx8kaeVv7BtKGFq3u1SmTGFEOe0z78fxFCxRFVEb09v0FMZ5tT-FNl7sUBnsGPPpDlAaQh4E_CSQQnwFakxNll2AvKiBvidb9ljEatmOzdJV4T4z8r5lmYG3DINHy-wR0/s1600/hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Hackers, Use, NeedyMantis, Maintain, Long-Term, Access, Breached, Networks</media:keywords>
</item>

<item>
<title>IAM for AI agents: A Practical Enterprise Framework</title>
<link>https://teqmanch.com/iam-for-ai-agents-a-practical-enterprise-framework</link>
<guid>https://teqmanch.com/iam-for-ai-agents-a-practical-enterprise-framework</guid>
<description><![CDATA[ What is IAM for AI agents?

AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of conventional provisioning, the components that matter, how to evaluate framework choices, and what runtime evidence proves an agent behaved as intended. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5iI5XAgqXDB1IvqmdWgs2QFGVb5cAbMuJgwtgpKwvRtamF2xs9Od5F4Xwv7JhH8HC0yDOUx1ErLjZaeOBSu8mkCR3ewFb3x3VTV-IFbfXwUR2Pzoqf6_JKFq9de2wf1enmkMSK8M5QU2FBGovMkMkhLzI2qV90LuQYTgdMW-ymc5zxrv_yieHXBUr4Ck/s1600/OR.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>IAM, for, agents:, Practical, Enterprise, Framework</media:keywords>
</item>

<item>
<title>Bitget Says Attacker Exploited Third&#45;Party Security Product Flaw to Steal $388M</title>
<link>https://teqmanch.com/bitget-says-attacker-exploited-third-party-security-product-flaw-to-steal-388m</link>
<guid>https://teqmanch.com/bitget-says-attacker-exploited-third-party-security-product-flaw-to-steal-388m</guid>
<description><![CDATA[ The attacker who stole about $388 million from the cryptocurrency exchange Bitget gained access through a vulnerability in a third-party security product the exchange used, Bitget said on Monday.

The attacker exploited the flaw to obtain high-level internal credentials and then, on September 24, used them to send fraudulent withdrawal commands to Bitget&#039;s wallet system.

Exchanges keep most ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgA8s-yMULxIXnKcHnHw7w1dF9pt58MDYc_-_wfJPo8ifPgGoD0GZcgE408ZdC1GbZvjp2wOOEYrlR8obpFEXZ-KUSjIBXFFb3LcswKfAd3EODISE5hSkU-QplYeZDnK95i0QrJhNZKcKEVgedmkKjAme9PV4vDLV-OY7Bh9KhCINbGuglY49greoPLCJQ/s1600/bitget-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Bitget, Says, Attacker, Exploited, Third-Party, Security, Product, Flaw, Steal, 388M</media:keywords>
</item>

<item>
<title>RatHat Android Malware Console Uses Gemini to Identify Higher&#45;Value Victims</title>
<link>https://teqmanch.com/rathat-android-malware-console-uses-gemini-to-identify-higher-value-victims</link>
<guid>https://teqmanch.com/rathat-android-malware-console-uses-gemini-to-identify-higher-value-victims</guid>
<description><![CDATA[ RatHat&#039;s operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy.

The console stores what the malware collects from each phone, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvGUhf2JsmovUtvjDk66AKULOtbtRwTqgcT_6lr5l8AEuwc-12IQTTWfvjKCYEn6-wwc4ZLDWAWh6Edv3-XcPDL1HHPFwRkwY1Nc_BUItyEO8iCXBDKEitrgYapLi__gpKnYqtFNm1M2c4tGiY3qrS_CgRG5ZF5qnqVUv4Gx9Pqk_cPz4N05KVwUNgTcw/s1600/gemini-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>RatHat, Android, Malware, Console, Uses, Gemini, Identify, Higher-Value, Victims</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off&#45;Script, and More Threats</title>
<link>https://teqmanch.com/weekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-off-script-and-more-threats</link>
<guid>https://teqmanch.com/weekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-off-script-and-more-threats</guid>
<description><![CDATA[ A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.

Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4-eWVCAN2nvZGZrKlwm-wminZE56MzJ_bVRK6CJfdBw9TXU4yQy6t9T0hDi0hSOskE9Xs6M-KCVEbVvBuL2DLDkew97W2iobOPZa9zqEBeGPWBnW8cftdD1FwzBLz7CIGVhJb1FwnS-35B62Jqc331zNQ67hZP-V2jKBT7yUxUV4rn8jMr27QCommYp-j/s1600/c-recap.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>⚡, Weekly, Recap:, 387M, Crypto, Hack, Citrix, Exploits, Agents, Off-Script, and, More, Threats</media:keywords>
</item>

<item>
<title>Custom ChatGPTs push ClickFix attacks to deploy RAT malware</title>
<link>https://teqmanch.com/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware</link>
<guid>https://teqmanch.com/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware</guid>
<description><![CDATA[ Custom variants of OpenAI&#039;s ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/29/chatgpt.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Custom, ChatGPTs, push, ClickFix, attacks, deploy, RAT, malware</media:keywords>
</item>

<item>
<title>FBI tells ShinyHunters members to turn themselves in after recent arrest</title>
<link>https://teqmanch.com/fbi-tells-shinyhunters-members-to-turn-themselves-in-after-recent-arrest</link>
<guid>https://teqmanch.com/fbi-tells-shinyhunters-members-to-turn-themselves-in-after-recent-arrest</guid>
<description><![CDATA[ The FBI is warning members of the ShinyHunters extortion group to turn themselves in after Dutch police arrested a man the bureau described as one of the group&#039;s alleged leaders. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/29/fbi-danger.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>FBI, tells, ShinyHunters, members, turn, themselves, after, recent, arrest</media:keywords>
</item>

<item>
<title>Hackers exploit Citrix NetScaler zero&#45;day to deploy web shells</title>
<link>https://teqmanch.com/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells</link>
<guid>https://teqmanch.com/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells</guid>
<description><![CDATA[ Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2023/07/21/citrix_headpic.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Hackers, exploit, Citrix, NetScaler, zero-day, deploy, web, shells</media:keywords>
</item>

<item>
<title>Former US Air Force members sent to prison over BEC attacks</title>
<link>https://teqmanch.com/former-us-air-force-members-sent-to-prison-over-bec-attacks</link>
<guid>https://teqmanch.com/former-us-air-force-members-sent-to-prison-over-bec-attacks</guid>
<description><![CDATA[ Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/29/Hackers-Dollars.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Former, Air, Force, members, sent, prison, over, BEC, attacks</media:keywords>
</item>

<item>
<title>Windows 11 2026 Update released, here&amp;apos;s everything you need to know</title>
<link>https://teqmanch.com/windows-11-2026-update-released-heres-everything-you-need-to-know</link>
<guid>https://teqmanch.com/windows-11-2026-update-released-heres-everything-you-need-to-know</guid>
<description><![CDATA[ Microsoft has started rolling out Windows 11 26H2 to everyone, and while it&#039;s this year&#039;s big annual feature update, you probably won&#039;t notice a massive difference after installing it. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/03/Windows-11.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Windows, 2026, Update, released, heres, everything, you, need, know</media:keywords>
</item>

<item>
<title>New Spectre v2 attack variant leaks Linux root password hash in minutes</title>
<link>https://teqmanch.com/new-spectre-v2-attack-variant-leaks-linux-root-password-hash-in-minutes</link>
<guid>https://teqmanch.com/new-spectre-v2-attack-variant-leaks-linux-root-password-hash-in-minutes</guid>
<description><![CDATA[ A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2022/06/02/motherboard-cpu-bios.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>New, Spectre, attack, variant, leaks, Linux, root, password, hash, minutes</media:keywords>
</item>

<item>
<title>Automated AI agent used to breach cybersecurity nonprofit DIVD</title>
<link>https://teqmanch.com/automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divd</link>
<guid>https://teqmanch.com/automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divd</guid>
<description><![CDATA[ The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as &quot;loud and very, very messy.&quot; [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/07/27/botnet.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Automated, agent, used, breach, cybersecurity, nonprofit, DIVD</media:keywords>
</item>

<item>
<title>Catch threats before they escalate with real&#45;time Identity Telemetry</title>
<link>https://teqmanch.com/catch-threats-before-they-escalate-with-real-time-identity-telemetry</link>
<guid>https://teqmanch.com/catch-threats-before-they-escalate-with-real-time-identity-telemetry</guid>
<description><![CDATA[ Identity governance helps control who should have access, but periodic reviews alone may not reveal attacks as they happen. tenfold Software explains how real-time identity telemetry can help security teams investigate suspicious activity before it escalates. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/25/tenfold-handcuffs.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Catch, threats, before, they, escalate, with, real-time, Identity, Telemetry</media:keywords>
</item>

<item>
<title>Vietnamese man charged in $16 million &amp;apos;pig butchering&amp;apos; crypto scam</title>
<link>https://teqmanch.com/vietnamese-man-charged-in-16-million-pig-butchering-crypto-scam</link>
<guid>https://teqmanch.com/vietnamese-man-charged-in-16-million-pig-butchering-crypto-scam</guid>
<description><![CDATA[ A Vietnamese national was charged with money laundering for his role in a massive &quot;pig butchering&quot; scam, which defrauded a victim out of $16 million worth of cryptocurrency. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/04/27/Hacker-Bitcoin-Dollars.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Vietnamese, man, charged, 16, million, pig, butchering, crypto, scam</media:keywords>
</item>

<item>
<title>Kiteworks patches critical flaw, brings customer systems online</title>
<link>https://teqmanch.com/kiteworks-patches-critical-flaw-brings-customer-systems-online</link>
<guid>https://teqmanch.com/kiteworks-patches-critical-flaw-brings-customer-systems-online</guid>
<description><![CDATA[ American tech company Kiteworks has lifted a precautionary advisory asking customers to shut down systems after patching a critical vulnerability. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/29/Kiteworks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 30 Sep 2026 02:30:20 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Kiteworks, patches, critical, flaw, brings, customer, systems, online</media:keywords>
</item>

<item>
<title>Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry</title>
<link>https://teqmanch.com/attackers-use-malicious-terraform-providers-to-deliver-go-malware-via-hashicorp-registry</link>
<guid>https://teqmanch.com/attackers-use-malicious-terraform-providers-to-deliver-go-malware-via-hashicorp-registry</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads.

According to Aikido, the list of Terraform providers and Go modules is below -


  gocommunity-io/dockerd (222 downloads)
  kreuzwenker/ ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8VNxKl5_NBWXcUoDi3VxoksbOSAixGFGd8EmIaZmKRQpsGhOj6SLg8fmHktJbtvR7wofZNG1AFIzSGnVFq8OJHgq27dhqNtc0cz457ZqqQQ6INHwnExfLu3xKERaNt0GmOpxJ6WR6oxp5FZTT-q3Q5YWAnVawXYfY51GRl09ovsDkhM3U8tRUTR4ClSfj/s1600/terraform.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Attackers, Use, Malicious, Terraform, Providers, Deliver, Malware, via, HashiCorp, Registry</media:keywords>
</item>

<item>
<title>A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You</title>
<link>https://teqmanch.com/a-leaked-gitlab-issue-email-address-lets-anyone-push-code-and-run-ci-jobs-as-you</link>
<guid>https://teqmanch.com/a-leaked-gitlab-issue-email-address-lets-anyone-push-code-and-run-ci-jobs-as-you</guid>
<description><![CDATA[ The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you.

GitLab shows each user this address behind a button labeled &quot;Email work item to this project.&quot; Mail sent to it opens an issue in that project, authored ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjaHKzSxkk0R4wjlziQHsR5vS1s1mTJovZkES9XL9nn5VLYiM55XuJoiGP9cugwNUOBMEMG3NrW3iBL9cVOqfp0F-9roYS7K7R5w8t3_NJr61_2_XgRNltvjXBFoGLfQPQFhUk0ju_mMCRCqJHjr76BrbngafAtElKkD-LZWZ7uUcY82i8PAMKh0ljHJQI/s1600/gitlab-email.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Leaked, GitLab, Issue, Email, Address, Lets, Anyone, Push, Code, and, Run, Jobs, You</media:keywords>
</item>

<item>
<title>MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key</title>
<link>https://teqmanch.com/mikrotrick-chain-let-attackers-take-over-mikrotik-routers-without-a-password-or-ssh-key</link>
<guid>https://teqmanch.com/mikrotrick-chain-let-attackers-take-over-mikrotik-routers-without-a-password-or-ssh-key</guid>
<description><![CDATA[ Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication.

The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjudzrtqX93WzCbZQoGI06WzKFtFpQsZaQB7GUao4yzBncGN3nxn0GzmYNybpL9SeKFttznMsVCZpQEQ_fD5kP_0nJRL4ZN6ZgHrXR2c33bpZN33gEyIkk6aBtx0k7znzalUe6epmrCO5VSCCH6beY_chvz9Pl0t5BbBtCLntTnNMwi3cFPXFd0p09FxA4/s1600/microtik.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>MikroTrick, Chain, Let, Attackers, Take, Over, MikroTik, Routers, Without, Password, SSH, Key</media:keywords>
</item>

<item>
<title>This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move</title>
<link>https://teqmanch.com/this-windows-malware-is-built-to-let-up-to-four-ai-models-vote-on-its-next-move</link>
<guid>https://teqmanch.com/this-windows-malware-is-built-to-let-up-to-four-ai-models-vote-on-its-next-move</guid>
<description><![CDATA[ A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker&#039;s server, Cisco Talos said on September 22.

The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZdSpi6aqUlY2q-T-3eJ4YCn7G3jYa9Exo6BMffjdRLuqg9Gdn4ImZXKjcYX8s5Swz3W_WhxMZ_Z7qbu0Z60KrCk8EUhRV8bJ7l1mXOoDCo-XAXyq69_rtFDoVhvAiuJP1rCdSf9KixTqgAA52iwqWsqB5T0uJaRGFz1hpBcpfQuvPMYd17UcrfrnUV0c/s1600/closed.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>This, Windows, Malware, Built, Let, Four, Models, Vote, Its, Next, Move</media:keywords>
</item>

<item>
<title>Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI</title>
<link>https://teqmanch.com/compromised-memtensor-packages-deliver-sckit-credential-stealer-via-npm-and-pypi</link>
<guid>https://teqmanch.com/compromised-memtensor-packages-deliver-sckit-credential-stealer-via-npm-and-pypi</guid>
<description><![CDATA[ Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS.

According to reports from Aikido, SafeDep, Socket, and StepSecurity, the libraries in question below -


  @memtensor/memos-cloud-openclaw-plugin versions ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFThFSFsti-2SIka75bNuMKpyJHtOW2ZPrZtcSjbjFQ64GCNn0WtdssYuWlVTbhaLB5cAJ0vu8FgyNmNsDa8g0Ijy-D1zP4FW7ihVfAjk9xWMYDMMdfZPICGyVdjeDwH3-jyKLHOUnjfaXBJIMxGn_3ngeXFsbb4CLnOibRd4fbwXHYpBkMQTcBQAf0edq/s1600/npm-pypi.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Compromised, MemTensor, Packages, Deliver, sckit, Credential, Stealer, via, npm, and, PyPI</media:keywords>
</item>

<item>
<title>Placeholder domain used in dev docs now serves ClickFix attacks</title>
<link>https://teqmanch.com/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks</link>
<guid>https://teqmanch.com/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks</guid>
<description><![CDATA[ The &quot;third-party.com&quot; domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/23/third-party-clickfix-red.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Placeholder, domain, used, dev, docs, now, serves, ClickFix, attacks</media:keywords>
</item>

<item>
<title>New RemControl Android banking malware targets users in Europe and Canada</title>
<link>https://teqmanch.com/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada</link>
<guid>https://teqmanch.com/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada</guid>
<description><![CDATA[ A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/01/31/image_(2).jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>New, RemControl, Android, banking, malware, targets, users, Europe, and, Canada</media:keywords>
</item>

<item>
<title>Check Point warns of hackers exploiting Security Gateway VPN RCE flaw</title>
<link>https://teqmanch.com/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw</link>
<guid>https://teqmanch.com/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw</guid>
<description><![CDATA[ Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/07/23/Check-Point.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Check, Point, warns, hackers, exploiting, Security, Gateway, VPN, RCE, flaw</media:keywords>
</item>

<item>
<title>Hackers start exploiting critical WordPress flaw for code execution</title>
<link>https://teqmanch.com/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution</link>
<guid>https://teqmanch.com/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution</guid>
<description><![CDATA[ Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/11/03/WordPress.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Hackers, start, exploiting, critical, WordPress, flaw, for, code, execution</media:keywords>
</item>

<item>
<title>Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers</title>
<link>https://teqmanch.com/malicious-ai-agents-steal-600k-credit-cards-infect-100-sites-with-skimmers</link>
<guid>https://teqmanch.com/malicious-ai-agents-steal-600k-credit-cards-infect-100-sites-with-skimmers</guid>
<description><![CDATA[ A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/23/robot-card.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Malicious, agents, steal, 600K, credit, cards, infect, 100, sites, with, skimmers</media:keywords>
</item>

<item>
<title>InfraTrust report warns network management systems under attack</title>
<link>https://teqmanch.com/infratrust-report-warns-network-management-systems-under-attack</link>
<guid>https://teqmanch.com/infratrust-report-warns-network-management-systems-under-attack</guid>
<description><![CDATA[ Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/23/network-management-vulnerability-blue.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>InfraTrust, report, warns, network, management, systems, under, attack</media:keywords>
</item>

<item>
<title>How One Kubernetes YAML Can Hand Over a GCP Organization</title>
<link>https://teqmanch.com/how-one-kubernetes-yaml-can-hand-over-a-gcp-organization</link>
<guid>https://teqmanch.com/how-one-kubernetes-yaml-can-hand-over-a-gcp-organization</guid>
<description><![CDATA[ A Kubernetes user with limited permissions can potentially gain control of an entire Google Cloud organization by exploiting the authority granted to Google Kubernetes Config Connector. Varonis explains how this confused deputy problem can turn a single Kubernetes YAML file into a path to organization-wide privilege escalation. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/22/screwdriver-stealing-card.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 24 Sep 2026 10:06:37 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>How, One, Kubernetes, YAML, Can, Hand, Over, GCP, Organization</media:keywords>
</item>

<item>
<title>New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control</title>
<link>https://teqmanch.com/new-cpanel-flaw-lets-a-hosting-account-run-code-as-root-take-full-server-control</link>
<guid>https://teqmanch.com/new-cpanel-flaw-lets-a-hosting-account-run-code-as-root-take-full-server-control</guid>
<description><![CDATA[ A flaw in cPanel&#039;s CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take &quot;full control of the server,&quot; the company said on September 22.

A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts.

cPanel has released fixed versions for both, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT5quc0dmRWhh6WOC80Gx9QoHTMYyq5srnXBXjybOKZk_qoUn1Q2nKLE9MifqCEyRIha_NFvRsyr8Nx5EyxGIREXaTb5Fh59cz4Ln8yZj9Zv7piqM49wmm7rfmchW1cVlss1wn47qNypaYarZUVNHBO8rzXaYTvRMi9u1phgfXVd8OZx8_Vjxm34684BE/s1600/cpanel-0day.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>New, cPanel, Flaw, Lets, Hosting, Account, Run, Code, Root, Take, Full, Server, Control</media:keywords>
</item>

<item>
<title>545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent</title>
<link>https://teqmanch.com/545-hackers-tested-it-first-now-xranges-for-ai-scores-your-security-agent</link>
<guid>https://teqmanch.com/545-hackers-tested-it-first-now-xranges-for-ai-scores-your-security-agent</guid>
<description><![CDATA[ Autonomous security agents are getting good at finding bugs. Nobody has a good way to measure how good. Point one at a realistic target and what comes back is a report the agent wrote about itself: confident prose, a list of findings, and no way to tell which of them happened. Someone with a security background then sits down and checks every claim against the target. Which findings are real, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEio2c14ELRJEhvTuDrxQmhUG4G9aGoVRrooBMMfuK7LyHPKW6HuJbI9PkKF-WG_5HlEz8NKcuj08XRmv1jNqfBtiDwXmC7e9P9lxoSHK5nUz023YCgoLQuo0BI_9hX4U9Vv97bGJejb4W0jvgv_3btkfj6BWnXwalfyI3k34wveC6n3k47ZdoGq2P0Yaw0/s1600/main.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>545, Hackers, Tested, First., Now, XRanges, for, Scores, Your, Security, Agent</media:keywords>
</item>

<item>
<title>Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests</title>
<link>https://teqmanch.com/anthropic-and-openai-models-still-attempt-restricted-actions-in-safety-tests</link>
<guid>https://teqmanch.com/anthropic-and-openai-models-still-attempt-restricted-actions-in-safety-tests</guid>
<description><![CDATA[ Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior.

Opus 5.5, per Anthropic, is a &quot;major step up from Opus 5,&quot; and &quot;achieves the best scores of any model to date on our automated behavioral audit, our alignment suite that tests Claude across thousands ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_ytuRh_WTu4R3TBnroGXO6IUgATMIi9vgx8DA7j0JJ0e_cTfAjlUIS6zAjb2q9EPdTI8gLwby7r2fijYkH83j2SwisKf-ANFKr6YTdwAHeds99dYrng0QN3nmkqDtIvSHoK8m47e_V0x01B0PuzIezcqtnc2VZlUCVYErOkaKQF7pbk0l35uLwmTl8Is1/s1600/CLAUDE-CHATGPT.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Anthropic, and, OpenAI, Models, Still, Attempt, Restricted, Actions, Safety, Tests</media:keywords>
</item>

<item>
<title>Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host&#45;Root Container Escape</title>
<link>https://teqmanch.com/exploit-released-for-unpatched-ubuntu-linux-flaw-enabling-host-root-container-escape</link>
<guid>https://teqmanch.com/exploit-released-for-unpatched-ubuntu-linux-flaw-enabling-host-root-container-escape</guid>
<description><![CDATA[ A use-after-free in the Linux kernel&#039;s AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22.

The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases. DepthFirst  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZjw_aCdQxMfwTv_-KFLK5KRCd96MoivCQPTAZcAWJal5_84FgCny9Um8csMgDDqta40CUGMPDO14hdbUo9CRk-FMJwY70MsDfV25AC8VmL-8_yDO_UWHYXbmeJ9jZANptIeHqJX9axqzxxn68AHEj8zFhYbh8coIbxWAVC9XbtG9CjxMBpQqclG14QuM/s1600/linux.gif" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Exploit, Released, for, Unpatched, Ubuntu, Linux, Flaw, Enabling, Host-Root, Container, Escape</media:keywords>
</item>

<item>
<title>F5 Patches Critical BIG&#45;IP APM Zero&#45;Day Exploited for Unauthenticated RCE on OAuth Servers</title>
<link>https://teqmanch.com/f5-patches-critical-big-ip-apm-zero-day-exploited-for-unauthenticated-rce-on-oauth-servers</link>
<guid>https://teqmanch.com/f5-patches-critical-big-ip-apm-zero-day-exploited-for-unauthenticated-rce-on-oauth-servers</guid>
<description><![CDATA[ Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.

The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_ZqCwuuKS7TqNWQ7GpeE07JLzHNn4Jdb2O6iQAlY34SiP2it2VwgmeVm5OjAzoAEHFQRVJENdDNGQL94ibPy1AiB9qkpNxZ3ILA89tYlwqm2OO9tEOH_BZ9HZzObw0nrzszQoKnaCQ-Q8ez5DPsnrKjq40qhm2tu_DhMSFunkVRsHeEIc0IA2NL-yZ5g/s1600/f5-zero-day.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Patches, Critical, BIG-IP, APM, Zero-Day, Exploited, for, Unauthenticated, RCE, OAuth, Servers</media:keywords>
</item>

<item>
<title>Chinese Hackers Exploit Chrome&#45;Windows Zero&#45;Day Chain to Deploy CLEANGULP Malware</title>
<link>https://teqmanch.com/chinese-hackers-exploit-chrome-windows-zero-day-chain-to-deploy-cleangulp-malware</link>
<guid>https://teqmanch.com/chinese-hackers-exploit-chrome-windows-zero-day-chain-to-deploy-cleangulp-malware</guid>
<description><![CDATA[ A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites.

The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikVEmuPJKZAlboodZWejG4dGZXXejOLThyXPoOnycqTY8lznAewTW5ovv8XFJzhyjPRMXT-njudYOVWFEYCLvmEPDyUrfDTZzAmp1S4KE4DuzsDFxt8R-biL2puZZBWG36_dkhfzvpeigcPb9WJNy31oIXo6Oh3zMUzL3JG6MEr4OaGE4Yi_k5JCpohVrZ/s1600/windows-china.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Chinese, Hackers, Exploit, Chrome-Windows, Zero-Day, Chain, Deploy, CLEANGULP, Malware</media:keywords>
</item>

<item>
<title>Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input</title>
<link>https://teqmanch.com/critical-nextjs-imageresponse-flaw-can-lead-to-server-code-execution-via-crafted-svg-input</link>
<guid>https://teqmanch.com/critical-nextjs-imageresponse-flaw-can-lead-to-server-code-execution-via-crafted-svg-input</guid>
<description><![CDATA[ A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said.

The risk applies when an app puts values an attacker controls, such as text read from the request URL, into the image. Vercel, which develops Next.js, fixed the flaw on September 22 in version ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBxfEfPNHZcocTp156lW-VbOENuCxmLM_7xUUY5QWEppPDsL04KhbN7yaT52b_XTCXW6ensPqjF8QBXuQWUgna8jerFExtxAfkCd4NqOGcQwUn8088DU87PMD7cgYhQ-dY2_xFdwPyaKU-kD9HBx_YcjAzvzwEQzLoKUu1cRRpOT5A1luhBCE6e6ChORw/s1600/next.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Critical, Next.js, ImageResponse, Flaw, Can, Lead, Server, Code, Execution, via, Crafted, SVG, Input</media:keywords>
</item>

<item>
<title>ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants</title>
<link>https://teqmanch.com/shinyhunters-claims-fbi-breach-says-it-stole-data-on-agents-and-job-applicants</link>
<guid>https://teqmanch.com/shinyhunters-claims-fbi-breach-says-it-stole-data-on-agents-and-job-applicants</guid>
<description><![CDATA[ The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency.

&quot;We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job,&quot; the group said in a statement posted on their dark ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBUSHHkVbK1vPy2WO_E9jEZ2NEd8UcPTpCFgCYTkbSPiSzDEpXRe6HRXan3z9Xg1huRk3-47hZbveFeG06vkRhAmGuL73zdPFjQEkVb6LISZIcHpPugYCMKQPtsEIihip_T7F1GWczJNWNTikwbM-SzC_UNeQsUjrg6AIeHYBwOnpOUlSOWyimHb07TzWz/s1600/shinyhunters.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>ShinyHunters, Claims, FBI, Breach, Says, Stole, Data, Agents, and, Job, Applicants</media:keywords>
</item>

<item>
<title>Check Point Warns of Management Server Zero&#45;Day Exploited in Targeted Attacks</title>
<link>https://teqmanch.com/check-point-warns-of-management-server-zero-day-exploited-in-targeted-attacks</link>
<guid>https://teqmanch.com/check-point-warns-of-management-server-zero-day-exploited-in-targeted-attacks</guid>
<description><![CDATA[ Attackers exploited a previously unknown flaw in Check Point&#039;s Security Management Server in a handful of targeted attacks on July 23, the company said.

The flaw, CVE-2026-93616, allows an attacker who can access the server&#039;s web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipTjrp93lIMdPVKigtkoXjbsk75AIXEvqJuXoYMQLAmvzQfqSy3V1XhBTLXY1SAWp92vTbajtnxBgHYvDr2e3EZOi9Yf8KgT8EzQOp61PjmPsI55nERsYckaL-pfmQDDzRTiCWXegVWrJ0Fu_9I8GUi5O0M0103r218S3dC67Zmr9BZ3quLBRBm9T6Xqo/s1600/cp-upload.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Check, Point, Warns, Management, Server, Zero-Day, Exploited, Targeted, Attacks</media:keywords>
</item>

<item>
<title>WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers</title>
<link>https://teqmanch.com/wordpress-issues-patch-for-critical-flaw-that-can-enable-code-execution-on-some-servers</link>
<guid>https://teqmanch.com/wordpress-issues-patch-for-critical-flaw-that-can-enable-code-execution-on-some-servers</guid>
<description><![CDATA[ WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders.

On some servers, that can go further, allowing the attacker to run their own code. The fix shipped on September 22 in WordPress 7.1.2, with fixes for every branch the project still supports, back to 4.7, and WordPress is telling site owners ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcFso-nJC2Re_gThOMTjPhyphenhyphenaOti1Mpn2_nb6NYGitzjVHTtvHN_q4oKg_FGa4IrTt81BAuA4qWzeJJZkxdV7F0-iSBR3ZwSUmqfBhvBX2ArxLTZqYjbtCPhu2Gw7PLSmOS5kOGQ9f0I46xPwhp5VCflFSN8YEm-z8VXdk1XRJwCvbqbljSZqorD4MpbQc/s1600/wp-update.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>WordPress, Issues, Patch, for, Critical, Flaw, That, Can, Enable, Code, Execution, Some, Servers</media:keywords>
</item>

<item>
<title>Malicious npm Package Poses as Twilio Bug&#45;Bounty Probe, Can Exfiltrate Credentials</title>
<link>https://teqmanch.com/malicious-npm-package-poses-as-twilio-bug-bounty-probe-can-exfiltrate-credentials</link>
<guid>https://teqmanch.com/malicious-npm-package-poses-as-twilio-bug-bounty-probe-can-exfiltrate-credentials</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a malicious npm package named &quot;tw-pkgprobe-7731&quot; that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data.

The package, named &quot;tw-pkgprobe-7731,&quot; was first uploaded to the npm registry in mid-August 2026 by an npm account named &quot;twdepprobe7731.&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikMlDL6W0FZvq8_gscr2M3UZIVnCYorB-Ip2G6To6-eZ04gFyOMsf-mvbqtMkYv484O3XnKhzySe0-UQjCOMm99fUhzrpkMD-QaZkn2UIUozJ5hLwrm7kXgLkODdkUUJk4GFXEkgrg7MlXKzcQ7kKtug2RmT80RROQfVRbQQm3HdeHBzAzhAjQ9bUf5eaT/s1600/twilio.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Malicious, npm, Package, Poses, Twilio, Bug-Bounty, Probe, Can, Exfiltrate, Credentials</media:keywords>
</item>

<item>
<title>Microsoft Takes Down EvilTokens Device&#45;Code Phishing Service Tied to 12,000 Inbox Compromises</title>
<link>https://teqmanch.com/microsoft-takes-down-eviltokens-device-code-phishing-service-tied-to-12000-inbox-compromises</link>
<guid>https://teqmanch.com/microsoft-takes-down-eviltokens-device-code-phishing-service-tied-to-12000-inbox-compromises</guid>
<description><![CDATA[ Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) &quot;at every step of the attack chain.&quot;

The action, carried out with authorization from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyLwFD0zZ8OEPo1dkZ0Tz87aOYoCklNQODjV4MMj90RNo6hRh9rGuJmFQBx5igj0gT1CabBEkSERWh7w_VdfZWpfs6BaJmEMc0KN9nIJXtxpYUINf1alSW9K2whcD9MXF4CaCWAKLJRJQlI51aqGtdpbpbdiX7WjpjTUxDvNgb0gc4qtmuZLat8-lGSFhu/s1600/ms-eviltokens.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, Takes, Down, EvilTokens, Device-Code, Phishing, Service, Tied, 12, 000, Inbox, Compromises</media:keywords>
</item>

<item>
<title>Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials</title>
<link>https://teqmanch.com/critical-bifrost-ai-gateway-flaw-lets-attackers-run-commands-without-credentials</link>
<guid>https://teqmanch.com/critical-bifrost-ai-gateway-flaw-lets-attackers-run-commands-without-credentials</guid>
<description><![CDATA[ A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request.

The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieRvfWKvxkIOajVIJ1qC7l54ZBCtHMwZTfUHGqSZ_35vGzAl23py6GfaqrxYkcfWZ_K75t9BGC6btqJQiS9jwaV7O4kJsCSIIQxmn9VnZrBbdjxSN4AzQ05K9G-ES82qV1G6IUcsBetsb0mVO5e5IHTr2FyAA3gtCN8Vne5N1H5Swgd2FLLlwi0GXFQ0o/s1600/bifrost.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Critical, Bifrost, Gateway, Flaw, Lets, Attackers, Run, Commands, Without, Credentials</media:keywords>
</item>

<item>
<title>Researcher Drops BigDiskBuster Zero&#45;Day PoC That Blocks Microsoft Defender Updates</title>
<link>https://teqmanch.com/researcher-drops-bigdiskbuster-zero-day-poc-that-blocks-microsoft-defender-updates</link>
<guid>https://teqmanch.com/researcher-drops-bigdiskbuster-zero-day-poc-that-blocks-microsoft-defender-updates</guid>
<description><![CDATA[ A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19.

The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf-fkqiHh6b0UEKMHUcsG54QVwJxghIbQLMNWeEG5LWKfUsicLMxisz4Mi8lXdfTdwVYDFpIrCFj5D7-JXXynq8lWhnNn1rJH2t8mgKUeZ4WMePwZktZRnIe2549JW3VXc2HYD9qpsvO8He0J0zCyAzsaRxWtiP46RSrd7jt4QnzKACJhfWnkmyWcFcQs/s1600/ms-def.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Researcher, Drops, BigDiskBuster, Zero-Day, PoC, That, Blocks, Microsoft, Defender, Updates</media:keywords>
</item>

<item>
<title>AI Agents Are Rewriting the Rules of Lateral Movement</title>
<link>https://teqmanch.com/ai-agents-are-rewriting-the-rules-of-lateral-movement</link>
<guid>https://teqmanch.com/ai-agents-are-rewriting-the-rules-of-lateral-movement</guid>
<description><![CDATA[ Security teams have spent decades asking whether an identity has too much access. AI agents raise a harder question: how can we determine which paths an autonomous system can discover, given the access it already has?

A person may try several ways to complete a task. A deterministic application follows the flow its developer wrote. But an AI agent is relentless in its pursuit of done. In May ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9ivhHLwWwT7Ptbr537Fd2CV3d_maDSNRmH0up0x67UPpc5x45Uuz0Bg8EnLkjrtB3DYXldW7aKbzx5uljQSF7IhQlzHHA1HR0F16Eaxs8Y3tgURkizSrA79L3EqyD5RDlqPGljbXCTQj0tFFG2EOVueksvhyrmdmC-v6VFjs76KdzZlCg1juWiVOPDnU/s1600/token.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Agents, Are, Rewriting, the, Rules, Lateral, Movement</media:keywords>
</item>

<item>
<title>Arista patches actively exploited VeloCloud Orchestrator zero&#45;day</title>
<link>https://teqmanch.com/arista-patches-actively-exploited-velocloud-orchestrator-zero-day</link>
<guid>https://teqmanch.com/arista-patches-actively-exploited-velocloud-orchestrator-zero-day</guid>
<description><![CDATA[ Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/23/Arista-logo.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Arista, patches, actively, exploited, VeloCloud, Orchestrator, zero-day</media:keywords>
</item>

<item>
<title>Microsoft: September Windows updates break Always On VPN connections</title>
<link>https://teqmanch.com/microsoft-september-windows-updates-break-always-on-vpn-connections</link>
<guid>https://teqmanch.com/microsoft-september-windows-updates-break-always-on-vpn-connections</guid>
<description><![CDATA[ Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/02/13/Windows-headpic.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft:, September, Windows, updates, break, Always, VPN, connections</media:keywords>
</item>

<item>
<title>Ryuk ransomware member sentenced to 24 months in prison</title>
<link>https://teqmanch.com/ryuk-ransomware-member-sentenced-to-24-months-in-prison</link>
<guid>https://teqmanch.com/ryuk-ransomware-member-sentenced-to-24-months-in-prison</guid>
<description><![CDATA[ An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/23/RYUK_ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Ryuk, ransomware, member, sentenced, months, prison</media:keywords>
</item>

<item>
<title>F5 patches BIG&#45;IP APM zero&#45;day flaw exploited in RCE attacks</title>
<link>https://teqmanch.com/f5-patches-big-ip-apm-zero-day-flaw-exploited-in-rce-attacks</link>
<guid>https://teqmanch.com/f5-patches-big-ip-apm-zero-day-flaw-exploited-in-rce-attacks</guid>
<description><![CDATA[ F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/06/18/F5.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>patches, BIG-IP, APM, zero-day, flaw, exploited, RCE, attacks</media:keywords>
</item>

<item>
<title>Rogue external MFA providers can steal passwords during logins</title>
<link>https://teqmanch.com/rogue-external-mfa-providers-can-steal-passwords-during-logins</link>
<guid>https://teqmanch.com/rogue-external-mfa-providers-can-steal-passwords-during-logins</guid>
<description><![CDATA[ Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users&#039; passwords during legitimate login attempts. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2022/09/19/MFA.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Rogue, external, MFA, providers, can, steal, passwords, during, logins</media:keywords>
</item>

<item>
<title>Sweden fines Miljödata $183,000 over breach affecting 2.2 million</title>
<link>https://teqmanch.com/sweden-fines-miljoedata-183000-over-breach-affecting-22-million</link>
<guid>https://teqmanch.com/sweden-fines-miljoedata-183000-over-breach-affecting-22-million</guid>
<description><![CDATA[ Sweden&#039;s data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2.2 million people. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/08/27/sweden.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Sweden, fines, Miljödata, 183, 000, over, breach, affecting, 2.2, million</media:keywords>
</item>

<item>
<title>Chinese hackers exploit WordPress, Zyxel flaws to steal govt data</title>
<link>https://teqmanch.com/chinese-hackers-exploit-wordpress-zyxel-flaws-to-steal-govt-data</link>
<guid>https://teqmanch.com/chinese-hackers-exploit-wordpress-zyxel-flaws-to-steal-govt-data</guid>
<description><![CDATA[ A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/03/05/chinese-hacker-flag.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Chinese, hackers, exploit, WordPress, Zyxel, flaws, steal, govt, data</media:keywords>
</item>

<item>
<title>ShinyHunters claims FBI hack, data theft in PeopleSoft zero&#45;day breach</title>
<link>https://teqmanch.com/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach</link>
<guid>https://teqmanch.com/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach</guid>
<description><![CDATA[ The ShinyHunters extortion gang claims it breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, gaining access to internal services and stealing sensitive data on employees and job applicants. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2022/12/16/FBI__headpic.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>ShinyHunters, claims, FBI, hack, data, theft, PeopleSoft, zero-day, breach</media:keywords>
</item>

<item>
<title>New ClosedQuorum Windows malware uses AI for attack decisions</title>
<link>https://teqmanch.com/new-closedquorum-windows-malware-uses-ai-for-attack-decisions</link>
<guid>https://teqmanch.com/new-closedquorum-windows-malware-uses-ai-for-attack-decisions</guid>
<description><![CDATA[ A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/10/21/Robot.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>New, ClosedQuorum, Windows, malware, uses, for, attack, decisions</media:keywords>
</item>

<item>
<title>Reducing shadow IT visibility gaps with Wazuh</title>
<link>https://teqmanch.com/reducing-shadow-it-visibility-gaps-with-wazuh</link>
<guid>https://teqmanch.com/reducing-shadow-it-visibility-gaps-with-wazuh</guid>
<description><![CDATA[ Shadow IT can leave security teams unaware of unmanaged endpoints, unauthorized software, and other assets that fall outside existing monitoring. Wazuh explains how endpoint inventory, agentless monitoring, and centralized analysis can help organizations identify and reduce these visibility gaps. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/22/IMG_7712.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 23 Sep 2026 19:26:05 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Reducing, shadow, visibility, gaps, with, Wazuh</media:keywords>
</item>

<item>
<title>One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor</title>
<link>https://teqmanch.com/one-hidden-meta-muse-setting-could-let-attackers-turn-the-ai-assistant-into-a-backdoor</link>
<guid>https://teqmanch.com/one-hidden-meta-muse-setting-could-let-attackers-turn-the-ai-assistant-into-a-backdoor</guid>
<description><![CDATA[ Malware already running on a Mac can quietly take over Meta&#039;s Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21.

It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta.

The flaw is in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjZLVTtI-AEbGRQqJ7aGa0tbXedD5L6P7VCEKIOGXOBZe7S3mhA-PnoHVEoZf3LBMzhcZSIX5sCTveGyZ-8qAqyAVaMXfEoxPL70OIESq-Iolqjkv8GuDjcVs1Jgh3k3SoOOGPDWFr6Lmk83avLqG1whcaiDclv5waXYhCuEqXk569wfwV8Ilrmvv3IKE/s1600/muse.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>One, Hidden, Meta, Muse, Setting, Could, Let, Attackers, Turn, the, Assistant, Into, Backdoor</media:keywords>
</item>

<item>
<title>WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session</title>
<link>https://teqmanch.com/wordpress-comment2shell-flaw-can-turn-anonymous-comment-xss-into-rce-via-admin-session</link>
<guid>https://teqmanch.com/wordpress-comment2shell-flaw-can-turn-anonymous-comment-xss-into-rce-via-admin-session</guid>
<description><![CDATA[ A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site&#039;s server.

WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed &quot;Comment2Shell,&quot; on September 17 in version 7.1.1 and told site owners to update right away. There is ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPBWV1XNsTGB5ImLNRGJTygk0-82k7xTHmuOr7lTivRRDcF83ddu4jLOpdkQYMq7VB3j5SMpA9zBRvM3-SUkDLBhN5-j-Z6UltcTnVfXOxHDzfBYWiw_fRiRefAYa1XSiFu5JMzb06dwqV4PhKaZkPt3vKZFHQjdVFUgbr2B3nOEoFs_qHe6zwGayHM2I/s1600/wordpress-comment.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>WordPress, Comment2Shell, Flaw, Can, Turn, Anonymous, Comment, XSS, Into, RCE, via, Admin, Session</media:keywords>
</item>

<item>
<title>Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access</title>
<link>https://teqmanch.com/zyxel-and-veeam-flaws-under-active-exploitation-with-command-and-system-access</link>
<guid>https://teqmanch.com/zyxel-and-veeam-flaws-under-active-exploitation-with-command-and-system-access</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjj9eouOxeSvnYBzl5A8tWvEQ4w_CCx94YcFmpBAXXqHWNqvFBWj4vOgeZdHYAf0MU-chY63biCpHDnzRC0pwR7s3pTdQAWwPAVI-olRZuBwG0ilgAxnIY_1KofE3cpuA8lKOE01U26EFHYE_nLrXYXOWl47G1KaoFTZ5UOO81Cw0Kb20pFSfAc1b9i9E_K/s1600/veeam.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Zyxel, and, Veeam, Flaws, Under, Active, Exploitation, With, Command, and, SYSTEM, Access</media:keywords>
</item>

<item>
<title>Fake LastPass Authenticator Installer Abuses Microsoft&#45;Signed Driver to Kill Antivirus and EDR</title>
<link>https://teqmanch.com/fake-lastpass-authenticator-installer-abuses-microsoft-signed-driver-to-kill-antivirus-and-edr</link>
<guid>https://teqmanch.com/fake-lastpass-authenticator-installer-abuses-microsoft-signed-driver-to-kill-antivirus-and-edr</guid>
<description><![CDATA[ A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17.

Microsoft&#039;s own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil-5ZV6QK7R23fL7Vtl-pdxgFYPAG9dT_cIIrXWgR70hLZRM705Ij3WuRpCL00VuDop9dTmVNf1t3QS60nqRGV9GCzsZ792yd7mFY_pjvgfufOK9D-oQJdxP4ZtrXiyeq08KNUBv3-mhQ_KCiCOMWIbeQpCAyF_h4lMZw54T0l9AcDdGf6aRptXAZJNcU/s1600/last.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Fake, LastPass, Authenticator, Installer, Abuses, Microsoft-Signed, Driver, Kill, Antivirus, and, EDR</media:keywords>
</item>

<item>
<title>Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto</title>
<link>https://teqmanch.com/contagious-interview-campaign-compromises-30000-devices-steals-1071m-in-crypto</link>
<guid>https://teqmanch.com/contagious-interview-campaign-compromises-30000-devices-steals-1071m-in-crypto</guid>
<description><![CDATA[ The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory.

The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjuVP0IzjchtSeuT6WwQHPupLynSiYhe7KinKtQVVE_EgFE5iG9SWV4HrgseuXaSUo-TaamFPzHl6SCnUPsbz29nzEo1BJeZVE4VB43KdMBmKEld7snbryRJIeIIAmiRZNEhFCJ-58klU6qGrvwg2Hn26FtkHv1s4cAj_zX9AWmdeym2-d4hScWr9dLiOY/s1600/exec.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Contagious, Interview, Campaign, Compromises, 30, 000, Devices, Steals, 10.71M, Crypto</media:keywords>
</item>

<item>
<title>Google Fined €403 Million Over GDPR Violations Tied to Location Data</title>
<link>https://teqmanch.com/google-fined-403-million-over-gdpr-violations-tied-to-location-data</link>
<guid>https://teqmanch.com/google-fined-403-million-over-gdpr-violations-tied-to-location-data</guid>
<description><![CDATA[ Google has been fined €403 million for breaking the EU&#039;s data protection law, the GDPR, in the way three of its features handled people&#039;s location data from May 2018 to February 2020.

Ireland&#039;s Data Protection Commission (DPC), Google&#039;s lead regulator in the EU, also ordered the company to make its processing comply with the law within 6 months. The DPC has not said publicly which ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrjOPn27sYW7sjjV6-SlFPjlnnAtZ2bVGvrJRbbussed8ddYCwrRnmyIBKOsJy9p3QGdwzMuxmxhtyNvyPQD9u53V0T84o-Pi1Euo1SPlHX9DiaFzVby2cKpyfdma7mA0b4F1gqDCvjWBrk3n916K6Su1Y1TaJcOKXHsuzNn0cxOmVzlUK1NIjPtElIXM/s1600/google-location.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Google, Fined, €403, Million, Over, GDPR, Violations, Tied, Location, Data</media:keywords>
</item>

<item>
<title>BigCommerce alerts merchants of data breach linked to Ribon apps</title>
<link>https://teqmanch.com/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps</link>
<guid>https://teqmanch.com/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps</guid>
<description><![CDATA[ Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2021/11/25/OnlineShopping.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>BigCommerce, alerts, merchants, data, breach, linked, Ribon, apps</media:keywords>
</item>

<item>
<title>CISA alerts of active exploitation of three Linux kernel flaws</title>
<link>https://teqmanch.com/cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws</link>
<guid>https://teqmanch.com/cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/01/13/CISA.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>CISA, alerts, active, exploitation, three, Linux, kernel, flaws</media:keywords>
</item>

<item>
<title>WordPress Click2Shell flaw lets hackers execute PHP on the server</title>
<link>https://teqmanch.com/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server</link>
<guid>https://teqmanch.com/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server</guid>
<description><![CDATA[ Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed &#039;Click2Shell&#039; that affects the platform&#039;s Core component. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/04/15/WordPress.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 14:01:17 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>WordPress, Click2Shell, flaw, lets, hackers, execute, PHP, the, server</media:keywords>
</item>

<item>
<title>Microsoft to retire Microsoft 365 Companion apps in December</title>
<link>https://teqmanch.com/microsoft-to-retire-microsoft-365-companion-apps-in-december</link>
<guid>https://teqmanch.com/microsoft-to-retire-microsoft-365-companion-apps-in-december</guid>
<description><![CDATA[ Microsoft will retire the Calendar, People, and Files Microsoft 365 companion apps on December 16 and has asked admins to remove them from managed devices. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/09/05/Microsoft-365.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 22 Sep 2026 13:23:35 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, retire, Microsoft, 365, Companion, apps, December</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Cisco 0&#45;Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks</title>
<link>https://teqmanch.com/weekly-recap-cisco-0-day-ai-agent-rce-clickfix-attacks-clickfix-surge-and-browser-hijacks</link>
<guid>https://teqmanch.com/weekly-recap-cisco-0-day-ai-agent-rce-clickfix-attacks-clickfix-surge-and-browser-hijacks</guid>
<description><![CDATA[ A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week.

The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost too easy. Even the research side is getting messy, with more findings, more automation, and not ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjovXeakmAmPG68i_kNoeGFJjwSSGDdpj-29aojemBxtTQVOHzR668zKtV5GGPhnJ0zyCEdlsNCc11LIT-F8n1U8Rkv3jr-3AAt6HC4YwwyfENs_Y8V-O_OlPC4_WByxrsUBq6NifTKHQpgWuSnIqnV4bg4rXVoe9BrtMtgRCo4ECfMLWHRIKOQsqjb0zEt/s1600/recap-2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Cisco, 0-Day, Agent, RCE, ClickFix, Attacks, ClickFix, Surge, and, Browser, Hijacks</media:keywords>
</item>

<item>
<title>TASK#STOMP PowerShell Backdoor Steals Documents, Wi&#45;Fi Passwords, and Clipboard Data</title>
<link>https://teqmanch.com/taskstomp-powershell-backdoor-steals-documents-wi-fi-passwords-and-clipboard-data</link>
<guid>https://teqmanch.com/taskstomp-powershell-backdoor-steals-documents-wi-fi-passwords-and-clipboard-data</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts.

The backdoor &quot;automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC3vJ8DX6852JxHepz1kGmunH3ZXsStcK4LINkLBCrzS8ZacBhqL-7epmGuzSNGI-jpF4GtkM-FXUsrv3croTLimjG_SBbw-rpO8NBIHf6Wvr6BMmYYSDKxEPQI-nrSFYrc9vmojcKn50LRFbc1t3h8qFA8dE_pZ3kMvelRpBFVFe2ZmCVJhPCWlMxYZpO/s1600/stomp.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>TASKSTOMP, PowerShell, Backdoor, Steals, Documents, Wi-Fi, Passwords, and, Clipboard, Data</media:keywords>
</item>

<item>
<title>ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure</title>
<link>https://teqmanch.com/clickfix-lures-deploy-chainscript-rat-using-polygon-to-rotate-c2-infrastructure</link>
<guid>https://teqmanch.com/clickfix-lures-deploy-chainscript-rat-using-polygon-to-rotate-c2-infrastructure</guid>
<description><![CDATA[ Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript.

&quot;ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software,&quot; Blackpoint Adversary Pursuit Group (APG) ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-cgmwQRZh142Z19A3s7K7tpaXtsyy6Imy9cYGM7nFP1DAZoSK9gDw8T0dGXlkFWOGDFShJWMNjC7jbwoSvLokr1pX27u2B1SABpBL-aWtaXj2hYYrqVwTE7LpEDn_iIbRYCro8sH2hzAEsjHLGkpFqTjEKlFHi2o2pgacFJQvYkPDCKVEhkJgW8OWhpZA/s1600/poly.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>ClickFix, Lures, Deploy, ChainScript, RAT, Using, Polygon, Rotate, Infrastructure</media:keywords>
</item>

<item>
<title>Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors</title>
<link>https://teqmanch.com/jade-sleet-linked-to-indian-it-provider-breach-with-flatroof-and-roofdeck-backdoors</link>
<guid>https://teqmanch.com/jade-sleet-linked-to-indian-it-provider-breach-with-flatroof-and-roofdeck-backdoors</guid>
<description><![CDATA[ The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based &quot;much smaller organization&quot; in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks.

Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-xFiujwBJLdl6_4wZSMCWdeyCgev2EqszOLkIJ5I9Kbanu6YNmQ36nM615XmLQ-sq2aqldOHfl47jaMNRtDd80RT8k5f6I7eQuszf7wsIg49sEdMW36hsEKUtVUkZabRlGvvDxn7H7COmRCV8qP2pzQm9LNo5QKRnnptxmxTlJ8BMcPxuiqdaMjn-are0/s1600/it-services.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Jade, Sleet, Linked, Indian, Provider, Breach, With, FLATROOF, and, ROOFDECK, Backdoors</media:keywords>
</item>

<item>
<title>Google fined €403 million over location data privacy violations</title>
<link>https://teqmanch.com/google-fined-403-million-over-location-data-privacy-violations</link>
<guid>https://teqmanch.com/google-fined-403-million-over-location-data-privacy-violations</guid>
<description><![CDATA[ Ireland&#039;s Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processing users&#039; location data. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/03/12/Google.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Google, fined, €403, million, over, location, data, privacy, violations</media:keywords>
</item>

<item>
<title>Microsoft fixes broken Excel copy and paste for all Office users</title>
<link>https://teqmanch.com/microsoft-fixes-broken-excel-copy-and-paste-for-all-office-users</link>
<guid>https://teqmanch.com/microsoft-fixes-broken-excel-copy-and-paste-for-all-office-users</guid>
<description><![CDATA[ Microsoft has fixed a known issue that causes copy-and-paste failures for Excel users after installing the September 2026 security updates. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/18/Microsoft-Excel.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, fixes, broken, Excel, copy, and, paste, for, all, Office, users</media:keywords>
</item>

<item>
<title>FBI&amp;apos;s CJIS v6.1: What Security Teams Need to Know.</title>
<link>https://teqmanch.com/fbis-cjis-v61-what-security-teams-need-to-know</link>
<guid>https://teqmanch.com/fbis-cjis-v61-what-security-teams-need-to-know</guid>
<description><![CDATA[ The FBI&#039;s CJIS Security Policy v6.1 strengthens requirements around encryption and vulnerability scanning while continuing the shift toward more continuous security assessment. Specops explains what changed and how agencies can address password, MFA, and identity requirements as they prepare for upcoming audits. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/14/specops-legal-doc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>FBIs, CJIS, v6.1:, What, Security, Teams, Need, Know.</media:keywords>
</item>

<item>
<title>Microsoft reminds admins to migrate Entra ID users to passkeys</title>
<link>https://teqmanch.com/microsoft-reminds-admins-to-migrate-entra-id-users-to-passkeys</link>
<guid>https://teqmanch.com/microsoft-reminds-admins-to-migrate-entra-id-users-to-passkeys</guid>
<description><![CDATA[ Microsoft has reminded admins to migrate Entra ID users to phishing-resistant authentication methods to avoid sign-in disruptions after it retires SMS first-factor sign-in starting in February 2027. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/03/12/Hacking_login.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, reminds, admins, migrate, Entra, users, passkeys</media:keywords>
</item>

<item>
<title>Microsoft: September updates break File History backup feature</title>
<link>https://teqmanch.com/microsoft-september-updates-break-file-history-backup-feature</link>
<guid>https://teqmanch.com/microsoft-september-updates-break-file-history-backup-feature</guid>
<description><![CDATA[ Microsoft warned that the built-in File History backup feature in Windows may stop working on some systems after installing the September 2026 security updates. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/02/13/Windows-headpic.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 23:18:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft:, September, updates, break, File, History, backup, feature</media:keywords>
</item>

<item>
<title>Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws</title>
<link>https://teqmanch.com/claude-opus-5-helped-researchers-take-over-openai-staff-accounts-via-chained-flaws</link>
<guid>https://teqmanch.com/claude-opus-5-helped-researchers-take-over-openai-staff-accounts-via-chained-flaws</guid>
<description><![CDATA[ Three researchers at the security firm Hacktron used Anthropic&#039;s Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository.

The chain began with a bug in the software that runs OpenAI&#039;s public help forum and moved through a weakness in OpenAI&#039;s own login system.

This was security research, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAElV4rXwWf_kTjj5e0UJFsEG-a0B7MUsCFqhFLYEA76kk2A7UeXbaG0DfRt-Syf7dxx4bHUanr0lVvwIUFyFgtPIfhyphenhyphenx61ccuo3oDZr6-wKROoEAVWjrAcKWuZ5WdlvL_pmKC91i9juBrsnI3FiLTGGgjnnJRAnjTgAxAbMjcbCTxZSWybZPPtG8HN1E/s1600/claude-openai.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Claude, Opus, Helped, Researchers, Take, Over, OpenAI, Staff, Accounts, via, Chained, Flaws</media:keywords>
</item>

<item>
<title>Identity Visibility in 2026: The Foundation of Identity Security</title>
<link>https://teqmanch.com/identity-visibility-in-2026-the-foundation-of-identity-security</link>
<guid>https://teqmanch.com/identity-visibility-in-2026-the-foundation-of-identity-security</guid>
<description><![CDATA[ Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in breach research, including Verizon&#039;s annual Data Breach Investigations Report. This article explains what identity visibility means in IAM, why cloud and multicloud environments complicate it, which capabilities matter in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTFTNQKV-yV8FRZZRLBPRxZDhk6E7s3v8SpP5xW_aeDyMz-xMvi-xAVUmvDvMC-CnU1kddKpVGN9BBzeoH4xeq8zE3OAqUq5441sYhC4tfYcyU1-3_yPkVphC-20dCQX_e5kN_G-Ji42wbYuxavkjczHwYn9QP0WRXnN16KUA33kizHwh38yQl7clZAA0/s1600/ORCHID-1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Identity, Visibility, 2026:, The, Foundation, Identity, Security</media:keywords>
</item>

<item>
<title>SolarWinds Patches ARM Hard&#45;Coded Key Flaw Enabling Unauthenticated RCE</title>
<link>https://teqmanch.com/solarwinds-patches-arm-hard-coded-key-flaw-enabling-unauthenticated-rce</link>
<guid>https://teqmanch.com/solarwinds-patches-arm-hard-coded-key-flaw-enabling-unauthenticated-rce</guid>
<description><![CDATA[ SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability.

The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior.

&quot;SolarWinds ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXW-SaTg898BaxxlrDjSCrcm6ZYDgxoeuYCBY4QNWs6Nt5RhyphenhyphenCf4iSIyodz-7jk8rTqUT8hjlMT74dIf6ZjL_pD5NmiNbAHhsZwzw2rakJUDaU1tVeEvKw7Az3tMf34Xwh3ffToJeI1tpTQ8rAR8AvVn2XTupFgfhehb9sHClHDDGeDd4Y9z4oUf5CYPoS/s1600/solar.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>SolarWinds, Patches, ARM, Hard-Coded, Key, Flaw, Enabling, Unauthenticated, RCE</media:keywords>
</item>

<item>
<title>Critical Pre&#45;Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild</title>
<link>https://teqmanch.com/critical-pre-auth-rce-in-orkes-conductor-workflow-platform-exploited-in-the-wild</link>
<guid>https://teqmanch.com/critical-pre-auth-rce-in-orkes-conductor-workflow-platform-exploited-in-the-wild</guid>
<description><![CDATA[ A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet.

The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution.

&quot;Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL-YeIVFaRBKvtwQKBxAilhKMaZP_x6L979d8JL60W3AEHy9o2sfL_dMrJWy_sPIV70oIbP6DYe2KVhHh-mwbB4zBvrV_jEgdRiuc_IzNyyPSfUAOGvAp7J7JO06OWUWjSwuqpU4JJ_kNy0vtW1D9_gEtQNNVmWiYzRTpYMwhe-J3Bvve3EHrAp81Wht4L/s1600/orkes.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Critical, Pre-Auth, RCE, Orkes, Conductor, Workflow, Platform, Exploited, the, Wild</media:keywords>
</item>

<item>
<title>Google Gemini Broke Into Real Company Systems After Security Test Domain Mix&#45;Up</title>
<link>https://teqmanch.com/google-gemini-broke-into-real-company-systems-after-security-test-domain-mix-up</link>
<guid>https://teqmanch.com/google-gemini-broke-into-real-company-systems-after-security-test-domain-mix-up</guid>
<description><![CDATA[ Google&#039;s Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a cybersecurity evaluation. The development was first reported by The Wall Street Journal.

The incidents occurred in May 2026 as part of a test run conducted by Israeli company Irregular. The evaluation partner was also involved in similar hacks disclosed ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgm1vwiJZKRchF7LYZ5yklmFs_RohvMasYHTdoHF_qDFFePLtM0KdHNBzPMWQYWlN05rsn5gBZ0SV3mU69LwLtHTVNf_59TpPC3pOn-z1ENVZw-V0kdX7W4j-K83Vtc7ukjZIQjXxSEFTmo3-wkx5hL7IGdxkUXKQYHzGy-IAcetXr70chvzQxtRahueg2H/s1600/gemini-hack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Google, Gemini, Broke, Into, Real, Company, Systems, After, Security, Test, Domain, Mix-Up</media:keywords>
</item>

<item>
<title>CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories</title>
<link>https://teqmanch.com/crowdsec-says-tanstack-npm-attack-led-to-copy-of-170-private-github-repositories</link>
<guid>https://teqmanch.com/crowdsec-says-tanstack-npm-attack-led-to-copy-of-170-private-github-repositories</guid>
<description><![CDATA[ An attacker copied about 170 of CrowdSec&#039;s private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18.

The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May&#039;s supply chain attack on TanStack, in which malicious versions of TanStack&#039;s npm packages stole credentials from ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1oastBaXn1Z-Cqbx-BPWZb2oSsgDseV8bReFs787OUvmfsQxJppvU6Fq_uUY_yrCdz1Z4xuevbNRdG88X9lnejn0NUF2RILOB8VxTm8lGXQ6VpZ1hPPqfmC4U86Ci2iYpIqpjy_3H3rCxJe6_9AKm0U9vgO6GHGrDHaKSdzCcFfgpUolbZvSB6VPbCC8/s1600/crowdsec.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>CrowdSec, Says, TanStack, npm, Attack, Led, Copy, 170, Private, GitHub, Repositories</media:keywords>
</item>

<item>
<title>CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild</title>
<link>https://teqmanch.com/cisa-flags-three-linux-kernel-vulnerabilities-exploited-in-the-wild</link>
<guid>https://teqmanch.com/cisa-flags-three-linux-kernel-vulnerabilities-exploited-in-the-wild</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The vulnerabilities are listed below -


  CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcKuQ4GC9r1-4fQ3Ap_CQko0y3nMI0SnATF3WNSv48uFtNskrV4PqnyW4s0L7sXcojrHoJCEZRazGJNz5JhxrTTSYZSAQeD-xwdquE3X7pJ_ylBUerrybIiaE3V-i1vXdiLr_N1KCM9GTmeAKLlgySqEr0QeCB5ckvnppiEHSZhnEqv0IfUnqCKdA1kKsN/s1600/cisa-linux.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>CISA, Flags, Three, Linux, Kernel, Vulnerabilities, Exploited, the, Wild</media:keywords>
</item>

<item>
<title>Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root</title>
<link>https://teqmanch.com/public-exploits-released-for-four-linux-kernel-flaws-that-enable-local-root</link>
<guid>https://teqmanch.com/public-exploits-released-for-four-linux-kernel-flaws-that-enable-local-root</guid>
<description><![CDATA[ A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access on a machine.

Kernel maintainers have fixed all four over the past few weeks, so a system running an up-to-date kernel is not affected. But the exploit code is now public, and any machine still running an older kernel should be updated.

The flaws ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixfmcEQbMRp9dJbUmuhA3LSquz7yG3lph_Nbh6NqiVGOPOiOoKYcWbspSqEDBpeyUMH-KK_DHWoBSFmaZPE_BlWRjy4swhpEPCBJ-p2NCJRTceTeDx84tDToap0VrFW304zxv0nKsRSVOMM3GPhFyJ7GZkGPG92N3aKvW3edGBBdoAJl0_fH6IehDA0I8/s1600/linux-kernel.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Public, Exploits, Released, for, Four, Linux, Kernel, Flaws, That, Enable, Local, Root</media:keywords>
</item>

<item>
<title>New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution</title>
<link>https://teqmanch.com/new-wordpress-click2shell-flaw-forces-theme-installs-can-chain-to-code-execution</link>
<guid>https://teqmanch.com/new-wordpress-click2shell-flaw-forces-theme-installs-can-chain-to-code-execution</guid>
<description><![CDATA[ WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install.

The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRmEdVvBEJZEaIzJ4GYHX3cDjJq5YaLQby6GeVwDl-uVl_qIR_tkRSx6aKpzoYhGVvp0E3NDIe9aum5f5N_lI-RPz6eDNGHC7vpKMa0UrlT1J1_bRJrJ8Wk0htpyFoR3ezoqh-BCJePJU914UFlL7gS45RXbWoVi3Lp49iNSkUt7eLrJyQTAEIGE-VRgY/s1600/click2shell.gif" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>New, WordPress, Click2Shell, Flaw, Forces, Theme, Installs, Can, Chain, Code, Execution</media:keywords>
</item>

<item>
<title>Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2</title>
<link>https://teqmanch.com/transparent-tribe-deploys-new-rust-backdoor-using-private-github-repositories-for-c2</link>
<guid>https://teqmanch.com/transparent-tribe-deploys-new-rust-backdoor-using-private-github-repositories-for-c2</guid>
<description><![CDATA[ The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan.

The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhBM0nXgCLpwEyXmAdxLO_GatYww1Cem0yuGGqhmMwCB5N8w-TeoMm7jV4SbH4hjfYmxctUjyPiSlR3Caj2cSu7L_1nxTzg5xtfJrxhq5y0elL7yh8J2S5lakpnTbck3XhMVB1iG3obibSh64E8z877YcECkeJBs_rrZARXefKDeYQJ9Nf2u8pnxD0gEnx/s1600/rust-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Transparent, Tribe, Deploys, New, Rust, Backdoor, Using, Private, GitHub, Repositories, for</media:keywords>
</item>

<item>
<title>Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation</title>
<link>https://teqmanch.com/microsoft-patches-cvss-100-azure-ai-foundry-flaw-enabling-unauthorized-privilege-escalation</link>
<guid>https://teqmanch.com/microsoft-patches-cvss-100-azure-ai-foundry-flaw-enabling-unauthorized-privilege-escalation</guid>
<description><![CDATA[ Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required.

The vulnerability, tracked as CVE-2026-85889, carries a CVSS score of 10.0.

&quot;Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiML2C2l_2QmIUPPt9Gs6K9nVdVk9WZWhJaeBQjf92a7R0O0ghnhNznkqPHwG1quCmfadrkibl0WJhLioNmbATDXGxPcy6EHuDVvUrcDF_q0m23IQD1CxL0DsMZT2ZnXCtOyGADMztIcBmgQzaAvNQR39JWnvbG085s4q4W01UQnH4g-Yj15_ZKrJXDaOpQ/s1600/ms-azure.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, Patches, CVSS, 10.0, Azure, Foundry, Flaw, Enabling, Unauthorized, Privilege, Escalation</media:keywords>
</item>

<item>
<title>An Abandoned CDN Domain Was Re&#45;Registered. Thousands of Sites Still Call It.</title>
<link>https://teqmanch.com/an-abandoned-cdn-domain-was-re-registered-thousands-of-sites-still-call-it</link>
<guid>https://teqmanch.com/an-abandoned-cdn-domain-was-re-registered-thousands-of-sites-still-call-it</guid>
<description><![CDATA[ In July 2025, someone registered a domain that used to belong to a content delivery network.  The CDN had been wound down years earlier, and the domain it served assets from was allowed to expire. What it had not lost were its callers. Thousands of websites, code repositories, and documentation pages still carry hard-coded references to hostnames beneath it. 

The new owner holds ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4A312zOZ7ftKXmWapCccs7ZW6g3d61vCPFzToGj6Y9nRb2cXUHcQ9__5Taotig6y1W_tljoo5ih74cJCTxZzfz5Ii0MMoLcBuUZS6fQCgn_L4zmq92Zamf2FJM-oT3ptyyzPM-2c1oyZSZSn3eYiUp0QidqC2N2tYT9GFrqAYitjrco1cmrDJRCm6HEk/s1600/report-uri.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Abandoned, CDN, Domain, Was, Re-Registered., Thousands, Sites, Still, Call, It.</media:keywords>
</item>

<item>
<title>Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents</title>
<link>https://teqmanch.com/plugin4shell-lets-repository-owners-swap-pinned-plugin-code-across-four-ai-coding-agents</link>
<guid>https://teqmanch.com/plugin4shell-lets-repository-owners-swap-pinned-plugin-code-across-four-ai-coding-agents</guid>
<description><![CDATA[ A flaw in four widely used AI coding agents lets someone who controls a plugin&#039;s code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday.

The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizNK9maRYTbrRVwr9_9b7Sm_IizPdRJh0AbH1GtKU1BNPrcxJydnUdRQxRxauE5p1ejpfk4ihANpP7HAoXbRCDD1Pu-ZZD1dnfzLFjysOSJm7gGRKYrkUjxVF-tX-0neJMQtN87iyk1DRD70hKKtFU_J6idWK4aoZr3k4DAz4q8pkjTfKTX10Vttaiwag/s1600/coding-agents.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Plugin4Shell, Lets, Repository, Owners, Swap, Pinned, Plugin, Code, Across, Four, Coding, Agents</media:keywords>
</item>

<item>
<title>WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage</title>
<link>https://teqmanch.com/weaselbiscuit-stealer-spreads-via-13-npm-packages-to-harvest-chrome-extension-storage</link>
<guid>https://teqmanch.com/weaselbiscuit-stealer-spreads-via-13-npm-packages-to-harvest-chrome-extension-storage</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit.

The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People&#039;s Republic of Korea&#039;s (DPRK) Contagious Interview campaign: BeaverTail and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZypkEn_5V1qllBxmH8UMxTPyA9qoXxQtKpBpJlFq2rtHgMM1wnknkyq4Vmmy0NiCHn2IjS0nyvtmiZpJ-vYOd6VxMFBexh_p6GXuq3Cjda-YfjDOUE5u5V5HfBBAQzEm5DLX3jg_ZrIfEBFlpcBod65T3Q0pXVR7vERfitlS6cBHYVG2K7ek5ivweYTRq/s1600/npm-chrome.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>WeaselBiscuit, Stealer, Spreads, via, npm, Packages, Harvest, Chrome, Extension, Storage</media:keywords>
</item>

<item>
<title>Malicious npm packages evade install&#45;script defenses at runtime</title>
<link>https://teqmanch.com/malicious-npm-packages-evade-install-script-defenses-at-runtime</link>
<guid>https://teqmanch.com/malicious-npm-packages-evade-install-script-defenses-at-runtime</guid>
<description><![CDATA[ An ongoing npm malware campaign involving the &#039;indexed-btree&#039; package shows how threat actors bypass supply chain defenses by hiding malicious code in a package&#039;s normal runtime behavior rather than in installation scripts. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/05/15/npm.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Malicious, npm, packages, evade, install-script, defenses, runtime</media:keywords>
</item>

<item>
<title>Researchers escape OpenAI Codex sandbox to run commands on host</title>
<link>https://teqmanch.com/researchers-escape-openai-codex-sandbox-to-run-commands-on-host</link>
<guid>https://teqmanch.com/researchers-escape-openai-codex-sandbox-to-run-commands-on-host</guid>
<description><![CDATA[ Researchers escaped OpenAI&#039;s Codex sandbox two ways, one running commands on a developer&#039;s machine from its most locked-down mode. OpenAI has patched both. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/17/OpenAI.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Researchers, escape, OpenAI, Codex, sandbox, run, commands, host</media:keywords>
</item>

<item>
<title>BragJack attacks hijack AI browser agents through malicious extensions</title>
<link>https://teqmanch.com/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions</link>
<guid>https://teqmanch.com/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions</guid>
<description><![CDATA[ BragJack, a proof-of-concept attack from Forever Security&#039;s Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome using one malicious extension. The Prompt Forcing technique earned over $20,000 in bounties and two CVEs. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/19/browsers-header.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>BragJack, attacks, hijack, browser, agents, through, malicious, extensions</media:keywords>
</item>

<item>
<title>North Korean WaterPlum hackers infected 30,000 devices worldwide</title>
<link>https://teqmanch.com/north-korean-waterplum-hackers-infected-30000-devices-worldwide</link>
<guid>https://teqmanch.com/north-korean-waterplum-hackers-infected-30000-devices-worldwide</guid>
<description><![CDATA[ A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/08/12/north-korean-hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>North, Korean, WaterPlum, hackers, infected, 30, 000, devices, worldwide</media:keywords>
</item>

<item>
<title>ShinyHunters hacks Clop leak site, threatens to extort ransomware gang</title>
<link>https://teqmanch.com/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang</link>
<guid>https://teqmanch.com/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang</guid>
<description><![CDATA[ The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation&#039;s data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/06/15/emoji-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>ShinyHunters, hacks, Clop, leak, site, threatens, extort, ransomware, gang</media:keywords>
</item>

<item>
<title>Viral AI actress&amp;apos; hotline face&#45;scans every caller, watches their mood</title>
<link>https://teqmanch.com/viral-ai-actress-hotline-face-scans-every-caller-watches-their-mood</link>
<guid>https://teqmanch.com/viral-ai-actress-hotline-face-scans-every-caller-watches-their-mood</guid>
<description><![CDATA[ AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored last night. Her &quot;Talking Tilly&quot; video call service face-scans every caller for an 18+ age check, senses callers&#039; moods during calls, and shuts down permanently on September 27. We tried it and read the fine print. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/19/tilly-norwood-face-scan-header-1600x900.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Viral, actress, hotline, face-scans, every, caller, watches, their, mood</media:keywords>
</item>

<item>
<title>Gyazo server flaw exploited to steal 23.6 million user records</title>
<link>https://teqmanch.com/gyazo-server-flaw-exploited-to-steal-236-million-user-records</link>
<guid>https://teqmanch.com/gyazo-server-flaw-exploited-to-steal-236-million-user-records</guid>
<description><![CDATA[ The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/18/gyazo.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Gyazo, server, flaw, exploited, steal, 23.6, million, user, records</media:keywords>
</item>

<item>
<title>Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer</title>
<link>https://teqmanch.com/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer</link>
<guid>https://teqmanch.com/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer</guid>
<description><![CDATA[  An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/06/23/lastpass.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Fake, LastPass, Authenticator, GitHub, repos, push, new, Rapuncel, infostealer</media:keywords>
</item>

<item>
<title>Secure enterprise sharing with access reviews for Microsoft 365</title>
<link>https://teqmanch.com/secure-enterprise-sharing-with-access-reviews-for-microsoft-365</link>
<guid>https://teqmanch.com/secure-enterprise-sharing-with-access-reviews-for-microsoft-365</guid>
<description><![CDATA[ Microsoft 365 makes sharing files easy, but access can remain long after its original purpose has ended, leaving organizations with little visibility into who can still reach sensitive data. tenfold Software explains how centralized access governance and owner-driven reviews can help identify and remove unnecessary access. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/09/tenfold-upload.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Secure, enterprise, sharing, with, access, reviews, for, Microsoft, 365</media:keywords>
</item>

<item>
<title>Microsoft Teams will let admins block custom file extensions</title>
<link>https://teqmanch.com/microsoft-teams-will-let-admins-block-custom-file-extensions</link>
<guid>https://teqmanch.com/microsoft-teams-will-let-admins-block-custom-file-extensions</guid>
<description><![CDATA[ Microsoft Teams will soon let administrators tweak the list of file extensions commonly associated with security threats to meet their company&#039;s security requirements. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/18/Microsoft-Teams.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 21 Sep 2026 10:32:22 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, Teams, will, let, admins, block, custom, file, extensions</media:keywords>
</item>

<item>
<title>Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer</title>
<link>https://teqmanch.com/claimed-bug-bounty-hunter-likely-used-llm-to-build-phantomraven-npm-stealer</link>
<guid>https://teqmanch.com/claimed-bug-bounty-hunter-likely-used-llm-to-build-phantomraven-npm-stealer</guid>
<description><![CDATA[ A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry.

&quot;The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyW8DcUYeyW1LOG-Gc3uqyV8_5rO4iwyEIM6FbRFwuvilvbfC7RSTjueJ4lEELpGvXX-22zzWuNCusN2qdODymiKNOQSz_8f1Q4u59bH7HCEZFT5PVsyBjj2NhWtlYiwvhXzXbwG_n3P_DCloZvMdajsc93hvqbJo6HCJy5wjNevUyN46ODFo7AlYsj499/s1600/npm-cicd.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 14:59:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Claimed, Bug, Bounty, Hunter, Likely, Used, LLM, Build, PhantomRaven, npm, Stealer</media:keywords>
</item>

<item>
<title>RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall</title>
<link>https://teqmanch.com/rathat-android-malware-abuses-adb-to-retain-shell-access-after-uninstall</link>
<guid>https://teqmanch.com/rathat-android-malware-abuses-adb-to-retain-shell-access-after-uninstall</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a new Android malware called RatHat that&#039;s assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.


&quot;Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5Psm8tS3JWb6ev7nZoz7YQDPIgoHj9gwbNjgjxbokxICdzRIUb5YJI-XfDx0NQgm8afhayc-Zd51hjuxqi7Sk_XxCNXoTNt7nIZWpxCBcDMLjSm3uW38HRciOu3WNtaUT0a-2NSsOX91GbXpCScryNirImMMC4lkuVysHku58maTbm9XvAwJ0-X6O_wDE/s1600/1000109602.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 14:59:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>RatHat, Android, Malware, Abuses, ADB, Retain, Shell, Access, After, Uninstall</media:keywords>
</item>

<item>
<title>Microsoft fixes broken copy and paste for Excel 2016 users</title>
<link>https://teqmanch.com/microsoft-fixes-broken-copy-and-paste-for-excel-2016-users</link>
<guid>https://teqmanch.com/microsoft-fixes-broken-copy-and-paste-for-excel-2016-users</guid>
<description><![CDATA[ Microsoft has fixed a known issue that causes copy-and-paste failures for some Excel users after installing the September 2026 KB5002914 security update. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/18/Microsoft_Excel.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 14:59:40 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, fixes, broken, copy, and, paste, for, Excel, 2016, users</media:keywords>
</item>

<item>
<title>Windows 11 24H2 Home and Pro reach end of support in October</title>
<link>https://teqmanch.com/windows-11-24h2-home-and-pro-reach-end-of-support-in-october</link>
<guid>https://teqmanch.com/windows-11-24h2-home-and-pro-reach-end-of-support-in-october</guid>
<description><![CDATA[ Microsoft reminded customers this week that devices running Windows 11 24H2 Home and Pro editions will stop receiving updates next month. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/04/01/Windows_11.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Windows, 24H2, Home, and, Pro, reach, end, support, October</media:keywords>
</item>

<item>
<title>Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries</title>
<link>https://teqmanch.com/red-heron-exploits-gitea-rce-to-compromise-13-organizations-across-six-countries</link>
<guid>https://teqmanch.com/red-heron-exploits-gitea-rce-to-compromise-13-organizations-across-six-countries</guid>
<description><![CDATA[ A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign.

&quot;Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems,&quot; Acronis Threat Research Unit (TRU) ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijvj2lBIP05rWNCbhHf0wzhfJ35HBSL0rrr99VOwBa-AzBrvlz0hpopABC1zCHMLj6mqJTNSiij7cFcocgbHUyRbh1QV3V7OCWDLXn3fJ_fRJQxaj63BC8UOjjNlcBdwZ0jdD3zWDA6XpA3Xt2an-6vAE-kyo3sPOpjNa5tzWnntDxaeia-0zzKa-PuywC/s1600/gitea-hacked.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Red, Heron, Exploits, Gitea, RCE, Compromise, Organizations, Across, Six, Countries</media:keywords>
</item>

<item>
<title>WordPress Adds Automated Plugin Reviews to Block High&#45;Risk Updates Before Distribution</title>
<link>https://teqmanch.com/wordpress-adds-automated-plugin-reviews-to-block-high-risk-updates-before-distribution</link>
<guid>https://teqmanch.com/wordpress-adds-automated-plugin-reviews-to-block-high-risk-updates-before-distribution</guid>
<description><![CDATA[ WordPress has announced it&#039;s launching an automated security review for every release of a plugin before it&#039;s distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved.

&quot;New plugins are reviewed before they enter the directory, but updates ship continuously after that,&quot; David Perez, WordPress Official Plugin ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6NRxf0-3Ca12cwdQVS-bicsxwk-06KQZJaLMbd2d217NkuO82Bld3P_E96WP8OEqZXSjDoLtW0JfnRYkQSyl0BlQDNkQoBOf7x-Q5wOmpc59Z4v1ycux0YWShQpPIyvYmMmIRJ0c5Zv_38VFrhwtdcdoxycqIm0b5Df7AeYjbr-8KCJlbujHVhmpvdtrk/s1600/wordpress-auto.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>WordPress, Adds, Automated, Plugin, Reviews, Block, High-Risk, Updates, Before, Distribution</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits</title>
<link>https://teqmanch.com/weekly-recap-rogue-ai-agents-wechat-worm-papercut-attacks-ai-espionage-and-rootkits</link>
<guid>https://teqmanch.com/weekly-recap-rogue-ai-agents-wechat-worm-papercut-attacks-ai-espionage-and-rootkits</guid>
<description><![CDATA[ AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination.

The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgubijVX34VFFHDXzT2j2iTTWrHaElVXjylLKHKAjeSU59q3jTZvRM_O35zw5QOCnrT8ejrYHTG-kjYyt0-R127H_2qEgIWJNuKynEL1FcM9JLyPbsJPY5OZW9rrkJpRprrxpWP8oAGZA2ARZ3xg_0DvBw1I2wbIoXKItcVEjNXQH-CXCMRyuqp1u53ALj7/s1600/recap-cyber.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Rogue, Agents, WeChat, Worm, PaperCut, Attacks, Espionage, and, Rootkits</media:keywords>
</item>

<item>
<title>AI Changed the Exposure Problem. Validation Needs to Change With It.</title>
<link>https://teqmanch.com/ai-changed-the-exposure-problem-validation-needs-to-change-with-it</link>
<guid>https://teqmanch.com/ai-changed-the-exposure-problem-validation-needs-to-change-with-it</guid>
<description><![CDATA[ There&#039;s a lot of noise around AI and cybersecurity right now. What’s actually important is far simpler, if often lost in the hubbub. Vulnerability discovery is getting faster and happening at a much greater scale, while defenders still have to work out which findings actually deserve their action.

In the first half of 2026, a whopping 35,853 CVEs were published, roughly 49% more than in the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEid_ratIPK3F0IGyzyDTTPaV26Nnh4gQoFjS0ejR49J_tbGb92GgukT-Mnr9xv9mK7h0QSdeXujxiEtD0AqVKNmrKoG9BMEuut7CB1368iyt3Gr6Xu5mAdkDsUQC86K9GZ-Uw6qfPvYYr9BUvHzn014_rzQeMS5dCVXEwkRLs3eViylo5ChmZs6QQygxE4/s1600/picus-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Changed, the, Exposure, Problem., Validation, Needs, Change, With, It.</media:keywords>
</item>

<item>
<title>Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users</title>
<link>https://teqmanch.com/malicious-twitch-browser-extension-leaks-oauth-tokens-from-nearly-31000-users</link>
<guid>https://teqmanch.com/malicious-twitch-browser-extension-leaks-oauth-tokens-from-nearly-31000-users</guid>
<description><![CDATA[ A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service.

The extension, named &quot;Twitch Enhanced Viewer | JeetBot,&quot; lists HISHIMIRO/jeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store -


  Chrome - ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguNgykDjufnR6xGrMUSq67eZ5sCFxbYjf8J6pEXekhUnt-zCt2xaJ4jzj6I0wPMYjps9z2ufKJ-JSJ8ZqhGe4BcbtNWfRETdaB6QgIRVLw0CtnsM5q2qCpyI3kL7oBXmNixcTTcumZJHFgCKaoLY8kRIBDbPHslMmmzzb25TlESGooJuaxtXEL5qrUzkop/s1600/twitch.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Malicious, Twitch, Browser, Extension, Leaks, OAuth, Tokens, From, Nearly, 31, 000, Users</media:keywords>
</item>

<item>
<title>Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds</title>
<link>https://teqmanch.com/human-attacker-exploits-marimo-rce-reaches-ssh-bastion-in-eight-seconds</link>
<guid>https://teqmanch.com/human-attacker-exploits-marimo-rce-reaches-ssh-bastion-in-eight-seconds</guid>
<description><![CDATA[ With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access.

In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzWVpv5OsfVGAYPz4or_uMgVNDXTSzyXpTB8XLtCFHdzk9IliH8Aydez_Zo9hDGSj7__A0cFwnjKUpRWn5nn4CSd5wlaIJ1-BpU29tUyeh3pC63H_kXIn9ANQna1FBENp-td6TCC6z50ZEcAeNjAZMA-tIA9_x9nYrlHqbnJOijQpbeHsQmW5tKMczy4ek/s1600/marimo (1).jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Human, Attacker, Exploits, Marimo, RCE, Reaches, SSH, Bastion, Eight, Seconds</media:keywords>
</item>

<item>
<title>Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point</title>
<link>https://teqmanch.com/attack-chains-not-just-attack-surfaces-why-testing-individual-techniques-misses-the-point</link>
<guid>https://teqmanch.com/attack-chains-not-just-attack-surfaces-why-testing-individual-techniques-misses-the-point</guid>
<description><![CDATA[ Introduction

Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my organization fail the phishing simulation? Does this SIEM rule fire on this particular technique? And, in more mature organizations, this testing happens continuously rather than as a one-off exercise.

But no matter how much you validate against these ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQ5FtIC97mlzzBT1tKZW7igSSWnJsEI-gEDuUjX-_smFr3Q-loPw-bYG2rEqPBOFPOm0SeL3Go5NvyiJo_DbqnF7ECWdg1EA0DaUML5koDFnXi_lTpJ_Vuow5bsBeQvqLTN25x3O0seE7Qxv5o3S9KoIKuQAVIu7FTPPoZm6ly5XtS97tng5LAaw3tCCY/s1600/live.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Attack, Chains, Not, Just, Attack, Surfaces:, Why, Testing, Individual, Techniques, Misses, the, Point</media:keywords>
</item>

<item>
<title>Mass&#45;Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers</title>
<link>https://teqmanch.com/mass-scanning-campaign-exploits-vite-flaw-to-extract-cloud-credentials-from-exposed-dev-servers</link>
<guid>https://teqmanch.com/mass-scanning-campaign-exploits-vite-flaw-to-extract-cloud-credentials-from-exposed-dev-servers</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data.

The first is an automated effort aimed at internet-exposed Vite development servers that&#039;s designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs.

The ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDvoBVfJIN7YwGuf64F0CQWt9GrAVzaxDWGJetCrAGM_QgGEfpZm_I7f3FTkWBydY7v_iV4n8RWPAr4jfp7ZhN9DVbVZGDryBYlZiL6dn5RuYzLd811NH_sARdjbwWIpf9kOj-jtXfLzb7BTuy-iMpHbsgB9n8J5T7Hx0qp0D1_XeJR-ANcGQ5p88YH3fE/s1600/vite.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Mass-Scanning, Campaign, Exploits, Vite, Flaw, Extract, Cloud, Credentials, From, Exposed, Dev, Servers</media:keywords>
</item>

<item>
<title>LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server</title>
<link>https://teqmanch.com/litespeed-enterprise-flaw-could-let-one-hosting-account-gain-root-access-on-a-shared-server</link>
<guid>https://teqmanch.com/litespeed-enterprise-flaw-could-let-one-hosting-account-gain-root-access-on-a-shared-server</guid>
<description><![CDATA[ A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel warned in an advisory published on September 14.

On such servers, many customers&#039; sites run on a single machine, and an attacker with one of those hosting accounts could exploit the flaw to access or alter other sites and the server itself, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRVzSne-2lfRX57xj9CbnkpX1fjEWXYoPN0tDsXwgBwaE_LVqYBKtWbO1nudNLKp89aR90EeszJUqsNvZN4ZLzU1i7hm89ihV-lK1mIKiNXl6GWAWkn6uz7WlRVfIdJrS7Nfn6x-1Cclf6oTs3RxVNWxQSVBsvhzDjMBnmU3l3oERVu3b5hqag5mSeKoU/s1600/litespeed.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>LiteSpeed, Enterprise, Flaw, Could, Let, One, Hosting, Account, Gain, Root, Access, Shared, Server</media:keywords>
</item>

<item>
<title>Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution</title>
<link>https://teqmanch.com/cisco-secure-email-gateway-flaw-exploited-in-the-wild-enables-root-command-execution</link>
<guid>https://teqmanch.com/cisco-secure-email-gateway-flaw-exploited-in-the-wild-enables-root-command-execution</guid>
<description><![CDATA[ Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild.

The vulnerability, tracked as CVE-2026-76461, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of insufficient validation in the email parsing logic that could allow an unauthenticated, remote attacker ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhu8z5yuk0NLq0i2IvKx9dibCdw5at8BanYNBhjn665PLV0EanY_s0UV0D4D0wcPijyd5r8sS4eCMDwKdsVQ9GktnqcPRympe7ZqI7Bh8ZSBukLsxFSQ3-SFRb10ylKsDPl7tU2-M3w_E0eNSe_ytrRE-JZ62fvAExuQCawQJZFjYwArFC550Ri8mOQ1q1s/s1600/cisco-email.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Cisco, Secure, Email, Gateway, Flaw, Exploited, the, Wild, Enables, Root, Command, Execution</media:keywords>
</item>

<item>
<title>China&#45;Linked Hackers Exploit Chrome&#45;Windows Zero&#45;Day Chain to Deploy GRIMWEDGE</title>
<link>https://teqmanch.com/china-linked-hackers-exploit-chrome-windows-zero-day-chain-to-deploy-grimwedge</link>
<guid>https://teqmanch.com/china-linked-hackers-exploit-chrome-windows-zero-day-chain-to-deploy-grimwedge</guid>
<description><![CDATA[ A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE.

Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026.

&quot;The ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5aJxmkQeaEoRUyxjlnH4uMELX24ICkHN1UpJaF3kM181M-V32GMskTo1YCRAf-8m4rsHw0nEYM53AC1CAZekv6yOEfBkj1ZNxL3lWatq_F5Bpuwsvw7snHIiIz62EA1pX-bPaawFgIwbvtUH020WdVwEupWi_CkYJVDog_w0LVEnMMvRYo0D7giAdtuGK/s1600/chrome-windows.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>China-Linked, Hackers, Exploit, Chrome-Windows, Zero-Day, Chain, Deploy, GRIMWEDGE</media:keywords>
</item>

<item>
<title>CISA: Critical VMware RCE flaw now exploited by ransomware gangs</title>
<link>https://teqmanch.com/cisa-critical-vmware-rce-flaw-now-exploited-by-ransomware-gangs</link>
<guid>https://teqmanch.com/cisa-critical-vmware-rce-flaw-now-exploited-by-ransomware-gangs</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/11/18/VMware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>CISA:, Critical, VMware, RCE, flaw, now, exploited, ransomware, gangs</media:keywords>
</item>

<item>
<title>Suspected Black Axe gang leaders face cybercrime charges in the US</title>
<link>https://teqmanch.com/suspected-black-axe-gang-leaders-face-cybercrime-charges-in-the-us</link>
<guid>https://teqmanch.com/suspected-black-axe-gang-leaders-face-cybercrime-charges-in-the-us</guid>
<description><![CDATA[ Five alleged leaders of the Black Axe cybercrime syndicate, known for its involvement in global-scale cyber-enabled financial fraud, have been extradited to the United States to face wire fraud and money laundering charges. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/04/24/Hackers_headpic.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Suspected, Black, Axe, gang, leaders, face, cybercrime, charges, the</media:keywords>
</item>

<item>
<title>Microsoft confirms KB5002914 Excel update breaks copy and paste</title>
<link>https://teqmanch.com/microsoft-confirms-kb5002914-excel-update-breaks-copy-and-paste</link>
<guid>https://teqmanch.com/microsoft-confirms-kb5002914-excel-update-breaks-copy-and-paste</guid>
<description><![CDATA[ Microsoft has confirmed that copy and paste may silently fail for some Excel users after installing the September 2026 KB5002914 security update. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/15/Excel.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, confirms, KB5002914, Excel, update, breaks, copy, and, paste</media:keywords>
</item>

<item>
<title>Cisco patches Secure Email Gateway zero&#45;day exploited in attacks</title>
<link>https://teqmanch.com/cisco-patches-secure-email-gateway-zero-day-exploited-in-attacks</link>
<guid>https://teqmanch.com/cisco-patches-secure-email-gateway-zero-day-exploited-in-attacks</guid>
<description><![CDATA[ Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/08/11/Cisco.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Cisco, patches, Secure, Email, Gateway, zero-day, exploited, attacks</media:keywords>
</item>

<item>
<title>Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root</title>
<link>https://teqmanch.com/critical-check-point-management-flaw-lets-unauthenticated-attackers-run-code-as-root</link>
<guid>https://teqmanch.com/critical-check-point-management-flaw-lets-unauthenticated-attackers-run-code-as-root</guid>
<description><![CDATA[ A critical vulnerability in Check Point&#039;s Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network.

The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuFSb4LQQ7e_Iz1RS0JfQEDY9G9LcQZ23RM0h6ladr56GJ6nN3kPwVoZPpNVJUyJEBmLVEyMaIxytF2XqyQs8fGjIdd_ymPjwaZA8Q8R7JiXC-srMFj0_YBd-a94juv46HZm4ie72j7PTj45veyTgOBaeuN53HvktSH3JTgasvV_Mo-RwjsTPnRLlHFVk/s1600/cp-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Critical, Check, Point, Management, Flaw, Lets, Unauthenticated, Attackers, Run, Code, Root</media:keywords>
</item>

<item>
<title>ThreatsDay: Self&#45;Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories</title>
<link>https://teqmanch.com/threatsday-self-rewriting-agents-800-flaws-patched-insider-sim-swaps-and-22-more-new-stories</link>
<guid>https://teqmanch.com/threatsday-self-rewriting-agents-800-flaws-patched-insider-sim-swaps-and-22-more-new-stories</guid>
<description><![CDATA[ Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them.

This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough.

So the threat landscape is not getting cleaner. It is just ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizRobrCcZcWNzLjEmyk91HaJj5g2vkMbOgX_lP1vNQqfvh8krm4975WJ5zi9VFY1FsF44ZTJ5znBY5sBuKYiN-riJQspK3iLLnvhW5crViG9fJMPF_SCEN3dKPk-ypSjFQfD_gN1zA-KbryzexASNOVcKRHf4hf3iZ1XBuvYG9WKWhBdVWbs1dzJS9BUIQ/s1600/threatsday-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>ThreatsDay:, Self-Rewriting, Agents, 800, Flaws, Patched, Insider, SIM, Swaps, and, More, New, Stories</media:keywords>
</item>

<item>
<title>Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files</title>
<link>https://teqmanch.com/critical-docker-sandboxes-flaw-lets-malicious-guest-code-read-and-modify-macos-host-files</link>
<guid>https://teqmanch.com/critical-docker-sandboxes-flaw-lets-malicious-guest-code-read-and-modify-macos-host-files</guid>
<description><![CDATA[ Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15.

The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJbYvRH1MRTGK43JYSWe2X3djxWAuNa3_r94FvOPBjt9sWrkRiEQi7D0DPksj3NH9vDPjm7MGSGY9UEc7JqePjd4aA-c4zuMzLZXH0Y5NWKWGnzNgbFe0tYlEFSFLrJFWVRuRKs_PQN8IKkdzYYNn8T7YWuUkZC4_2skq3deXYAw7i0aqWdx6G0FQwVzs/s1600/docker-macos.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Critical, Docker, Sandboxes, Flaw, Lets, Malicious, Guest, Code, Read, and, Modify, macOS, Host, Files</media:keywords>
</item>

<item>
<title>Iran&#45;Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords</title>
<link>https://teqmanch.com/iran-linked-handala-hack-tied-to-heavygram-telegram-backdoor-that-can-steal-passwords</link>
<guid>https://teqmanch.com/iran-linked-handala-hack-tied-to-heavygram-telegram-backdoor-that-can-steal-passwords</guid>
<description><![CDATA[ The Iran-linked &quot;hacktivist&quot; persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE.

&quot;HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdqFZ07lueoUFevcbuCOBavlR6CaAxmFqFs7hLpyqw-maKbLcISxW0Q-y7JwvoRrhDumRNaJo_Z4T6QRrGLUTDEE8yYqFfoRLmkoc_J4omdeCAmew1_5k-NwnNWJyYawal5nni-TVZu8M4aDsGNhbwlpp1Y7wLUSjsFR-olY89Mls9hD4CiL9jq0roUpzA/s1600/telegram-handala.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Iran-Linked, Handala, Hack, Tied, HEAVYGRAM, Telegram, Backdoor, That, Can, Steal, Passwords</media:keywords>
</item>

<item>
<title>Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone</title>
<link>https://teqmanch.com/critical-unbound-dnssec-validator-flaw-could-allow-rce-via-a-malicious-dns-zone</link>
<guid>https://teqmanch.com/critical-unbound-dnssec-validator-flaw-could-allow-rce-via-a-malicious-dns-zone</guid>
<description><![CDATA[ Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday.

An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution.

Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642, along with ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiiFNFekCjM7qSAMNaeoNatwUPsjJY0Nj67yGKdlhq_zzLH9tyjQrXAByn9B6BvXEcMabyWnO5oWWE11_orN2h7G-7jRjGPSW48xtd4HySWIkI1fQzCbUDCVzRyc_KG3curUoXk4LgyckPwUO8aP65kR0CYnc90pkfXctHKXVQ7grKsc43drFZ63yRur20/s1600/dns-admin.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Critical, Unbound, DNSSEC, Validator, Flaw, Could, Allow, RCE, via, Malicious, DNS, Zone</media:keywords>
</item>

<item>
<title>Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar</title>
<link>https://teqmanch.com/can-you-prove-a-new-cve-is-exploitable-before-attackers-do-learn-how-in-this-webinar</link>
<guid>https://teqmanch.com/can-you-prove-a-new-cve-is-exploitable-before-attackers-do-learn-how-in-this-webinar</guid>
<description><![CDATA[ A new CVE drops. Your scanner finds it. The severity score looks ugly.

But that still does not answer the question that matters: Can it actually be exploited in your environment?

Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs still validate risk on weekly or quarterly cycles. The dangerous gap is no longer just technical. It is ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVgJqM9WZF6u_WZBeTJKqe35CDnh_4kxjLjZa3w63XbqfKBRNUENbTh5HGVrgYUGtmLRW9Px3GGzNcewMJWzd7CRxsk66eY1D70or8gasHUroPNdbUJ6ordqjxb7s8gKqQwuyWxCWC2BT0Matusn6PLXV9xus1PlqqqD3JITL_Unxt2xP8UK6zlX9Tmr0A/s1600/cves.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Can, You, Prove, New, CVE, Exploitable, Before, Attackers, Do, Learn, How, This, Webinar</media:keywords>
</item>

<item>
<title>CISO&amp;apos;s Expert Guide to Agentic Pentesting for Websites</title>
<link>https://teqmanch.com/cisos-expert-guide-to-agentic-pentesting-for-websites</link>
<guid>https://teqmanch.com/cisos-expert-guide-to-agentic-pentesting-for-websites</guid>
<description><![CDATA[ Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production.

TL;DR

Exploitation is now the front door. It starts 31% of breaches (Verizon DBIR ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqOqtV_80Gn3utPVzonjyU94CgrwrcRNCUvdMEMZbOJGmKGOGD_ly8yH-V5AVwUtyNADgEPXySLFga7FZiWBSHCESverdknL-LS6MJSrkv6ejTaFkDM087mWkfBfur7UQ_vXsM8gcBByxyYyn0g3rAENhqJamGszCkPf2LM31d3wDgEUpCuFrGt4mZnUE/s1600/REFF.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>CISOs, Expert, Guide, Agentic, Pentesting, for, Websites</media:keywords>
</item>

<item>
<title>China&#45;Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America</title>
<link>https://teqmanch.com/china-aligned-famoussparrow-deploys-sparrowocky-backdoor-across-latin-america</link>
<guid>https://teqmanch.com/china-aligned-famoussparrow-deploys-sparrowocky-backdoor-across-latin-america</guid>
<description><![CDATA[ The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025.

&quot;SparroWocky is a modular, C++ backdoor,&quot; ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOuXwG1YyG0uUU23HOcrfuGGEs6q0HvIDe8f7tcoTc3Vg049ITdUDCK_oyfFs8F68GEANNMqayc_75ARq5bBdbIu8qplp_nwC8hWxALOjCCGyf_Pb76GvNjEEfoWybq1nM9WXuxoPvYiRN_vJewkghj5IAYOaCh9JulsW4DnZLCEOhg_mXL_ykI0_oJwah/s1600/chinese-hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>China-Aligned, FamousSparrow, Deploys, SparroWocky, Backdoor, Across, Latin, America</media:keywords>
</item>

<item>
<title>OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads</title>
<link>https://teqmanch.com/openai-reveals-six-model-incidents-involving-hidden-failures-and-unauthorized-uploads</link>
<guid>https://teqmanch.com/openai-reveals-six-model-incidents-involving-hidden-failures-and-unauthorized-uploads</guid>
<description><![CDATA[ OpenAI on Wednesday disclosed six new instances of &quot;unexpected or concerning model behavior&quot; that took place over the past six months, while sharing a new framework for reporting, tracking, investigating, and disclosing model misalignment in a bid to improve transparency.

&quot;As AI systems grow more advanced and more widely deployed, we need to build a broader and better-informed consensus on the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhz2xdqQbSjGZGGkNO0hRMgoEWNFpWVp0DDsBvsbQekWezeScq_sLAPfzY-kJenfNHYFnSqDcU93F30gmINBYYobl0Jf1thyPsXm34lbJPqMfZwPXoRy1UvpQcS_eHwF_nVqk-rDBTd83B8iteh4e23r2pnbtUsOgFPmYVRi-IlrW6-9FFUf7-DiZ8yyAOJ/s1600/openai-models.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>OpenAI, Reveals, Six, Model, Incidents, Involving, Hidden, Failures, and, Unauthorized, Uploads</media:keywords>
</item>

<item>
<title>BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS&#45;over&#45;HTTPS</title>
<link>https://teqmanch.com/bind-9-update-fixes-14-flaws-including-an-unauthenticated-crash-over-dns-over-https</link>
<guid>https://teqmanch.com/bind-9-update-fixes-14-flaws-including-an-unauthenticated-crash-over-dns-over-https</guid>
<description><![CDATA[ The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH).

A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEd6WLqBvkSx9Y2P6HrNL-VApj7Xb05Wlhnw4pPW6-X9NwGiAeAm_Hf4KYj_1hEy6uITGe8kh3xgYeTAha8nR5inx0snMzfWGP2Qd8kRuiOp0h4O49J-33kPpA1cuGhClV2qAvPyhyr2BqSYj9ZIvI6c-wncUNGESpGK-3tivnS-HIrOj9ZdSJALq_8Ts/s1600/bind9.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>BIND, Update, Fixes, Flaws, Including, Unauthenticated, Crash, Over, DNS-over-HTTPS</media:keywords>
</item>

<item>
<title>Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records</title>
<link>https://teqmanch.com/gyazo-breach-exposes-2362-million-user-records-and-490-million-image-metadata-records</link>
<guid>https://teqmanch.com/gyazo-breach-exposes-2362-million-user-records-and-490-million-image-metadata-records</guid>
<description><![CDATA[ A security breach at Gyazo, Helpfeel&#039;s image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday.

It also exposed about 490 million image metadata records, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo image links.

Helpfeel said ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjo_VMcM5A8FocwrVqXOjmk-BvMd3D_JA6RIur9wT4Gca5jQjiLLinldpcu3u2hWmJQeJZg5nhVRBwxHe2y0BHg1TZEd046RkPLatyX5JN-7_WtuRyPMX3VnMCAs7tfCYOSghFuBCUT6HFyCBH-bLeAPWlAj9TPtAn1sitCktd2vp_pJr6VtzHd2_EFDpo/s1600/gyazo.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Gyazo, Breach, Exposes, 23.62, Million, User, Records, and, 490, Million, Image, Metadata, Records</media:keywords>
</item>

<item>
<title>Cisco Warns of New Zero&#45;Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks</title>
<link>https://teqmanch.com/cisco-warns-of-new-zero-day-ise-auth-bypass-cvss-100-exploited-in-active-attacks</link>
<guid>https://teqmanch.com/cisco-warns-of-new-zero-day-ise-auth-bypass-cvss-100-exploited-in-active-attacks</guid>
<description><![CDATA[ Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation.

The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication.

&quot;This vulnerability is due to insufficient authentication control on an API endpoint,&quot; Cisco said. &quot;An attacker ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKC3hrw_VedPPLj2lAD6qhUn-7eJuJ8dqSBMAOwTEjUdYxlwnOla9dFF4pwOBNr-QsjzJPuXEtkA6orbkLHUqHI3RbWMBR0VeNaYvZqSnkNnM5HH-T9ofLeBzrZcOXn5nbZyNC2YeQjANmTzBAhaAwhDoGoXLJOeB1nFbIr-TJuFTHM8y0TAzj6Hxd0MYM/s1600/cisco-0-day.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Cisco, Warns, New, Zero-Day, ISE, Auth, Bypass, CVSS, 10.0, Exploited, Active, Attacks</media:keywords>
</item>

<item>
<title>U.S. Seizes NightmareStresser Domains Linked to Hundreds of Thousands of DDoS Attacks</title>
<link>https://teqmanch.com/us-seizes-nightmarestresser-domains-linked-to-hundreds-of-thousands-of-ddos-attacks</link>
<guid>https://teqmanch.com/us-seizes-nightmarestresser-domains-linked-to-hundreds-of-thousands-of-ddos-attacks</guid>
<description><![CDATA[ The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distributed denial-of-service (DDoS)-for-hire service known as NightmareStresser.

The domains in question are: nightmare-stresser[.]com and nightmarestresser[.]org. Visitors to the site are now greeted by a seizure banner that states -

&quot;This domain has been seized by the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiizrhUTj3tjdgb7IhljezkW3bnwYpTrYnUKKPyx7s7RWalycDu2JiqKhRZDgnpZdafbKxkyBrx4kjkpGTNSNXYZ-nL2wFQ_kKcRBVo14lJ5Da5SF2sq2-eOzHeRXxuJ3skSWSn5AC0XA4NjwQrhTWFOuFxvSRsmOC63AIKBxV-9bfmABkLGW4BgyfV3CSM/s1600/domain.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>U.S., Seizes, NightmareStresser, Domains, Linked, Hundreds, Thousands, DDoS, Attacks</media:keywords>
</item>

<item>
<title>Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution</title>
<link>https://teqmanch.com/attackers-exploit-issabel-framework-flaw-enabling-unauthenticated-os-command-execution</link>
<guid>https://teqmanch.com/attackers-exploit-issabel-framework-flaw-enabling-unauthenticated-os-command-execution</guid>
<description><![CDATA[ A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.

The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5aXi8Vt3MH8e38-ViNXz-m4hRPrbqDMGcpbMtOc3b-cDLIyEZEjqGvSscW6mR34ZrmPM4lSnv6C9XFTHlgq3UyGLA24gySGqcCzdKr-hIY2QZO8VSXnC-KAsdEz6vTkgdRnVxAZVM7NyrhgpL2xDWR8lcvPInEwgvj0pTgHkC7KStUFglwcLext7eb3w5/s1600/issa.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Attackers, Exploit, Issabel, Framework, Flaw, Enabling, Unauthenticated, Command, Execution</media:keywords>
</item>

<item>
<title>Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers</title>
<link>https://teqmanch.com/three-threat-groups-target-russian-enterprises-with-backdoors-ransomware-and-wipers</link>
<guid>https://teqmanch.com/three-threat-groups-target-russian-enterprises-with-backdoors-ransomware-and-wipers</guid>
<description><![CDATA[ Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky.

The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMMZZrs8eh-baUC-73E9tejQYA0JZzWyoElUJGhCi0N4_f2EzmPPhQW3xY0kmNZv775T26ywu4czdta-vHaLp1gaI03eqho2SSe3riHMZP8hLTrU1ETnIv-k1ywOpnBFvbkyQJNZt7F4Xx4NndvvS8esTt1jzaCdeN9JZNkNB8sBU1vytibSRAjMsLZzc6/s1600/russian-groups.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Three, Threat, Groups, Target, Russian, Enterprises, With, Backdoors, Ransomware, and, Wipers</media:keywords>
</item>

<item>
<title>New RatHat Android malware uses AI to automate device control</title>
<link>https://teqmanch.com/new-rathat-android-malware-uses-ai-to-automate-device-control</link>
<guid>https://teqmanch.com/new-rathat-android-malware-uses-ai-to-automate-device-control</guid>
<description><![CDATA[ A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/05/03/Android.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>New, RatHat, Android, malware, uses, automate, device, control</media:keywords>
</item>

<item>
<title>OpenAI details more cases of AI agents taking unauthorized actions</title>
<link>https://teqmanch.com/openai-details-more-cases-of-ai-agents-taking-unauthorized-actions</link>
<guid>https://teqmanch.com/openai-details-more-cases-of-ai-agents-taking-unauthorized-actions</guid>
<description><![CDATA[ OpenAI has presented new examples of what they call &quot;AI model misalignment&quot; from the past six months, including unauthorized file uploads, following self-generated instructions, hiding mistakes, and leveraging exposed API keys. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/17/OpenAI.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>OpenAI, details, more, cases, agents, taking, unauthorized, actions</media:keywords>
</item>

<item>
<title>Brevo supply&#45;chain attack injected ClickFix scripts on customer sites</title>
<link>https://teqmanch.com/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites</link>
<guid>https://teqmanch.com/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites</guid>
<description><![CDATA[ Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/12/10/hacker-box.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Brevo, supply-chain, attack, injected, ClickFix, scripts, customer, sites</media:keywords>
</item>

<item>
<title>What Recent AI&#45;Powered Attacks Mean for Your Identity Security</title>
<link>https://teqmanch.com/what-recent-ai-powered-attacks-mean-for-your-identity-security</link>
<guid>https://teqmanch.com/what-recent-ai-powered-attacks-mean-for-your-identity-security</guid>
<description><![CDATA[ AI is making credential theft faster and easier to scale, giving attackers more opportunities to abuse valid identities. Specops explains why identity security must go beyond successful authentication by verifying that both the user and the device requesting access can be trusted. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/09/specops-hands-typing.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>What, Recent, AI-Powered, Attacks, Mean, for, Your, Identity, Security</media:keywords>
</item>

<item>
<title>US takes down NightmareStresser DDoS&#45;for&#45;hire platform</title>
<link>https://teqmanch.com/us-takes-down-nightmarestresser-ddos-for-hire-platform</link>
<guid>https://teqmanch.com/us-takes-down-nightmarestresser-ddos-for-hire-platform</guid>
<description><![CDATA[ The U.S. Federal Bureau of Investigation (FBI) seized the domains used by NightmareStresser, one of the world&#039;s longest-running distributed denial-of-service (DDoS) platforms. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/06/12/DDoS-outage-map-globe.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>takes, down, NightmareStresser, DDoS-for-hire, platform</media:keywords>
</item>

<item>
<title>Chinese hackers use SparroWocky malware in govt espionage attacks</title>
<link>https://teqmanch.com/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attacks</link>
<guid>https://teqmanch.com/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attacks</guid>
<description><![CDATA[ The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/04/23/China.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Chinese, hackers, use, SparroWocky, malware, govt, espionage, attacks</media:keywords>
</item>

<item>
<title>Microsoft shares workaround for Windows domain login issues</title>
<link>https://teqmanch.com/microsoft-shares-workaround-for-windows-domain-login-issues</link>
<guid>https://teqmanch.com/microsoft-shares-workaround-for-windows-domain-login-issues</guid>
<description><![CDATA[ Microsoft shared a temporary fix on Wednesday for a known issue that prevents Windows 11 users from logging in with valid domain credentials after installing the September 2026 security updates. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/02/07/Windows_11.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, shares, workaround, for, Windows, domain, login, issues</media:keywords>
</item>

<item>
<title>Cisco warns of max severity ISE zero&#45;day exploited in attacks</title>
<link>https://teqmanch.com/cisco-warns-of-max-severity-ise-zero-day-exploited-in-attacks</link>
<guid>https://teqmanch.com/cisco-warns-of-max-severity-ise-zero-day-exploited-in-attacks</guid>
<description><![CDATA[ Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/07/02/Cisco.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Cisco, warns, max, severity, ISE, zero-day, exploited, attacks</media:keywords>
</item>

<item>
<title>Anthropic wants Claude to analyze your bank account and financial data</title>
<link>https://teqmanch.com/anthropic-wants-claude-to-analyze-your-bank-account-and-financial-data</link>
<guid>https://teqmanch.com/anthropic-wants-claude-to-analyze-your-bank-account-and-financial-data</guid>
<description><![CDATA[ Anthropic is testing a new personal finance feature called &quot;Claude Money&quot; that will allow you to connect your bank accounts directly to Claude and &quot;understand your money.&quot; [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/05/07/Claude_AI.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 18 Sep 2026 11:38:10 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Anthropic, wants, Claude, analyze, your, bank, account, and, financial, data</media:keywords>
</item>

<item>
<title>Microsoft releases emergency Windows updates to fix RDS failures</title>
<link>https://teqmanch.com/microsoft-releases-emergency-windows-updates-to-fix-rds-failures</link>
<guid>https://teqmanch.com/microsoft-releases-emergency-windows-updates-to-fix-rds-failures</guid>
<description><![CDATA[ Microsoft has released emergency out-of-band Windows updates to fix Remote Desktop Services failures caused by this month&#039;s security updates, along with Hyper-V and USB audio problems on some Windows versions. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2023/10/19/Microsoft_headpic.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, releases, emergency, Windows, updates, fix, RDS, failures</media:keywords>
</item>

<item>
<title>Japan&amp;apos;s Digital Agency says VPN flaw exposed 246,000 personnel records</title>
<link>https://teqmanch.com/japans-digital-agency-says-vpn-flaw-exposed-246000-personnel-records</link>
<guid>https://teqmanch.com/japans-digital-agency-says-vpn-flaw-exposed-246000-personnel-records</guid>
<description><![CDATA[ Japan&#039;s Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/14/japan.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Japans, Digital, Agency, says, VPN, flaw, exposed, 246, 000, personnel, records</media:keywords>
</item>

<item>
<title>Homebrew 7.0.0 gets built&#45;in GUI, better security controls</title>
<link>https://teqmanch.com/homebrew-700-gets-built-in-gui-better-security-controls</link>
<guid>https://teqmanch.com/homebrew-700-gets-built-in-gui-better-security-controls</guid>
<description><![CDATA[ Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/01/21/homebrew.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Homebrew, 7.0.0, gets, built-in, GUI, better, security, controls</media:keywords>
</item>

<item>
<title>Webinar: How malicious OAuth apps can lead to Google Workspace breaches</title>
<link>https://teqmanch.com/webinar-how-malicious-oauth-apps-can-lead-to-google-workspace-breaches</link>
<guid>https://teqmanch.com/webinar-how-malicious-oauth-apps-can-lead-to-google-workspace-breaches</guid>
<description><![CDATA[ Attackers can combine social engineering with malicious OAuth applications to gain access to Google Workspace data without relying solely on stolen passwords. This webinar examines two attacks to show how these breaches unfold and which security controls can help stop them. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/13/oauth-breach.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Webinar:, How, malicious, OAuth, apps, can, lead, Google, Workspace, breaches</media:keywords>
</item>

<item>
<title>Microsoft: September updates cause RDS failures on Windows Server</title>
<link>https://teqmanch.com/microsoft-september-updates-cause-rds-failures-on-windows-server</link>
<guid>https://teqmanch.com/microsoft-september-updates-cause-rds-failures-on-windows-server</guid>
<description><![CDATA[ Microsoft has confirmed reports that the September 2026 security updates cause Remote Desktop Services (RDS) failures on Windows Server systems. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/04/17/Windows_Server.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft:, September, updates, cause, RDS, failures, Windows, Server</media:keywords>
</item>

<item>
<title>Revolut discloses data breach exposing financial info, passports</title>
<link>https://teqmanch.com/revolut-discloses-data-breach-exposing-financial-info-passports</link>
<guid>https://teqmanch.com/revolut-discloses-data-breach-exposing-financial-info-passports</guid>
<description><![CDATA[ Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/14/Revolut-card.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Revolut, discloses, data, breach, exposing, financial, info, passports</media:keywords>
</item>

<item>
<title>New DDRop Attack Breaks Intel TDX and AMD SEV&#45;SNP Confidential Computing</title>
<link>https://teqmanch.com/new-ddrop-attack-breaks-intel-tdx-and-amd-sev-snp-confidential-computing</link>
<guid>https://teqmanch.com/new-ddrop-attack-breaks-intel-tdx-and-amd-sev-snp-confidential-computing</guid>
<description><![CDATA[ Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently dropping writes to a server&#039;s memory, so the processor keeps reading old encrypted data as if it were current.

The attack requires an attacker who already controls the server&#039;s software and can briefly access the machine to insert a small circuit ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4IfzHWVZbbX-Jlw_WME4viVgnupLfVdkxzfZ0skzjQpB5I32f-nua5-Gt6UJGJ9-cwTyrHqaCxBFndtNkIFx_Tj9sf3LnxfrqlecJ0zh0N83i5YRdukZRTpTiUP-kVrkpF4gMJZN-tONZy7jjk2gqdq87ELsUHDlyjQDFCIX6Rioz3ljHItZ2IeLDqb-w/s1600/DDRop.gif" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>New, DDRop, Attack, Breaks, Intel, TDX, and, AMD, SEV-SNP, Confidential, Computing</media:keywords>
</item>

<item>
<title>3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials</title>
<link>https://teqmanch.com/3bb-attacker-used-meshcentral-backdoor-for-root-access-targeted-subscriber-credentials</link>
<guid>https://teqmanch.com/3bb-attacker-used-meshcentral-backdoor-for-root-access-targeted-subscriber-credentials</guid>
<description><![CDATA[ An attacker was operating inside the network of 3BB, one of Thailand&#039;s largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said.

The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker&#039;s own tools and a list of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9khzZCrFkNfQ1fOYHT8A4LJrIsfc52ppe6xZffdUrfRacqTVQ76P0VPDZhqC2UfKM32jdbEiQfaCZDbrV2F0_dssOM8V8nT3ZZYvwhflLdfEhJhdNa0-UntK9XHkFJ4R5RthFMOM2X5kDZxUKW1RnRLmmQ0xLh5foMldMZovB0ZPdafoRf9cEb_w9Hwk/s1600/3bb.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>3BB, Attacker, Used, MeshCentral, Backdoor, for, Root, Access, Targeted, Subscriber, Credentials</media:keywords>
</item>

<item>
<title>Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports</title>
<link>https://teqmanch.com/telegram-desktop-flaw-lets-hidden-javascript-exfiltrate-messages-from-html-exports</link>
<guid>https://teqmanch.com/telegram-desktop-flaw-lets-hidden-javascript-exfiltrate-messages-from-html-exports</guid>
<description><![CDATA[ A flaw in Telegram Desktop let a bot&#039;s message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12.

In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7YYT-Mf718wZ9kLasqkkPZ1Drw4dlLUMaHtOPuWRltuG7bOcA-d4bFr4GRmer0MMohBwgv7HFVFADi-EeDvIMcbEaJUiyn8t-iLxtR8PVRDWHLmxKnofrZgoPOH_RS7qaUkzd0Ery8Rr7oWlgoPJligCMSSywXmXdMHgzuER6M77sWisfdMOo_rqudmk/s1600/telehgram.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 18:52:43 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Telegram, Desktop, Flaw, Lets, Hidden, JavaScript, Exfiltrate, Messages, From, HTML, Exports</media:keywords>
</item>

<item>
<title>Twitch extension with 30K installs exposes users’ OAuth tokens</title>
<link>https://teqmanch.com/twitch-extension-with-30k-installs-exposes-users-oauth-tokens</link>
<guid>https://teqmanch.com/twitch-extension-with-30k-installs-exposes-users-oauth-tokens</guid>
<description><![CDATA[ A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users&#039; Twitch OAuth session tokens to a commercial bot service. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2021/10/07/Twitch_headpic.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 11:25:07 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Twitch, extension, with, 30K, installs, exposes, users’, OAuth, tokens</media:keywords>
</item>

<item>
<title>Hackers hijack HBO Max Reddit account to push malware in ClickFix ads</title>
<link>https://teqmanch.com/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads</link>
<guid>https://teqmanch.com/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads</guid>
<description><![CDATA[ Hackers compromised HBO Max&#039;s official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2021/06/18/hbo-max-header.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 11:25:07 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Hackers, hijack, HBO, Max, Reddit, account, push, malware, ClickFix, ads</media:keywords>
</item>

<item>
<title>Hackers target exposed Vite dev servers to steal AWS, Azure secrets</title>
<link>https://teqmanch.com/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets</link>
<guid>https://teqmanch.com/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets</guid>
<description><![CDATA[ A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/05/05/hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 11:25:07 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Hackers, target, exposed, Vite, dev, servers, steal, AWS, Azure, secrets</media:keywords>
</item>

<item>
<title>Why Patch Automation Needs Brakes, Not Just an Accelerator</title>
<link>https://teqmanch.com/why-patch-automation-needs-brakes-not-just-an-accelerator</link>
<guid>https://teqmanch.com/why-patch-automation-needs-brakes-not-just-an-accelerator</guid>
<description><![CDATA[ Patch automation can help IT teams keep pace with growing update volumes, but deploying faster also means bad updates can spread faster. Action1 explains how update rings, predefined success criteria, and human oversight can make automated patching faster without sacrificing control. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/09/action1-cybersecurity-lock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 15 Sep 2026 11:25:07 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Why, Patch, Automation, Needs, Brakes, Not, Just, Accelerator</media:keywords>
</item>

<item>
<title>Hackers exploit Tencent app flaw to deploy GrayRabbit malware</title>
<link>https://teqmanch.com/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware</link>
<guid>https://teqmanch.com/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware</guid>
<description><![CDATA[ Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent&#039;s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/11/rabbit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 14 Sep 2026 13:04:24 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Hackers, exploit, Tencent, app, flaw, deploy, GrayRabbit, malware</media:keywords>
</item>

<item>
<title>CISA: Hackers now exploit max severity GitLab flaw in attacks</title>
<link>https://teqmanch.com/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks</link>
<guid>https://teqmanch.com/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/14/GitLab.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 14 Sep 2026 12:37:14 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>CISA:, Hackers, now, exploit, max, severity, GitLab, flaw, attacks</media:keywords>
</item>

<item>
<title>Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data</title>
<link>https://teqmanch.com/attackers-use-passkey-phishing-to-hijack-microsoft-cloud-accounts-and-exfiltrate-data</link>
<guid>https://teqmanch.com/attackers-use-passkey-phishing-to-hijack-microsoft-cloud-accounts-and-exfiltrate-data</guid>
<description><![CDATA[ Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments.

The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZ2E2hmYwxfZ25xw5iPhCHaSDENcuEyEIaha9e_rIJCf68srth31FtjIiIlnOcEiSQDDuk2Vg-dQdNLfR753ePSoDntP3BS-MGbEH2DS8Ch5ihzhpiDZZm5UIzKCbL1vNJSwSABCYst8oG6Oa-7iBWaSF6WSTEkCJBAi9YEEwAmVEdGYvu-JWZnxwEX9ni/s1600/ms-outlook.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 19:23:25 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Attackers, Use, Passkey, Phishing, Hijack, Microsoft, Cloud, Accounts, and, Exfiltrate, Data</media:keywords>
</item>

<item>
<title>CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV</title>
<link>https://teqmanch.com/cisa-adds-5-actively-exploited-artifactory-screenconnect-and-routeros-flaws-to-kev</link>
<guid>https://teqmanch.com/cisa-adds-5-actively-exploited-artifactory-screenconnect-and-routeros-flaws-to-kev</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.

Details of the vulnerabilities are as follows -


  CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhva55LDIsAmtR2cRnUJw2XZ3Rvo4YhdJe39cfng8EZ1oHjLevxwRcYoFdg-ydI2I7fdt9OxGj7aMcaHMekZmy9hwSlopIZ4_KQgRnmiSy0OfGh8zO26StiEeOsHaQ4fYed0dbEUCUcz4gJM9Lu6Wt7m-ppDmI7iMl52-cRfQfsu9d90Sp2ncuvbVpAPupe/s1600/jj.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>CISA, Adds, Actively, Exploited, Artifactory, ScreenConnect, and, RouterOS, Flaws, KEV</media:keywords>
</item>

<item>
<title>When the Whole Company Adopts AI: What It Does to Your SOC</title>
<link>https://teqmanch.com/when-the-whole-company-adopts-ai-what-it-does-to-your-soc</link>
<guid>https://teqmanch.com/when-the-whole-company-adopts-ai-what-it-does-to-your-soc</guid>
<description><![CDATA[ Over the past year, we watched a new class of alert appear in enterprise security operations centers and grow faster than anything else in the stream: alerts that were triggered by AI tools and agents. Not attacks against AI, but the ordinary, everyday footprint of an organization using it, from developers running coding agents and non-technical staff signing consumer AI tools into corporate ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhx03NP3tJYBFro8_pZ2g6irfvMJFy0HGYqvUu9kkRJZBnMJ-BcA9aWGZZ1vS4a71YOgpB5qLBDkoNnMyOBJXGhfsyQQMK0IgaGunMOUTLnFUSFddG_5NwlnXsUCWJpGh3bGOcWLHpxXTAqv0i4QAYyRZPXcm0Rcp5K9Yfc7o7SEeLZXNtGp3NZVMzlv1M/s1600/in.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>When, the, Whole, Company, Adopts, AI:, What, Does, Your, SOC</media:keywords>
</item>

<item>
<title>OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers</title>
<link>https://teqmanch.com/openai-agents-linked-to-rubygems-campaign-that-gained-rce-on-rubydoc-servers</link>
<guid>https://teqmanch.com/openai-agents-linked-to-rubygems-campaign-that-gained-rce-on-rubydoc-servers</guid>
<description><![CDATA[ The &quot;major malicious attack&quot; that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx.

On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSyR4P1ZPtVeXKeb60Ut1xdO4OhRvHWFmoYNgM7SI3NEwfwcTi3Ut60xwcqIfP56OzGFtixKW4Aeo14cVZNE6TPmpC-x8qFgofgMToETQ82bp1aMIMBuaOER2Rq6PkhONMhZPGLFSKFfxVjY4_zDNJOXYHPbQaorfgr74o2PimTPeCf1hgZQ0spe-nJoiU/s1600/rubygems-openai.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>OpenAI, Agents, Linked, RubyGems, Campaign, That, Gained, RCE, RubyDoc, Servers</media:keywords>
</item>

<item>
<title>GitLab CVSS 10 File&#45;Read Flaw Draws In&#45;the&#45;Wild Probes After Disclosure</title>
<link>https://teqmanch.com/gitlab-cvss-10-file-read-flaw-draws-in-the-wild-probes-after-disclosure</link>
<guid>https://teqmanch.com/gitlab-cvss-10-file-read-flaw-draws-in-the-wild-probes-after-disclosure</guid>
<description><![CDATA[ GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.

The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioFH6aWhF9NgRW1O3yFExc7paTA9akN5-3IUQF8mvEiSTaFJjKvm6YQzFX6MP2uimYplHe1MJXz6eZtPtnxaLy25jJBhU6KuhsWFpIlnqhbn6OI6QTcfp6Olp1-VDUEF4KEYFF7hQDBdmgtxibsg9MkvbcOJIlR8Of2Flyw2m9zYfXC6gUm-TV8XA6vU43/s1600/gitlab-wild.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>GitLab, CVSS, File-Read, Flaw, Draws, In-the-Wild, Probes, After, Disclosure</media:keywords>
</item>

<item>
<title>Anthropic Says Seven China&#45;Based AI Labs Ran Industrial&#45;Scale Claude Distillation Attacks</title>
<link>https://teqmanch.com/anthropic-says-seven-china-based-ai-labs-ran-industrial-scale-claude-distillation-attacks</link>
<guid>https://teqmanch.com/anthropic-says-seven-china-based-ai-labs-ran-industrial-scale-claude-distillation-attacks</guid>
<description><![CDATA[ Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax.

Knowledge distillation by itself is a legitimate training method. It refers to a machine learning technique where a large, powerful AI model assumes the role of a &quot;teacher&quot; to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIEiaJBfFrHCrYlSFKWGSRYD6CW_EeKfmYWCZw4jm5c9hyphenhyphenDVbaSIhyphenhyphenXwFB0ncQOoB10crmwgJV9nsvhQzJNuVMsDh6jPVt2ep23r0A2PB7ZhLfTroa0Ff__kyjjX2MjP4ok4DtBwFEF1VZC7b5OOCkibJBbwECsR0Y_9S1-NpdEIw04J5FtY9OloB084t_/s1600/claude-china.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Anthropic, Says, Seven, China-Based, Labs, Ran, Industrial-Scale, Claude, Distillation, Attacks</media:keywords>
</item>

<item>
<title>Claude Used to Automate Exploitation and Data Theft Across Multiple Victims</title>
<link>https://teqmanch.com/claude-used-to-automate-exploitation-and-data-theft-across-multiple-victims</link>
<guid>https://teqmanch.com/claude-used-to-automate-exploitation-and-data-theft-across-multiple-victims</guid>
<description><![CDATA[ Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026.

The threat actors, which the artificial intelligence (AI) company has branded Generative Threat Groups (GTGs), span state-sponsored groups, financially motivated criminals, commercial ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiG0iCBQ4Eqxn0QOtvYZSysksPzr5fT0m8aLqNTa0a7Gcz3A5ikRt1oAenJwzo8rxcLERq54SNLtRvkYXKMTo0nMOmV8pWh4It3T0vP7q4J5Z23tdDkbBf3j7v317S7sQbBBbN6j6MuHusofo3qcbm2Y3DWT76gHp4Z1_En2QnJMCyEpvCo1sCcXoRZVw5-/s1600/claudeai.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Claude, Used, Automate, Exploitation, and, Data, Theft, Across, Multiple, Victims</media:keywords>
</item>

<item>
<title>Russian State&#45;Sponsored Hackers Use Claude to Rebuild Malware After Detection</title>
<link>https://teqmanch.com/russian-state-sponsored-hackers-use-claude-to-rebuild-malware-after-detection</link>
<guid>https://teqmanch.com/russian-state-sponsored-hackers-use-claude-to-rebuild-malware-after-detection</guid>
<description><![CDATA[ Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve.

The operation has been attributed to a cyber espionage group it calls GTG-20006 (where &quot;GTG&quot; stands for Generative Threat Group), which aligns with broader reporting linking the cluster to Midnight ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtfzeoSe_6tXrJiKsyJfN4vYk6suLsJPF3-SOJWE8LAaZ6_WixrsJVjZ0T8O6jdtB1d08IR8swK6H0B4S_m7-0YfIiJlVPHuL7guxwC-4ANLXUyNsEWfIusPzvOMPOKSBmFcBT1NBBVWIglIRlT8fs6O9Uc6ZRBRgWZNPbvgAVIj8gIXfusRwZh0tndhni/s1600/claude-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Russian, State-Sponsored, Hackers, Use, Claude, Rebuild, Malware, After, Detection</media:keywords>
</item>

<item>
<title>Your Critical Vulnerabilities Might Not Be Your Biggest Risk</title>
<link>https://teqmanch.com/your-critical-vulnerabilities-might-not-be-your-biggest-risk</link>
<guid>https://teqmanch.com/your-critical-vulnerabilities-might-not-be-your-biggest-risk</guid>
<description><![CDATA[ Security teams have become exceptionally talented at finding vulnerabilities. Now, it’s time to turn our attention to optimizing the process for determining which of those vulnerabilities actually create a path to compromise.

A critical vulnerability may look alarming on a scanner report, but if it sits behind strong segmentation, identity controls, and other defenses that prevent an attacker ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPPe_ve3Cylrq2fJ8HTFPebWF7lR7tvzMvL3mwFcGZNF2KWesOGc66BfO7NbiPxmsiao8jcItyikguKNqsEGfpJEcAvacbP7rflAaAT-e0Y1IbsNCNvdqvXMbwERLlPpV0PMhk9c5esoEjCE97wglh8rU9xZ7eGz2N4BOpzFYTb9-Ln3FaBRQiscqzK7U/s1600/breachlock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Your, Critical, Vulnerabilities, Might, Not, Your, Biggest, Risk</media:keywords>
</item>

<item>
<title>Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors</title>
<link>https://teqmanch.com/attackers-chain-jfrog-artifactory-flaws-to-gain-admin-control-and-plant-backdoors</link>
<guid>https://teqmanch.com/attackers-chain-jfrog-artifactory-flaws-to-gain-admin-control-and-plant-backdoors</guid>
<description><![CDATA[ Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report.

Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that had not been updated were open to them. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgX61WXln9MMGAzqzflpRDt_LZGfB7ZJ_u1fsQhr5FRnml48-E-V-uxtCIF-GERZlt-eBhw3MDT7_6jFgwEDF1ppC7YZlB_CZn-q4_nKD9S3fQTI3kDQFe2Izsq6_NoGnCRtRZckr8Irg9kOJ8Fwghl3qHqwg1zWoN6ff-VsmlCaojw2Divb6L00F34lJk/s1600/jfrog-art.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Attackers, Chain, JFrog, Artifactory, Flaws, Gain, Admin, Control, and, Plant, Backdoors</media:keywords>
</item>

<item>
<title>China&#45;Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor</title>
<link>https://teqmanch.com/china-linked-unc3569-exploited-sogou-input-method-flaw-to-deploy-grayrabbit-backdoor</link>
<guid>https://teqmanch.com/china-linked-unc3569-exploited-sogou-input-method-flaw-to-deploy-grayrabbit-backdoor</guid>
<description><![CDATA[ A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims&#039; computers, security company Gen Digital said in research published Thursday.

The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjp8vDxYtUGwWuRZlSSBh2ghvSf6GTi_VlTQSQXTaIWSlQgHY_imEfl4hyAcrhPz9w3_ejmdAKK7ZeOt5gBsNZI7mhxJsnbyLT8Bo6O6HdM01yCNuDjuz-IU64LRuAuVDOzh2Z0vLhvzwP9PUUBKE_OLn0YD7m74-kZpo1dr5c0hzCMRHxrgfIzjk9MnR4/s1600/chinese.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>China-Linked, UNC3569, Exploited, Sogou, Input, Method, Flaw, Deploy, GRAYRABBIT, Backdoor</media:keywords>
</item>

<item>
<title>PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws</title>
<link>https://teqmanch.com/papercut-replaces-emergency-patches-with-fixes-for-two-actively-exploited-flaws</link>
<guid>https://teqmanch.com/papercut-replaces-emergency-patches-with-fixes-for-two-actively-exploited-flaws</guid>
<description><![CDATA[ PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation.

The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10 are now available for customers to download.

&quot;These are Regular Maintenance Releases (MR) that ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT6b7k7Y60TgLLmuruqSocYNfZoYEmONgga8CidWSXIdOZLWlgCYLuXOe9bWQRi_3BRkOmJvPNANZAOS85Xx6RtuQTVCg2-QNi3dXfELQm8bglTMUK9rn54e-sLoslCkVYlPGiyGSnsu58yxo9EkC3PvXDWVTYhTRgDQqTDAQTs69vPBh7xjq0Fwm7bY40/s1600/papercut-flaws.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>PaperCut, Replaces, Emergency, Patches, With, Fixes, for, Two, Actively, Exploited, Flaws</media:keywords>
</item>

<item>
<title>Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware</title>
<link>https://teqmanch.com/cisco-fmc-flaws-exploited-to-steal-credentials-and-deploy-qilin-ransomware</link>
<guid>https://teqmanch.com/cisco-fmc-flaws-exploited-to-steal-credentials-and-deploy-qilin-ransomware</guid>
<description><![CDATA[ Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities.

The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJizB5uHZncQAbfKm3-k256bJHufHNcClzKqXH2XK79HlAw8egcuz3abU_gxrTbR2zrWqpMmFcHApBqp5AvC2uox6vEeOlDt1JdRy-A6WAqpFPfVeZ4hM4gp-lCqqY_hIXMu2VVupFLGzbv1sBXLjQGSPlORsnaEdcOqjLJQKAKfDMHJqGY6KY1NZCLth0/s1600/cisco-ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Cisco, FMC, Flaws, Exploited, Steal, Credentials, and, Deploy, Qilin, Ransomware</media:keywords>
</item>

<item>
<title>ThreatsDay: 200 Android Flaws, Browser&#45;Built Phishing, 119K Scam Shops + 23 More Stories</title>
<link>https://teqmanch.com/threatsday-200-android-flaws-browser-built-phishing-119k-scam-shops-23-more-stories</link>
<guid>https://teqmanch.com/threatsday-200-android-flaws-browser-built-phishing-119k-scam-shops-23-more-stories</guid>
<description><![CDATA[ A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?”

An extension asks for access and takes too much. A trusted service becomes part of a phishing chain. An old bug still gets results. An exposed system stays exposed. A package looks useful right up until it isn’t. Different stories, same basic problem: the path in was often already ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFNPIVe_Yx__WtfjnMTnoJSKPMcGPiMCP5NxEyv1gRcGSlnozG41TeGldWhQi7Hsc0XgcmC9tfTEBS-CdLLAz8cOskVbBOsghdSM9kg_AhQmhfMada8rs4l7O7Py8YJErqK54BIt0r06Sm1l62fy8yv6H8PJrEXWxjnvyLkyFKzzXcGI_h00yeBqck5v9L/s1600/td-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:34:42 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>ThreatsDay:, 200, Android, Flaws, Browser-Built, Phishing, 119K, Scam, Shops, More, Stories</media:keywords>
</item>

<item>
<title>Google Play Early Access Abused to Push Thousands of Deceptive Android Apps</title>
<link>https://teqmanch.com/google-play-early-access-abused-to-push-thousands-of-deceptive-android-apps</link>
<guid>https://teqmanch.com/google-play-early-access-abused-to-push-thousands-of-deceptive-android-apps</guid>
<description><![CDATA[ Bad actors are misusing Google Play&#039;s Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content.

Early Access apps are apps that haven&#039;t been released on the official Android app marketplace. The main idea behind the program is for developers to solicit user feedback for new applications or features they may be working on before their ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4vbRDTWaQnxiILexae9P_rAk0hzx-re0czK2tM_WNQcoVDPlKblD4M5qOy8FZ9hHJBDLGjHHAyYutmaiacI54o5q1SH5qSbsptviRF16T2r6i8Iywvzk4GJprCm60p12qrK7t3R8h_ZR7CUoG47YfdeOb0iKY0WRapDeObI8_poWklMtKXrmr421Scjzi/s1600/play.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:23:46 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Google, Play, Early, Access, Abused, Push, Thousands, Deceptive, Android, Apps</media:keywords>
</item>

<item>
<title>Check Point Discloses Two 9.8&#45;Rated VPN Certificate Flaws Enabling Unauthenticated RCE</title>
<link>https://teqmanch.com/check-point-discloses-two-98-rated-vpn-certificate-flaws-enabling-unauthenticated-rce</link>
<guid>https://teqmanch.com/check-point-discloses-two-98-rated-vpn-certificate-flaws-enabling-unauthenticated-rce</guid>
<description><![CDATA[ Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only &quot;under specific conditions&quot; that it has not described.

One flaw affects Check Point&#039;s Security Gateways, its firewall appliances. The other affects those gateways and the Security ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyc0Kqar7_6N4y9ymGxw8ukQCQbqQ_pGCfnoXYMBZoNZK1w3ljkO26S_rhVhJaIVcx8rcEK95njKyaYj5g63VByKh8ncf_s84nUBWoyEbWZH6uaLYjnu5fNt_TC9wz-r6P_RTJgZ83Z5wmurzSb9_lHVfV1t9STts4WCZr18AH-3XRHTn5pj15uURIM-0/s1600/checkpoint.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:23:39 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Check, Point, Discloses, Two, 9.8-Rated, VPN, Certificate, Flaws, Enabling, Unauthenticated, RCE</media:keywords>
</item>

<item>
<title>Conti ransomware gang member sentenced to 4 years in prison</title>
<link>https://teqmanch.com/conti-ransomware-gang-member-sentenced-to-4-years-in-prison</link>
<guid>https://teqmanch.com/conti-ransomware-gang-member-sentenced-to-4-years-in-prison</guid>
<description><![CDATA[ A Ukrainian national has been sentenced to four years in prison for his role in Conti ransomware attacks between 2021 and 2022. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/05/29/Prison-man.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Conti, ransomware, gang, member, sentenced, years, prison</media:keywords>
</item>

<item>
<title>Hackers abused Claude to extract secrets from 1.8M Android apps</title>
<link>https://teqmanch.com/hackers-abused-claude-to-extract-secrets-from-18m-android-apps</link>
<guid>https://teqmanch.com/hackers-abused-claude-to-extract-secrets-from-18m-android-apps</guid>
<description><![CDATA[ Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/11/robothacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Hackers, abused, Claude, extract, secrets, from, 1.8M, Android, apps</media:keywords>
</item>

<item>
<title>Florida confirms DMV database breached via stolen police account</title>
<link>https://teqmanch.com/florida-confirms-dmv-database-breached-via-stolen-police-account</link>
<guid>https://teqmanch.com/florida-confirms-dmv-database-breached-via-stolen-police-account</guid>
<description><![CDATA[ The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database suffered a data breach, saying the attackers gained access using credentials belonging to a police department employee. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2024/08/16/data-leak.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Florida, confirms, DMV, database, breached, via, stolen, police, account</media:keywords>
</item>

<item>
<title>Passkey&#45;themed phishing attacks lead to Microsoft 365 data theft</title>
<link>https://teqmanch.com/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft</link>
<guid>https://teqmanch.com/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft</guid>
<description><![CDATA[ Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/08/04/Microsoft-365.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Passkey-themed, phishing, attacks, lead, Microsoft, 365, data, theft</media:keywords>
</item>

<item>
<title>Artifactory flaws chained in attacks deploying backdoor malware</title>
<link>https://teqmanch.com/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware</link>
<guid>https://teqmanch.com/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware</guid>
<description><![CDATA[ Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2025/03/12/hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Artifactory, flaws, chained, attacks, deploying, backdoor, malware</media:keywords>
</item>

<item>
<title>How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface</title>
<link>https://teqmanch.com/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface</link>
<guid>https://teqmanch.com/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface</guid>
<description><![CDATA[ Threat actors are abusing trusted AI platforms to host malicious content, poison search results, and trick users into installing malware. Huntress examines campaigns targeting AI users through weaponized Claude Artifacts, shared AI conversations, sponsored search results, and ClickFix-style lures. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/posts/2026/09/08/hackers-monitoring-targets.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>How, Threat, Actors, Are, Turning, Trusted, Platforms, Into, Attack, Surface</media:keywords>
</item>

<item>
<title>GitLab urges users to patch max severity path traversal flaw</title>
<link>https://teqmanch.com/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw</link>
<guid>https://teqmanch.com/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw</guid>
<description><![CDATA[ GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/02/04/GitLab.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>GitLab, urges, users, patch, max, severity, path, traversal, flaw</media:keywords>
</item>

<item>
<title>Microsoft fixes Teams, Outlook launch failures on ARM Windows PCs</title>
<link>https://teqmanch.com/microsoft-fixes-teams-outlook-launch-failures-on-arm-windows-pcs</link>
<guid>https://teqmanch.com/microsoft-fixes-teams-outlook-launch-failures-on-arm-windows-pcs</guid>
<description><![CDATA[ Microsoft has fixed a bug that prevented Teams and Outlook from launching on ARM-based Windows devices after installing updates released since the August 2026 Patch Tuesday. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/03/10/Windows.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Microsoft, fixes, Teams, Outlook, launch, failures, ARM, Windows, PCs</media:keywords>
</item>

<item>
<title>Trezor: 347,000 users targeted in phishing attacks after Brevo breach</title>
<link>https://teqmanch.com/trezor-347000-users-targeted-in-phishing-attacks-after-brevo-breach</link>
<guid>https://teqmanch.com/trezor-347000-users-targeted-in-phishing-attacks-after-brevo-breach</guid>
<description><![CDATA[ Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/09/11/Trezor.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:18:12 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Trezor:, 347, 000, users, targeted, phishing, attacks, after, Brevo, breach</media:keywords>
</item>

<item>
<title>Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent</title>
<link>https://teqmanch.com/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent</link>
<guid>https://teqmanch.com/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent</guid>
<description><![CDATA[ The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103. [...] ]]></description>
<enclosure url="https://www.bleepstatic.com/content/hl-images/2026/07/23/Check-Point.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 13 Sep 2026 01:13:38 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>Dutch, NCSC:, Critical, Check, Point, VPN, flaws, exploitation, imminent</media:keywords>
</item>

<item>
<title>Hackers Used AI to Scan 1.8 Million Android Apps for Hidden Secrets</title>
<link>https://teqmanch.com/hackers-ai-scan-1-8-million-android-apps-secrets</link>
<guid>https://teqmanch.com/hackers-ai-scan-1-8-million-android-apps-secrets</guid>
<description><![CDATA[ Hackers reportedly used AI-assisted automation to scan 1.8 million Android apps for exposed credentials, highlighting the growing threat of AI-powered cyberattacks. ]]></description>
<enclosure url="https://teqmanch.com/uploads/images/202609/image_870x580_6aa53c6c0659e.jpg" length="172567" type="image/jpeg"/>
<pubDate>Sat, 12 Sep 2026 17:17:57 +0530</pubDate>
<dc:creator>Raghib Awan</dc:creator>
<media:keywords>AI cybersecurity, Android app security, Android APK, hackers, cyberattacks, Claude AI, Anthropic Claude, exposed credentials, API keys, hardcoded secrets, Android security, mobile app security, AI-powered cyberattacks, cybersecurity threats, ShinyHunters, credential theft, APK security, cybersecurity news</media:keywords>
</item>

</channel>
</rss>