{
    "generated_at": "2026-08-16T03:49:55+00:00",
    "realm": "surface",
    "count": 30,
    "articles": [
        {
            "id": 1,
            "title": "New Evooo1Bot Linux botnet turns routers into traffic relay nodes",
            "url": "https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/",
            "author": "Bill Toulas",
            "summary": "A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. [...]",
            "published_at": "2026-08-15 14:14:38",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Linux",
                "Malware",
                "Network Security"
            ],
            "cves": []
        },
        {
            "id": 2,
            "title": "How Anthropic plans to watermark Claude's AI-generated text",
            "url": "https://www.bleepingcomputer.com/news/artificial-intelligence/how-anthropic-plans-to-watermark-claudes-ai-generated-text/",
            "author": "Mayank Parmar",
            "summary": "It could soon become easier to identify AI-generated content, even if it's not the usual \"It's Not X, it's Y\" type of post you'd come across on LinkedIn and other socials. [...]",
            "published_at": "2026-08-14 23:24:17",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [],
            "cves": []
        },
        {
            "id": 331,
            "title": "The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure",
            "url": "https://www.tenable.com/blog/the-agentic-ai-threat-cluster-seven-incidents-three-actors-and-what-they-mean",
            "author": "Research Special Operations",
            "summary": "Tenable’s Research Special Operations (RSO) team has been tracking a cluster of agentic AI threat activity since late July 2026. The Taiwan autonomous AI cyber attack confirmed what the cluster data already showed: near-autonomous offensive AI has crossed from theoretical risk to operational reality.Key TakeawaysTaiwan's Ministry of Digital Affairs confirmed a near-autonomous AI cyber attack in July 2026 in which autonomous agents mapped 21 connected government systems, compromised 85 accounts, and exfiltrated more than 2,564 personnel records in approximately four days.The Taiwan campaign is part of a broader seven-incident agentic AI threat cluster that also includes JADEPUFFER, which exploited CVE-2025-3248 in the Langflow AI workflow platform for automated database extortion, and knaithe/KnYuan, a Chinese-speaking operator assessed by Unit 42 with moderate confidence, using the same AI agent framework for autonomous vulnerability scanning.The common entry point across all cluster activity is identity and authentication exposure: discoverable federation endpoints, weak credentials, and misconfigured SSO are the conditions autonomous agents exploit at machine speed, and Tenable One can identify this class of risk in customer environments.BackgroundThe Taiwan autonomous AI cyber attack, confirmed by Taiwan’s Ministry of Digital Affairs on Aug. 13, 2026, is the highest-profile event in a broader pattern Tenable’s RSO team has been tracking as an intelligence cluster since July 21, 2026. That cluster now encompasses seven confirmed incidents of autonomous or semi-autonomous AI systems deployed for offensive cyber operations or escaping containment boundaries, spanning November 2025 through August 2026.The Taiwan campaign is the anchor finding, but it is not the whole story. In late July, Palo Alto Networks’ Unit 42 independently documented a separate Chinese-speaking individual operator using the same underlying AI agent framework for autonomous vulnerability scanning. Before either of those events became public, the RSO team was already tracking JADEPUFFER, the first documented agentic threat actor, which exploited an AI workflow platform for initial access and pivoted to database extortion. Three additional agentic AI exploitation incidents emerged during Q1 and Q2 of 2026. And on the defensive side, a confirmed AI sandbox escape incident involving a frontier model demonstrated that autonomous systems can break containment from the inside, not just be weaponized from the outside.Tenable’s RSO team assesses that these events are not coincidental. They represent two sides of the same exposure condition: autonomous AI systems operating beyond the boundaries their developers intended. This FAQ explains what the cluster contains, what the Taiwan anchor event revealed, and what the cluster reveals about the broader exposure condition.FAQWhat happened in the Taiwan AI cyber attack?Between July 1 and July 4, 2026, a suspected China-linked operator ran a four-day intrusion campaign against Taiwanese government infrastructure across 12 distinct attack waves. Starting from a single government portal, autonomous AI agents mapped 21 connected systems, compromised 85 accounts, and exfiltrated more than 2,564 personnel records. The operation then expanded beyond its initial foothold to reach Taiwan’s national nuclear safety agency, seven energy companies, government IT supply chain vendors, and a government email system.Dream Security's chief strategy officer, Amir Becker, a former member of Israel's Unit 8200, characterized the level of autonomy demonstrated as unprecedented against a government target, according to SecurityAffairs reporting. Taiwan’s Ministry of Digital Affairs confirmed the attack on Aug. 13, 2026, but did not publicly attribute it to a specific state.How did the AI agents conduct the attack autonomously?The operator assembled a multi-agent framework from two open-source AI agent projects, Hermes Agent and OpenClaw, and added Bayesian decision engines capable of coordinating up to eight parallel sub-agents per attack wave. Rather than following a fixed script, the agents scraped the government portal's publicly accessible authentication metadata: the federated sign-on endpoints, service identifiers, and identity-provider configuration that interconnected web applications routinely expose, then used what they found to independently discover and map the 21 connected systems behind it. In what Dream Security described as a fully autonomous decision, the agents followed a URL from the portal's JavaScript bundles to a GitBook documentation site hosting the national SSO integration guide, scraped the documentation using GitBook's built-in content features, and downloaded two SDK integration projects. Dream's analysis notes that while the agents ran automated code review on the SDK samples, none of those findings produced confirmed exploits. The actual breaches came from server-side flaws discoverable through standard black-box testing.To acquire credentials, the agents generated password variations based on employee identifiers and automatically solved CAPTCHA challenges through optical character recognition, compromising 85 accounts without a human operator manually testing each one. The agents also bypassed their own AI safety guardrails by reframing the offensive operation as “authorized penetration testing,” a novel prompt-based technique with no current mapping in the MITRE ATT&CK framework. Throughout the operation, the agents pulled exploitation techniques from public vulnerability databases and GitHub in real time rather than relying on a pre-loaded set of exploits, a pattern Tenable’s RSO team assesses as genuine adaptive behavior rather than simple scripted branching.Did the attackers exploit a specific vulnerability or zero-day?No single classifiable Common Vulnerabilities and Exposures (CVE) entry drove this campaign. Instead, the AI agents dynamically identified and abused misconfigurations, exposed administrative interfaces, and weak credentials already present in the target environment, sourcing exploitation techniques from public databases as they went. Tenable’s RSO team regards this absence as analytically significant: it demonstrates an attack category that a purely CVE-centric defensive model cannot fully address, because the exposure is the target’s entire discoverable attack surface rather than one known vulnerability.Who was behind the attack?Dream Security's linguistic analysis of the recovered 160MB archive found that internal operator communications were in Simplified Chinese while the exfiltrated government data was in Traditional Chinese. The targeting sequence (government portal, then nuclear safety agency, then energy sector) also aligns with previously documented Chinese strategic intelligence collection priorities against Taiwan.Attribution currently rests on a single primary source. Dream Security is the sole entity that has published technical and linguistic analysis of the archive, and no second vendor has yet corroborated a link to a specific Chinese state entity. Tenable’s RSO team evaluated three competing attribution hypotheses (state-sponsored, state-adjacent contractor, and false flag) and assesses a state-adjacent contractor or patriotic hacker origin as the leading explanation, with state sponsorship as a close runner-up that cannot be excluded.What is the connection to the Unit 42 findings on knaithe/KnYuan?On July 30, 2026, roughly two weeks before the Taiwan campaign became public, Unit 42 published research on a separate Chinese-speaking individual operator tracked as knaithe (also known as KnYuan), assessed with moderate confidence as operating out of Zhuhai, China. Unit 42 discovered the actor after a misconfigured Hermes Agent instance accidentally exposed the actor's full operational workspace. Unit 42's report details the exposed contents: tool configurations, API credentials, exploit scripts, tar",
            "published_at": "2026-08-14 21:36:57",
            "discovered_at": "2026-08-16 02:02:12",
            "updated_at": "2026-08-16 02:02:12",
            "priority_score": 30,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Tenable Blog",
            "source_group": "Vendor Research",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 2,
            "categories": [
                "AI Security",
                "APT / Nation-State",
                "Cloud Security",
                "Initial Access",
                "Network Security",
                "Threat Actors",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2025-3248"
            ]
        },
        {
            "id": 311,
            "title": "Metasploit Wrap Up: Lot of summer shells and fit http profiles",
            "url": "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles",
            "author": "Rapid7 Labs",
            "summary": "This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE (CVE-2026-46300). Metasploit also got the glow-up of the summer with the new http malleable profiles, MCP functionality and linux multi fetch payloads (more details on the [official 6.5 release blog post](https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released/)!). Windows on ARM confirm to be the new first-class citizenship thanks to brand-new AArch64 reverse-TCP shells (both inline and staged), so your Snapdragon boxes can join the party too. Last but not least, an important message: *Nyan Nyan Nyan Nyan Nyan Nyan.*New module content (13)Ray Dashboard Logs API Path TraversalAuthor: Richard Howe Type: AuxiliaryPull request: #21681 contributed by rmhowe425Path: `gather/ray_dashboard_logs_api_path_traversal`Description: This adds an auxiliary module that leverages a path traversal vulnerability in Ray to list the contents of local directories. There is currently no CVE assigned to this vulnerability. Issuance is pending with MITRE. Pterodactyl Panel CVE-2025-49132 Remote Code ExecutionAuthors: 0xtensho and jheysel-r7Type: ExploitPull request: #21452 contributed by jheysel-r7Path: `linux/http/pterodactyl_locales_locale_json`AttackerKB reference: CVE-2025-49132Description: This adds a module which exploits a vulnerability in Pterodactyl Panel before version 1.11.11 that allows unauthenticated remote code execution through improper handling of locale file operations. The vulnerability, CVE-2025-49132, exists in the locale.json endpoint which allows path traversal and arbitrary file creation. This combination of capabilities results in remote code execution in the context of the user running the web server.SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command ExecutionAuthors: Deral Heiland, Rapid7 Vulnerability Research, and Ryan EmmonsType: ExploitPull request: #21678 contributed by dheiland-r7(https://github.com/dheiland-r7)Path: `linux/http/sonicwall_sma1000_wsproxy_rce`AttackerKB reference: CVE-2026-15409Description: This adds a new exploit module for CVE-2026-15409, a Server-Side Request Forgery (SSRF) vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service.Fragnesia LPE (CVE-2026-46300)Authors: William Bowling and msutovsky-r7Type: ExploitPull request: #21456 contributed by msutovsky-r7Path: linux/local/cve_2026_46300_fragnesiaAttackerKB reference: CVE-2026-46300Description: This adds a local module for the Fragnesia exploit which is a page-cache replacement vulnerability in the Linux kernel's XFRM (IPsec) subsystem, tracked as CVE-2026-46300.Ghost CMS Remote Code ExecutionAuthors: Cristian-Alexandru Staicu and Maksim RogovType: ExploitPull request: #21234 contributed by vognikPath: multi/http/ghostcms_auth_rce_cve_2026_29053AttackerKB reference: CVE-2026-22594Description: This adds an exploit module for Ghost CMS (CVE-2026-29053) that achieves remote code execution by uploading a malicious theme. Ghost's theme renderer evaluates untrusted JSONPath expressions through the {{#get}} helper, letting the module inject and trigger arbitrary code once a theme is uploaded and activated. You'll need valid admin or staff credentials to authenticate.Joomla Content Editor Unauthenticated File Upload RCEAuthors: David Jardin, Uwe Flottemesch, and ispyispyispyType: ExploitPull request: #21615 contributed by 15py15py15pyPath: multi/http/joomla_com_jce_unauth_file_upload_rceAttackerKB reference: CVE-2026-48907Description: This adds a new exploit module for CVE-2026-48907, an unauthenticated arbitrary profile creation vulnerability in the JCE (Joomla Content Editor) extension for Joomla!. The profiles.import task fails to enforce authentication, letting an attacker import a crafted profile that is written to disk as a PHP web shell, resulting in remote code execution when the tmp/ directory is directly accessible. All JCE versions up to and including 2.9.99.4 are affected, and no credentials are required.Langflow Unauth RCEAuthors: Diamorphine and Richard HoweType: ExploitPull request: #21700 contributed by rmhowe425Path: multi/http/langflow_unauth_rce_cve_2026_33017AttackerKB reference: CVE-2026-33017Description: Adds a new multi/http/langflow_unauth_rce_cve_2026_33017 exploit module that exploits an unauth RCE vulnerability in the /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow versions prior to 1.9.0.OpenCATS Installer PHP Code InjectionAuthors: Chocapikk and stlthr4k3rType: ExploitPull request: #21630 contributed by stlthr4k3rPath: multi/http/opencats_installer_rceAttackerKB reference: CVE-2026-27760Description: Adds an exploit module targeting CVE-2026-27760, a PHP code injection in OpenCATS.WordPress WP2Shell REST API Batch Route Confusion SQLi to RCEAuthors: Adam Kues, Crypto-Cat, TF1T, dtro, and haongoType: ExploitPull request: #21686 contributed by Crypto-CatPath: multi/http/wp_batch_desync_rceAttackerKB reference: CVE-2026-60137Description: This adds an exploit module to target WP2Shell, an unauthenticated pre-auth remote code execution vulnerability affecting WordPress core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The module chains a REST API route confusion flaw (CVE-2026-63030) with an SQL injection (CVE-2026-60137) to elevate privileges, deploy a payload via a custom plugin, and execute a remote session.WordPress Unauthenticated RCE via Pix for WooCommerce pluginAuthors: Alexis Lafontaine and Maksim RogovType: ExploitPull request: #21683 contributed by vognikPath: multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891AttackerKB reference: CVE-2026-3891Description: Adds CVE-2026-3891 WordPress Unauthenticated RCE Exploit module targeting Pix for WooCommerce plugin.Release Metasploit 6.5Authors: OJ Reeves, Spencer McIntyreType: Payload (Single) Pull request: #21728 contributed by zeroSteinerDescription: Adds support for a new MALLEABLEC2 option to Meterpreter HTTP(S) payloads. This feature enables users to load a standard profile into Meterpreter and change the shape of its HTTP(S) traffic. All Meterpreters, including Windows, Java, Python, PHP and Linux, have been updated with this functionality.Windows AArch64 Command Shell, Reverse TCP InlineAuthor: vinicius-batistellaType: Payload (Single)Pull request: #21589 contributed by vinicius-batistellaPath: windows/aarch64/shell_reverse_tcpDescription: Adds Windows on ARM (AArch64) reverse-TCP command-shell payload.Windows AArch64 Command Shell, Windows AArch64 Reverse TCP StagerAuthor: vinicius-batistellaType: Payload (Stager)Pull request: #21744 contributed by vinicius-batistellaPath: windows/aarch64/shell/reverse_tcpDescription: Adds Windows AARCH64 staged shell payloads.Enhancements and features (15)#21379 from g0tmi1k - This improves the FTP login scanner by extending the reporting logic and adding extra checks#21575 from g0tmi1k - Improves scanner/ftp/ftp_version to now report the service if host is up but we don't get an appropriate FTP banner#21578 from arpan-pramanik - Fixes a bug where msfconsole crashes with an unhandled exception when attempting to exit if the msf database is missing#21607 from Pushpenderrathore - This extends CertificateTrace peer cert tracing to support LDAP over TLS and RDP#21608 from Pushpenderrathore - This adds CertificateTrace peer cert tracing to PostgreSQL over TLS, and fixes a long-standing gap where the Postgres mixin accepted an SSL datastore option but never passed it through to the underlying connection#21622 from zeroSteiner - Adds Bearer Authentication to the MCP server plugin#21638 from eve0805 - This reuses the existing Kerberos ticket trace formatting for offline Kerberos artifact workflows, so stored and converted tickets can be inspected with the same output style used during li",
            "published_at": "2026-08-14 21:27:45",
            "discovered_at": "2026-08-16 02:02:12",
            "updated_at": null,
            "priority_score": 20,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Rapid7",
            "source_group": "Vendor Research",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 2,
            "categories": [
                "Linux",
                "Microsoft",
                "Vulnerabilities"
            ],
            "cves": [
                "CVE-2025-49132",
                "CVE-2026-15409",
                "CVE-2026-27760",
                "CVE-2026-29053",
                "CVE-2026-3891",
                "CVE-2026-46300",
                "CVE-2026-48907",
                "CVE-2026-60137",
                "CVE-2026-63030"
            ]
        },
        {
            "id": 231,
            "title": "Investigation of banking hack leads to arrests in Europe, Brazil",
            "url": "https://therecord.media/investigation-into-banking-hack-leads-to-arrests-germany-brazil",
            "author": null,
            "summary": "Germany’s federal police agency, the BKA, said three suspects were picked up in Europe and charged with fraud, and Brazil’s federal police said four others were arrested on similar charges.",
            "published_at": "2026-08-14 20:31:00",
            "discovered_at": "2026-08-16 02:02:10",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "The Record",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Cybercrime",
                "DFIR",
                "Law Enforcement"
            ],
            "cves": []
        },
        {
            "id": 181,
            "title": "Mission-Driven Security: Inside a Global Bank's Defense",
            "url": "https://www.darkreading.com/cybersecurity-operations/mission-driven-security-inside-global-bank-defense",
            "author": "Kristina Beek",
            "summary": "In this video interview, Standard Chartered's group CISO shares insights on transitioning from technical roles to strategic leadership, the importance of business-savvy security executives, and how AI is reshaping both defensive capabilities and adversarial tactics in banking.",
            "published_at": "2026-08-14 19:24:18",
            "discovered_at": "2026-08-16 02:02:10",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [],
            "cves": []
        },
        {
            "id": 91,
            "title": "Cisco Advance Notification for Publication of August 19, 2026, Security Advisories",
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-LDquvx5d?vs_f=Cisco%20Security%20Advisory%26vs_cat%3DSecurity%20Intelligence%26vs_type%3DRSS%26vs_p%3DCisco%20Advance%20Notification%20for%20Publication%20of%20August%2019%2C%202026%2C%20Security%20Advisories%26vs_k%3D1",
            "author": null,
            "summary": "On August 19, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: BroadWorks Crosswork Industrial Ethernet 1000 Series Switches Packaged Contact Center Enterprise and Unified Contact Center Enterprise RoomOS Secure Workload Unified Intelligence Center To fully remediate vulnerabilities to be disclosed on August 19, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery. Security Impact Rating: Informational",
            "published_at": "2026-08-14 19:21:24",
            "discovered_at": "2026-08-16 02:02:09",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Cisco Security Advisories",
            "source_group": "Vendor Research",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 1,
            "categories": [
                "DFIR",
                "Network Security",
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 3,
            "title": "Hackers arrested over €30M bank fraud exploiting service provider flaw",
            "url": "https://www.bleepingcomputer.com/news/security/hackers-arrested-over-30m-bank-fraud-exploiting-service-provider-flaw/",
            "author": "Bill Toulas",
            "summary": "Four cybercriminals were arrested in Brazil, and three others were charged in Europe over allegations that they exploited a vulnerability at a service provider, allowing them to withdraw funds from Commerzbank customers' bank accounts. [...]",
            "published_at": "2026-08-14 18:04:26",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Cybercrime",
                "Law Enforcement",
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 182,
            "title": "Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI",
            "url": "https://www.darkreading.com/vulnerabilities-threats/ai-driven-bug-tsunami-nist-looks-to-ai",
            "author": "Robert Lemos",
            "summary": "Driven by AI-augmented research and scanning, vulnerability volumes continue to surge, driving the National Institute of Standards and Technology to ask whether AI could be the answer.",
            "published_at": "2026-08-14 17:32:46",
            "discovered_at": "2026-08-16 02:02:10",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 183,
            "title": "Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office",
            "url": "https://www.darkreading.com/cyberattacks-data-breaches/scottish-govt-data-breach-prosecutors-office",
            "author": "Nate Nelson",
            "summary": "One Caledonian government agency reported a breach, thanks to a third party that may have serviced other agencies as well.",
            "published_at": "2026-08-14 15:58:50",
            "discovered_at": "2026-08-16 02:02:10",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Data Breaches"
            ],
            "cves": []
        },
        {
            "id": 4,
            "title": "Hackers exploit macOS Screen Sharing flaw to deploy Monero miner",
            "url": "https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/",
            "author": "Bill Toulas",
            "summary": "The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. [...]",
            "published_at": "2026-08-14 14:59:55",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 10,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Apple",
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 5,
            "title": "The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI",
            "url": "https://www.bleepingcomputer.com/news/security/the-modern-attack-chain-rethinking-google-workspace-security-in-the-age-of-ai/",
            "author": "Sponsored by Material Security",
            "summary": "Google Workspace attacks do not always begin with phishing. Stolen OAuth tokens can provide another path into Gmail, Drive, and connected systems. Material Security explains why organizations need defenses that cover the entire Workspace attack chain. [...]",
            "published_at": "2026-08-14 14:00:10",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Phishing"
            ],
            "cves": []
        },
        {
            "id": 256,
            "title": "How Google is Making Private AI Practical with Homomorphic Encryption",
            "url": "https://blog.google/security/how-google-is-making-private-ai-practical-with-homomorphic-encryption/",
            "author": "Jeremy Kun",
            "summary": "heir logo",
            "published_at": "2026-08-14 14:00:00",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Google Security Blog",
            "source_group": "Vendor Research",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 2,
            "categories": [],
            "cves": []
        },
        {
            "id": 184,
            "title": "What Boards Need to Know About Tech Risk",
            "url": "https://www.darkreading.com/cyber-risk/what-boards-must-know-tech-risk",
            "author": "Chris Drumgoole",
            "summary": "Why do so many boards underestimate technology risk until it becomes a crisis?",
            "published_at": "2026-08-14 14:00:00",
            "discovered_at": "2026-08-16 02:02:10",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [],
            "cves": []
        },
        {
            "id": 6,
            "title": "Max severity SAP Commerce Cloud flaw now targeted in attacks",
            "url": "https://www.bleepingcomputer.com/news/security/max-severity-sap-commerce-cloud-flaw-now-targeted-in-attacks/",
            "author": "Sergiu Gatlan",
            "summary": "A maximum-severity SAP Commerce Cloud remote code execution vulnerability patched three days ago is already being targeted in attacks, according to threat intelligence company Defused. [...]",
            "published_at": "2026-08-14 13:45:18",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 15,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Threat Intelligence",
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 232,
            "title": "France investigates tax authority breach after hacker claims 600,000 victims",
            "url": "https://therecord.media/french-tax-authority-dgfip-confirms-data-breach",
            "author": null,
            "summary": "French authorities confirmed that someone gained unauthorized access to systems at the Directorate General of Public Finances in late June after stealing or misusing someone’s identity.",
            "published_at": "2026-08-14 13:14:15",
            "discovered_at": "2026-08-16 02:02:10",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "The Record",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [],
            "cves": []
        },
        {
            "id": 185,
            "title": "Cyera's Oasis Security Buy Is All About AI Agent Control",
            "url": "https://www.darkreading.com/identity-access-management-security/cyera-oasis-security-acquisition-ai-agent-control",
            "author": "Jeffrey Schwartz",
            "summary": "The $1 billion deal aims to converge data security and identity into a single control plane for agents, with privileged access redefined around business context rather than static roles.",
            "published_at": "2026-08-14 12:17:21",
            "discovered_at": "2026-08-16 02:02:10",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Dark Reading",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "AI Security"
            ],
            "cves": []
        },
        {
            "id": 236,
            "title": "In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities",
            "url": "https://www.securityweek.com/in-other-news-rapid7-layoffs-hacking-a-boeing-737-refrigeration-system-vulnerabilities/",
            "author": "SecurityWeek News",
            "summary": "Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON attendee blamed for Delta flight disruption. The post In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities appeared first on SecurityWeek.",
            "published_at": "2026-08-14 11:57:51",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SecurityWeek",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [],
            "cves": []
        },
        {
            "id": 7,
            "title": "Shell investigates 'potential incident' after Clop data theft claims",
            "url": "https://www.bleepingcomputer.com/news/security/shell-investigates-potential-incident-after-clop-data-theft-claims/",
            "author": "Sergiu Gatlan",
            "summary": "Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of data. [...]",
            "published_at": "2026-08-14 11:55:45",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 15,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Ransomware"
            ],
            "cves": []
        },
        {
            "id": 237,
            "title": "Trivy, Not LiteLLM Behind the 2,500 Org Compromise",
            "url": "https://www.securityweek.com/trivy-not-litellm-behind-the-2500-org-compromise/",
            "author": "Ionut Arghire",
            "summary": "Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published. The post Trivy, Not LiteLLM Behind the 2,500 Org Compromise appeared first on SecurityWeek.",
            "published_at": "2026-08-14 11:35:23",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SecurityWeek",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [],
            "cves": []
        },
        {
            "id": 16,
            "title": "Who’s Tracking You? Use This New Service to Find Out",
            "url": "https://krebsonsecurity.com/2026/08/whos-tracking-you-use-this-new-service-to-find-out/",
            "author": "BrianKrebs",
            "summary": "It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.",
            "published_at": "2026-08-14 11:24:35",
            "discovered_at": "2026-08-16 02:02:08",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "Krebs on Security",
            "source_group": "Independent Research",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 2,
            "categories": [],
            "cves": []
        },
        {
            "id": 238,
            "title": "Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal",
            "url": "https://www.securityweek.com/google-cloud-sets-out-post-quantum-roadmap-with-2029-readiness-goal/",
            "author": "Eduard Kovacs",
            "summary": "Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028. The post Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal appeared first on SecurityWeek.",
            "published_at": "2026-08-14 11:00:00",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SecurityWeek",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Cloud Security"
            ],
            "cves": []
        },
        {
            "id": 8,
            "title": "RingCentral data breach exposed info of 1.6 million accounts",
            "url": "https://www.bleepingcomputer.com/news/security/ringcentral-data-breach-exposed-info-of-16-million-accounts/",
            "author": "Sergiu Gatlan",
            "summary": "The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned. [...]",
            "published_at": "2026-08-14 10:52:05",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Data Breaches",
                "Microsoft"
            ],
            "cves": []
        },
        {
            "id": 239,
            "title": "1.6 Million Likely Impacted by RingCentral Data Breach",
            "url": "https://www.securityweek.com/1-6-million-likely-impacted-by-ringcentral-data-breach/",
            "author": "Ionut Arghire",
            "summary": "The hackers published the allegedly stolen information, including names, addresses, email addresses, and phone numbers. The post 1.6 Million Likely Impacted by RingCentral Data Breach appeared first on SecurityWeek.",
            "published_at": "2026-08-14 10:24:03",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SecurityWeek",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Data Breaches",
                "Microsoft"
            ],
            "cves": []
        },
        {
            "id": 240,
            "title": "Over 1,000 Charities Hit by Beacon CRM Data Breach",
            "url": "https://www.securityweek.com/over-1000-charities-hit-by-beacon-crm-data-breach/",
            "author": "Eduard Kovacs",
            "summary": "The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts. The post Over 1,000 Charities Hit by Beacon CRM Data Breach appeared first on SecurityWeek.",
            "published_at": "2026-08-14 09:20:28",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SecurityWeek",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Cloud Security",
                "Data Breaches"
            ],
            "cves": []
        },
        {
            "id": 9,
            "title": "Data analyst sent to prison for stealing data, extorting employer",
            "url": "https://www.bleepingcomputer.com/news/security/data-analyst-sent-to-prison-for-stealing-data-extorting-employer/",
            "author": "Sergiu Gatlan",
            "summary": "A former data analyst contractor for Brightly Software has been sentenced to two years in prison for targeting his employer in a $2.5 million extortion scheme. [...]",
            "published_at": "2026-08-14 08:27:18",
            "discovered_at": "2026-08-16 02:02:07",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "BleepingComputer",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [],
            "cves": []
        },
        {
            "id": 241,
            "title": "14,000 Trezor Customers Impacted by Data Breach at ShipMonk",
            "url": "https://www.securityweek.com/14000-trezor-customers-impacted-by-data-breach-at-shipmonk/",
            "author": "Ionut Arghire",
            "summary": "Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers. The post 14,000 Trezor Customers Impacted by Data Breach at ShipMonk appeared first on SecurityWeek.",
            "published_at": "2026-08-14 08:16:00",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SecurityWeek",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Data Breaches"
            ],
            "cves": []
        },
        {
            "id": 242,
            "title": "Hackers Exploiting Unpatched GeoServer Zero-Day",
            "url": "https://www.securityweek.com/hackers-exploiting-unpatched-geoserver-zero-day/",
            "author": "Ionut Arghire",
            "summary": "The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. The post Hackers Exploiting Unpatched GeoServer Zero-Day appeared first on SecurityWeek.",
            "published_at": "2026-08-14 07:01:56",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 40,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SecurityWeek",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Vulnerabilities"
            ],
            "cves": []
        },
        {
            "id": 243,
            "title": "AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions",
            "url": "https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/",
            "author": "Ionut Arghire",
            "summary": "The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies. The post AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions appeared first on SecurityWeek.",
            "published_at": "2026-08-14 06:41:43",
            "discovered_at": "2026-08-16 02:02:11",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SecurityWeek",
            "source_group": "Security Journalism",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 3,
            "categories": [
                "Apple",
                "Malware"
            ],
            "cves": []
        },
        {
            "id": 413,
            "title": "ISC Stormcast For Friday, August 14th, 2026 https://isc.sans.edu/podcastdetail/10052, (Fri, Aug 14th)",
            "url": "https://isc.sans.edu/diary/rss/33246",
            "author": null,
            "summary": "(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.",
            "published_at": "2026-08-14 02:00:03",
            "discovered_at": "2026-08-16 02:20:01",
            "updated_at": null,
            "priority_score": 0,
            "verification_status": "publisher",
            "intel_type": null,
            "source": "SANS Internet Storm Center",
            "source_group": "Community",
            "realm": "surface",
            "source_type": "rss",
            "trust_tier": 2,
            "categories": [],
            "cves": []
        }
    ]
}