<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0" xmlns:media="http://search.yahoo.com/mrss/">
    <channel>
        <title><![CDATA[ProbablyPwned - Cybersecurity News]]></title>
        <description><![CDATA[Your source for cybersecurity news, vulnerability analysis, and threat intelligence.]]></description>
        <link>https://www.probablypwned.com</link>
        <image>
            <url>https://www.probablypwned.com/logo.png</url>
            <title>ProbablyPwned - Cybersecurity News</title>
            <link>https://www.probablypwned.com</link>
        </image>
        <generator>RSS for Node</generator>
        <lastBuildDate>Fri, 10 Apr 2026 19:14:07 GMT</lastBuildDate>
        <atom:link href="https://www.probablypwned.com/rss.xml" rel="self" type="application/rss+xml"/>
        <pubDate>Fri, 10 Apr 2026 19:14:07 GMT</pubDate>
        <copyright><![CDATA[© 2026 ProbablyPwned]]></copyright>
        <language><![CDATA[en]]></language>
        <item>
            <title><![CDATA[CPUID Hijacked: CPU-Z, HWMonitor Downloads Served Malware]]></title>
            <description><![CDATA[Attackers compromised CPUID's website API for six hours, redirecting CPU-Z and HWMonitor downloads to trojanized installers that steal browser credentials using advanced evasion techniques.]]></description>
            <link>https://www.probablypwned.com/article/cpuid-supply-chain-attack-cpu-z-hwmonitor-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cpuid-supply-chain-attack-cpu-z-hwmonitor-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[CPUID]]></category>
            <category><![CDATA[CPU-Z]]></category>
            <category><![CDATA[HWMonitor]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mercor Breach Exposes 4TB of AI Training Data After LiteLLM Attack]]></title>
            <description><![CDATA[AI startup Mercor confirms breach via LiteLLM supply chain attack. Lapsus$ claims 4TB stolen including candidate data, source code, and API keys. Meta pauses contracts.]]></description>
            <link>https://www.probablypwned.com/article/mercor-data-breach-4tb-litellm-supply-chain-lapsus</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mercor-data-breach-4tb-litellm-supply-chain-lapsus</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Mercor]]></category>
            <category><![CDATA[LiteLLM]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[Lapsus$]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 12:06:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Breach Anodot, Steal Data From Snowflake Customers]]></title>
            <description><![CDATA[ShinyHunters compromised SaaS analytics provider Anodot, using stolen authentication tokens to access and exfiltrate data from dozens of Snowflake customers.]]></description>
            <link>https://www.probablypwned.com/article/anodot-breach-shinyhunters-snowflake-customers-token-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/anodot-breach-shinyhunters-snowflake-customers-token-theft</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Anodot]]></category>
            <category><![CDATA[Snowflake]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SaaS]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 12:05:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Deploys PRISMEX Malware Against Ukraine and NATO Allies]]></title>
            <description><![CDATA[Russian GRU's APT28 uses new PRISMEX malware suite with steganography and COM hijacking to target Ukraine defense and NATO logistics. Includes wiper capability.]]></description>
            <link>https://www.probablypwned.com/article/apt28-prismex-malware-ukraine-nato-steganography-sabotage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-prismex-malware-ukraine-nato-steganography-sabotage</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[PRISMEX]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[NATO]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 12:05:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Disrupts APT28's FrostArmada Router Hijacking Campaign]]></title>
            <description><![CDATA[FBI-led Operation Masquerade dismantled Russia's GRU-linked FrostArmada, which compromised 18,000+ routers to steal Microsoft 365 credentials via DNS hijacking.]]></description>
            <link>https://www.probablypwned.com/article/apt28-frostarmada-dns-hijacking-18000-routers-disrupted</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-frostarmada-dns-hijacking-18000-routers-disrupted</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[FrostArmada]]></category>
            <category><![CDATA[DNS hijacking]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[FBI]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 12:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Smart Slider Hijacked: 900K WordPress Sites Get Backdoored]]></title>
            <description><![CDATA[Attackers compromised Nextend's update infrastructure to push a malicious Smart Slider 3 Pro version with four layers of backdoors. Here's who's affected and how to recover.]]></description>
            <link>https://www.probablypwned.com/article/smart-slider-supply-chain-attack-900k-wordpress-backdoors</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smart-slider-supply-chain-attack-900k-wordpress-backdoors</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[Joomla]]></category>
            <category><![CDATA[Smart Slider]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 14:32:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LAPD Records Exposed in City Attorney Breach: 337K Files Leaked]]></title>
            <description><![CDATA[World Leaks gang dumps 7TB of sensitive police data including personnel files and Internal Affairs investigations after breaching LA City Attorney's Office.]]></description>
            <link>https://www.probablypwned.com/article/lapd-data-breach-337000-files-world-leaks-city-attorney-hack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lapd-data-breach-337000-files-world-leaks-city-attorney-hack</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[LAPD]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[World Leaks]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[government breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:07:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Bitcoin Depot Discloses $3.6M Bitcoin Theft in SEC Filing]]></title>
            <description><![CDATA[Attackers stole 50.9 BTC from company wallets after obtaining settlement account credentials. Second security incident for the crypto ATM operator since 2023.]]></description>
            <link>https://www.probablypwned.com/article/bitcoin-depot-hack-3-6-million-btc-stolen-sec-8k-filing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bitcoin-depot-hack-3-6-million-btc-stolen-sec-8k-filing</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Bitcoin Depot]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SEC filing]]></category>
            <category><![CDATA[wallet theft]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:07:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Movable Type RCE Lets Attackers Execute Arbitrary Perl Code]]></title>
            <description><![CDATA[CVE-2026-25776 (CVSS 9.8) enables remote code execution through Movable Type's Listing Framework. Affects versions 6.0+. Patches available for MT 9, 8.8, 8.0.]]></description>
            <link>https://www.probablypwned.com/article/movable-type-cve-2026-25776-perl-code-injection-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/movable-type-cve-2026-25776-perl-code-injection-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-25776]]></category>
            <category><![CDATA[Movable Type]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Perl]]></category>
            <category><![CDATA[CMS]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:06:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Spreads 1,700 Malicious Packages Across npm, PyPI, Go, Rust]]></title>
            <description><![CDATA[Contagious Interview campaign escalates with trojanized developer tools across five ecosystems. Packages impersonate logging utilities and steal credentials.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-contagious-interview-1700-malicious-packages-npm-pypi-go-rust</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-contagious-interview-1700-malicious-packages-npm-pypi-go-rust</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[Contagious Interview]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:06:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Second PraisonAI Sandbox Escape in a Week Scores CVSS 9.9]]></title>
            <description><![CDATA[CVE-2026-39888 bypasses PraisonAI's Python sandbox via exception frame traversal. Attackers chain __traceback__ attributes to reach exec(). Patch to 1.5.115.]]></description>
            <link>https://www.probablypwned.com/article/praisonai-cve-2026-39888-sandbox-escape-exception-frame-traversal</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/praisonai-cve-2026-39888-sandbox-escape-exception-frame-traversal</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-39888]]></category>
            <category><![CDATA[PraisonAI]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:05:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Anthropic Restricts Claude Mythos Over Vulnerability-Finding Power]]></title>
            <description><![CDATA[Project Glasswing partners Amazon, Microsoft, Cisco to hunt zero-days with an AI model too dangerous for public release. Thousands of flaws already found.]]></description>
            <link>https://www.probablypwned.com/article/anthropic-project-glasswing-claude-mythos-vulnerability-hunting</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/anthropic-project-glasswing-claude-mythos-vulnerability-hunting</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[Claude Mythos]]></category>
            <category><![CDATA[Project Glasswing]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[vulnerability research]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:04:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[13-Year-Old ActiveMQ Bug Found by Claude AI Enables RCE]]></title>
            <description><![CDATA[CVE-2026-34197 exposes Apache ActiveMQ to remote code execution via the Jolokia API. Horizon3 researcher used Claude to uncover the flaw in under 10 minutes. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/activemq-cve-2026-34197-rce-jolokia-claude-ai-discovery</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/activemq-cve-2026-34197-rce-jolokia-claude-ai-discovery</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache ActiveMQ]]></category>
            <category><![CDATA[CVE-2026-34197]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Jolokia]]></category>
            <category><![CDATA[AI security research]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 08 Apr 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ComfyUI Servers Hijacked for Monero Mining and Proxy Botnet]]></title>
            <description><![CDATA[Over 1,000 exposed ComfyUI instances targeted by cryptomining campaign. Attackers exploit custom nodes for RCE, deploy XMRig and Hysteria V2 botnet with persistence.]]></description>
            <link>https://www.probablypwned.com/article/comfyui-cryptominer-botnet-1000-servers-compromised</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/comfyui-cryptominer-botnet-1000-servers-compromised</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ComfyUI]]></category>
            <category><![CDATA[cryptominer]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[XMRig]]></category>
            <category><![CDATA[stable diffusion]]></category>
            <category><![CDATA[AI infrastructure]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 08 Apr 2026 12:05:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI, CISA Warn Iran Is Attacking US Water and Energy PLCs]]></title>
            <description><![CDATA[Joint advisory AA26-097A details Iranian APT targeting Rockwell Allen-Bradley controllers across critical infrastructure. Attacks caused operational disruptions since March 2026.]]></description>
            <link>https://www.probablypwned.com/article/cisa-aa26-097a-iran-plc-attacks-water-energy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-aa26-097a-iran-plc-attacks-water-energy</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[PLC]]></category>
            <category><![CDATA[Rockwell Automation]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[CyberAv3ngers]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 08 Apr 2026 12:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Docker Auth Bypass Gives Attackers Full Host Access]]></title>
            <description><![CDATA[CVE-2026-34040 lets attackers bypass Docker authorization plugins with a single padded HTTP request. CVSS 8.8 flaw patched in Engine 29.3.1.]]></description>
            <link>https://www.probablypwned.com/article/docker-cve-2026-34040-authz-bypass-host-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/docker-cve-2026-34040-authz-bypass-host-access</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[CVE-2026-34040]]></category>
            <category><![CDATA[container security]]></category>
            <category><![CDATA[authorization bypass]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 08 Apr 2026 12:04:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran-Linked Hackers Spray 300+ Israeli M365 Tenants]]></title>
            <description><![CDATA[Check Point tracks an Iran-nexus campaign targeting Microsoft 365 accounts across 300+ Israeli organizations and 25+ UAE entities. Attackers use Tor exit nodes and Israeli VPNs to evade detection.]]></description>
            <link>https://www.probablypwned.com/article/iran-password-spraying-microsoft-365-israel-uae-300-orgs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-password-spraying-microsoft-365-israel-uae-300-orgs</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[password spraying]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[Israel]]></category>
            <category><![CDATA[cloud security]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:52:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Storm-1175 Deploys Medusa Ransomware Within 24 Hours of Access]]></title>
            <description><![CDATA[Microsoft links China-based Storm-1175 to high-velocity Medusa ransomware attacks exploiting zero-day vulnerabilities. Healthcare, education, and finance sectors hit across Australia, UK, and US.]]></description>
            <link>https://www.probablypwned.com/article/storm-1175-medusa-ransomware-zero-day-china-24-hours</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/storm-1175-medusa-ransomware-zero-day-china-24-hours</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Storm-1175]]></category>
            <category><![CDATA[Medusa]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:51:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[36 Fake Strapi Plugins Deploy Redis RCE and Credential Stealers]]></title>
            <description><![CDATA[Coordinated npm supply chain attack deploys 36 malicious packages masquerading as Strapi CMS plugins. Attackers target cryptocurrency platforms with Redis exploitation, credential harvesting, and persistent backdoors.]]></description>
            <link>https://www.probablypwned.com/article/malicious-strapi-npm-packages-redis-postgresql-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/malicious-strapi-npm-packages-redis-postgresql-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Strapi]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:49:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Flowise AI Builder RCE Hits CVSS 10 — 12,000 Servers Exposed]]></title>
            <description><![CDATA[Critical code injection vulnerability CVE-2025-59528 in Flowise AI agent builder scores maximum CVSS 10.0 and is under active exploitation. Over 12,000 instances are publicly accessible.]]></description>
            <link>https://www.probablypwned.com/article/flowise-ai-cve-2025-59528-cvss-10-rce-12000-instances</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/flowise-ai-cve-2025-59528-cvss-10-rce-12000-instances</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Flowise]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVE-2025-59528]]></category>
            <category><![CDATA[code injection]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:48:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BlueHammer: Researcher Leaks Unpatched Windows Zero-Day Exploit]]></title>
            <description><![CDATA[Security researcher releases working proof-of-concept for BlueHammer, an unpatched Windows Defender privilege escalation flaw enabling SYSTEM access via TOCTOU and path confusion vulnerabilities.]]></description>
            <link>https://www.probablypwned.com/article/bluehammer-windows-defender-zero-day-lpe-exploit-leak</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bluehammer-windows-defender-zero-day-lpe-exploit-leak</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Windows Defender]]></category>
            <category><![CDATA[exploit]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:46:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GPUBreach Exploits GDDR6 Rowhammer for Full System Takeover]]></title>
            <description><![CDATA[University of Toronto researchers demonstrate GPUBreach, a GPU rowhammer attack that bypasses IOMMU protections to achieve root access on systems with NVIDIA GPUs. Consumer GPUs remain unmitigated.]]></description>
            <link>https://www.probablypwned.com/article/gpubreach-gpu-rowhammer-gddr6-privilege-escalation-nvidia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gpubreach-gpu-rowhammer-gddr6-privilege-escalation-nvidia</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[GPU security]]></category>
            <category><![CDATA[rowhammer]]></category>
            <category><![CDATA[NVIDIA]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[hardware vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:45:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Feds to Patch FortiClient EMS Flaw by Thursday]]></title>
            <description><![CDATA[CISA adds CVE-2026-35616 to KEV catalog with April 9 deadline for federal agencies. Nearly 2,000 FortiClient EMS instances remain exposed as exploitation continues.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-forticlient-ems-cve-2026-35616-federal-deadline-april-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-forticlient-ems-cve-2026-35616-federal-deadline-april-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiClient EMS]]></category>
            <category><![CDATA[CVE-2026-35616]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[federal mandate]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 16:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ImageMagick Zero-Days Enable RCE on Linux, WordPress via Image Upload]]></title>
            <description><![CDATA[AI-discovered vulnerabilities bypass all security policies including 'secure' mode. Most servers won't receive fixes until 2027 without manual intervention.]]></description>
            <link>https://www.probablypwned.com/article/imagemagick-zero-day-rce-linux-wordpress-magic-byte-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/imagemagick-zero-day-rce-linux-wordpress-magic-byte-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ImageMagick]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[image processing]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 12:06:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Group-Office Deserialization Bug Enables Server Takeover (CVSS 9.9)]]></title>
            <description><![CDATA[CVE-2026-34838 lets authenticated attackers achieve RCE on Group-Office CRM servers via insecure deserialization. Upgrade to patched versions immediately.]]></description>
            <link>https://www.probablypwned.com/article/group-office-cve-2026-34838-deserialization-rce-cvss-9-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/group-office-cve-2026-34838-deserialization-rce-cvss-9-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Group-Office]]></category>
            <category><![CDATA[CVE-2026-34838]]></category>
            <category><![CDATA[deserialization]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CRM]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 12:05:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Progress ShareFile Flaws Chain to Pre-Auth RCE on 30,000 Servers]]></title>
            <description><![CDATA[CVE-2026-2699 and CVE-2026-2701 combine to let unauthenticated attackers take over ShareFile Storage Zone Controllers. Patches available since March 10.]]></description>
            <link>https://www.probablypwned.com/article/progress-sharefile-cve-2026-2699-2701-pre-auth-rce-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/progress-sharefile-cve-2026-2699-2701-pre-auth-rce-chain</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Progress]]></category>
            <category><![CDATA[ShareFile]]></category>
            <category><![CDATA[CVE-2026-2699]]></category>
            <category><![CDATA[CVE-2026-2701]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[pre-auth]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 12:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Patches Dual 9.8 CVSS Flaws in IMC and SSM On-Prem]]></title>
            <description><![CDATA[CVE-2026-20093 and CVE-2026-20160 let unauthenticated attackers take full control of Cisco UCS servers and licensing infrastructure. No workarounds exist.]]></description>
            <link>https://www.probablypwned.com/article/cisco-imc-ssm-cve-2026-20093-20160-critical-auth-bypass-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-imc-ssm-cve-2026-20093-20160-critical-auth-bypass-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20093]]></category>
            <category><![CDATA[CVE-2026-20160]]></category>
            <category><![CDATA[IMC]]></category>
            <category><![CDATA[SSM]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 12:04:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiClient EMS Zero-Day Under Active Exploit — Patch Now]]></title>
            <description><![CDATA[CVE-2026-35616 lets attackers bypass API authentication in FortiClient EMS 7.4.5-7.4.6 for unauthenticated RCE. Exploitation began March 31. Emergency hotfixes available.]]></description>
            <link>https://www.probablypwned.com/article/forticlient-ems-cve-2026-35616-zero-day-api-bypass-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/forticlient-ems-cve-2026-35616-zero-day-api-bypass-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiClient EMS]]></category>
            <category><![CDATA[CVE-2026-35616]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[API bypass]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Casbaneiro Banking Trojan Spreads via Dynamic PDF Phishing]]></title>
            <description><![CDATA[Brazilian threat actor Augmented Marauder targets Latin America and Europe with Casbaneiro banking trojan, using dynamically generated court summons PDFs and Horabot for worm-like propagation.]]></description>
            <link>https://www.probablypwned.com/article/casbaneiro-banking-trojan-latin-america-horabot-phishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/casbaneiro-banking-trojan-latin-america-horabot-phishing</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Casbaneiro]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[Latin America]]></category>
            <category><![CDATA[Horabot]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Brazil]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:07:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Warns of WhatsApp-Delivered VBS Malware Campaign]]></title>
            <description><![CDATA[Microsoft Defender Experts identify multi-stage malware campaign using WhatsApp messages to deliver VBS scripts that bypass UAC and establish persistent Windows backdoors.]]></description>
            <link>https://www.probablypwned.com/article/whatsapp-vbs-malware-microsoft-warning-uac-bypass-windows</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/whatsapp-vbs-malware-microsoft-warning-uac-bypass-windows</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[VBS malware]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[UAC bypass]]></category>
            <category><![CDATA[Windows malware]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hims & Hers Discloses Breach After Zendesk System Compromise]]></title>
            <description><![CDATA[Telehealth company Hims & Hers reveals data breach affecting customer support tickets. ShinyHunters gang exploited Okta SSO to access Zendesk platform.]]></description>
            <link>https://www.probablypwned.com/article/hims-hers-data-breach-zendesk-okta-shinyhunters</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hims-hers-data-breach-zendesk-okta-shinyhunters</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Hims & Hers]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Zendesk]]></category>
            <category><![CDATA[Okta]]></category>
            <category><![CDATA[healthcare]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:06:04 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[KadNap Botnet Hijacks 14,000+ ASUS Routers for Proxy Network]]></title>
            <description><![CDATA[Security researchers expose KadNap malware targeting ASUS routers to build a criminal proxy network. 60% of infected devices located in the US, linked to Doppelganger service.]]></description>
            <link>https://www.probablypwned.com/article/kadnap-botnet-asus-routers-14000-devices-proxy-network</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kadnap-botnet-asus-routers-14000-devices-proxy-network</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[ASUS]]></category>
            <category><![CDATA[router malware]]></category>
            <category><![CDATA[proxy network]]></category>
            <category><![CDATA[KadNap]]></category>
            <category><![CDATA[IoT security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SparkCat Crypto Stealer Returns to iOS and Android App Stores]]></title>
            <description><![CDATA[Kaspersky discovers new SparkCat malware variants on Apple App Store and Google Play that use OCR to steal cryptocurrency wallet recovery phrases from photo galleries.]]></description>
            <link>https://www.probablypwned.com/article/sparkcat-malware-app-store-google-play-crypto-ocr-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sparkcat-malware-app-store-google-play-crypto-ocr-stealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[SparkCat]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[mobile malware]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Sinobi Ransomware Hits 215 Victims in Six Months]]></title>
            <description><![CDATA[Sinobi, a suspected Lynx/INC rebrand, has grown from 40 victims to 215 since September 2025. The RaaS operation targets US midmarket companies with hybrid Curve25519/AES encryption.]]></description>
            <link>https://www.probablypwned.com/article/sinobi-ransomware-lynx-rebrand-215-victims-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sinobi-ransomware-lynx-rebrand-215-victims-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Sinobi]]></category>
            <category><![CDATA[RaaS]]></category>
            <category><![CDATA[Lynx]]></category>
            <category><![CDATA[INC ransomware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:05:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Phantom Taurus Deploys Net-Star Backdoors Across Africa]]></title>
            <description><![CDATA[Unit 42 exposes Phantom Taurus, a Chinese APT targeting embassies and foreign ministries with fileless NET-STAR malware. The group resurfaces within hours after discovery.]]></description>
            <link>https://www.probablypwned.com/article/phantom-taurus-net-star-china-apt-africa-middle-east</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/phantom-taurus-net-star-china-apt-africa-middle-east</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Phantom Taurus]]></category>
            <category><![CDATA[Net-Star]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:04:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Behind $285M Drift Protocol Heist]]></title>
            <description><![CDATA[Solana's Drift Protocol lost $285 million in 2026's largest DeFi hack. TRM Labs attributes the attack to North Korean actors who exploited oracle manipulation and pre-signed transactions.]]></description>
            <link>https://www.probablypwned.com/article/drift-protocol-285-million-hack-north-korea-defi</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/drift-protocol-285-million-hack-north-korea-defi</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[DeFi]]></category>
            <category><![CDATA[Solana]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Drift Protocol]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:04:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Claude Code Repos Push Vidar Infostealer on GitHub]]></title>
            <description><![CDATA[Threat actors weaponized Anthropic's accidental source code leak to distribute Vidar malware through trojanized GitHub repos. Here's how the attack works.]]></description>
            <link>https://www.probablypwned.com/article/claude-code-leak-vidar-infostealer-github-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/claude-code-leak-vidar-infostealer-github-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[Claude Code]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:03:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PraisonAI Sandbox Bypass Scores Perfect CVSS 10]]></title>
            <description><![CDATA[CVE-2026-34938 lets attackers escape PraisonAI's three-layer Python sandbox to execute arbitrary OS commands. CVSS 10 — patch to version 1.5.90 immediately.]]></description>
            <link>https://www.probablypwned.com/article/praisonai-cve-2026-34938-sandbox-bypass-rce-cvss-10</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/praisonai-cve-2026-34938-sandbox-bypass-rce-cvss-10</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-34938]]></category>
            <category><![CDATA[PraisonAI]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:03:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Hits German Left Party Amid Hybrid War Fears]]></title>
            <description><![CDATA[Die Linke confirms Qilin stole internal data and employee info from party headquarters. Officials suggest attack may be politically motivated hybrid warfare.]]></description>
            <link>https://www.probablypwned.com/article/qilin-ransomware-die-linke-german-political-party-hybrid-warfare</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/qilin-ransomware-die-linke-german-political-party-hybrid-warfare</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Germany]]></category>
            <category><![CDATA[Die Linke]]></category>
            <category><![CDATA[political parties]]></category>
            <category><![CDATA[hybrid warfare]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NoVoice Rootkit Infected 2.3M Android Devices via Play]]></title>
            <description><![CDATA[McAfee discovered NoVoice malware hiding in 50+ Google Play apps, using 22 exploits to root devices and clone WhatsApp sessions. Factory reset won't remove it.]]></description>
            <link>https://www.probablypwned.com/article/novoice-android-rootkit-google-play-2-3-million-devices</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/novoice-android-rootkit-google-play-2-3-million-devices</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[NoVoice]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[rootkit]]></category>
            <category><![CDATA[Google Play]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[mobile malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 12:05:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Uses GitHub as C2 in South Korea Attacks]]></title>
            <description><![CDATA[FortiGuard Labs exposes DPRK campaign using LNK files and GitHub repositories for command-and-control against South Korean targets. 22 evasion techniques identified.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-github-c2-lnk-south-korea-fortigate</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-github-c2-lnk-south-korea-fortigate</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[DPRK]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[South Korea]]></category>
            <category><![CDATA[LNK]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 12:04:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Storm Infostealer Decrypts Credentials Server-Side]]></title>
            <description><![CDATA[New Storm infostealer bypasses Chrome's App-Bound Encryption by shipping encrypted credentials to attacker infrastructure for decryption. Endpoint tools can't detect it.]]></description>
            <link>https://www.probablypwned.com/article/storm-infostealer-server-side-decryption-browser-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/storm-infostealer-server-side-decryption-browser-credentials</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Storm]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[MaaS]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 12:03:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Azure Kubernetes CVE-2026-33105 Hits CVSS 10.0]]></title>
            <description><![CDATA[Microsoft Azure Kubernetes Service has a critical auth bypass (CVE-2026-33105) with a perfect CVSS 10.0 score. Unauthenticated attackers can escalate to cluster admin—patch now.]]></description>
            <link>https://www.probablypwned.com/article/azure-kubernetes-cve-2026-33105-cvss-10-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/azure-kubernetes-cve-2026-33105-cvss-10-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-33105]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[Kubernetes]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 12:02:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrystalX RAT Flips Screens While Emptying Crypto Wallets]]></title>
            <description><![CDATA[Kaspersky exposes CrystalX RAT, a new malware-as-a-service combining stealer, RAT, and prankware. It rotates screens, swaps mouse buttons, and drains crypto via clipboard hijacking.]]></description>
            <link>https://www.probablypwned.com/article/crystalx-rat-maas-stealer-prankware-kaspersky</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crystalx-rat-maas-stealer-prankware-kaspersky</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[CrystalX RAT]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[cryptoclipping]]></category>
            <category><![CDATA[prankware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Stolen Credentials Hit Dark Web Markets Within 48 Hours]]></title>
            <description><![CDATA[New research maps the infostealer lifecycle from infection to dark web sale. Microsoft Entra ID appears in 79% of 2.05 million credential logs analyzed in 2026.]]></description>
            <link>https://www.probablypwned.com/article/infostealer-48-hour-dark-web-enterprise-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infostealer-48-hour-dark-web-enterprise-credentials</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[dark web]]></category>
            <category><![CDATA[Microsoft Entra ID]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:08:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hasbro Confirms Cyberattack, Warns of Weeks-Long Recovery]]></title>
            <description><![CDATA[Toy giant Hasbro filed an SEC 8-K disclosing unauthorized network access discovered March 28. Systems remain offline with recovery expected to take weeks.]]></description>
            <link>https://www.probablypwned.com/article/hasbro-cyberattack-sec-filing-weeks-recovery</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hasbro-cyberattack-sec-filing-weeks-recovery</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Hasbro]]></category>
            <category><![CDATA[SEC filing]]></category>
            <category><![CDATA[cyberattack]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:07:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Italy's Largest Bank Fined $36M After Employee Snooped for Years]]></title>
            <description><![CDATA[Intesa Sanpaolo hit with $36 million GDPR fine after a single employee accessed 3,573 customer accounts undetected for over two years, including politicians.]]></description>
            <link>https://www.probablypwned.com/article/intesa-sanpaolo-gdpr-fine-31-million-insider-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/intesa-sanpaolo-gdpr-fine-31-million-insider-access</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[GDPR]]></category>
            <category><![CDATA[Intesa Sanpaolo]]></category>
            <category><![CDATA[insider threat]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Italy]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:05:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hackers Impersonate Ukraine's CERT to Push AGEWHEEZE RAT]]></title>
            <description><![CDATA[Threat actor UAC-0255 sent 1 million phishing emails posing as CERT-UA to distribute the AGEWHEEZE remote access trojan targeting Ukrainian organizations.]]></description>
            <link>https://www.probablypwned.com/article/uac-0255-agewheeze-cert-ua-impersonation-million-emails</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uac-0255-agewheeze-cert-ua-impersonation-million-emails</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UAC-0255]]></category>
            <category><![CDATA[AGEWHEEZE]]></category>
            <category><![CDATA[CERT-UA]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[phishing]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:04:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DeepLoad Malware Uses AI-Generated Code to Evade Detection]]></title>
            <description><![CDATA[New DeepLoad malware combines ClickFix delivery with AI-generated obfuscation to bypass security scanners. WMI persistence survives remediation for days.]]></description>
            <link>https://www.probablypwned.com/article/deepload-malware-clickfix-ai-evasion-wmi-persistence</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/deepload-malware-clickfix-ai-evasion-wmi-persistence</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[DeepLoad]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[WMI persistence]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:03:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AuraStealer Spreads Via TikTok Videos Posing as Software Tutorials]]></title>
            <description><![CDATA[Russian-linked AuraStealer infostealer operates 48 C2 domains, steals crypto wallets and 2FA tokens, and spreads through fake software activation videos on TikTok.]]></description>
            <link>https://www.probablypwned.com/article/aurastealer-infostealer-48-c2-domains-tiktok-distribution</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aurastealer-infostealer-48-c2-domains-tiktok-distribution</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AuraStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[TikTok]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:06:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vertex AI Flaw Turns Enterprise AI Agents Into Data Thieves]]></title>
            <description><![CDATA[Unit 42 exposes how excessive default permissions in Google Cloud's Vertex AI let attackers weaponize AI agents to steal data from customer environments.]]></description>
            <link>https://www.probablypwned.com/article/vertex-ai-double-agent-gcp-data-exfiltration-unit42</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vertex-ai-double-agent-gcp-data-exfiltration-unit42</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Google Cloud]]></category>
            <category><![CDATA[Vertex AI]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[data exfiltration]]></category>
            <category><![CDATA[Unit 42]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:05:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese APT Hijacked TrueConf Updates to Backdoor Governments]]></title>
            <description><![CDATA[Operation TrueChaos exploited CVE-2026-3502 in TrueConf video conferencing to deploy Havoc malware across Southeast Asian government networks.]]></description>
            <link>https://www.probablypwned.com/article/operation-truechaos-trueconf-zero-day-southeast-asia-apt</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-truechaos-trueconf-zero-day-southeast-asia-apt</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[TrueConf]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[CVE-2026-3502]]></category>
            <category><![CDATA[Havoc]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:04:53 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Patches Fourth Chrome Zero-Day of 2026]]></title>
            <description><![CDATA[CVE-2026-5281 exploited in the wild targets Dawn WebGPU implementation. Google rushes emergency patch as Chrome zero-days accelerate in 2026.]]></description>
            <link>https://www.probablypwned.com/article/chrome-cve-2026-5281-fourth-zero-day-dawn-webgpu</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-cve-2026-5281-fourth-zero-day-dawn-webgpu</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-5281]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[WebGPU]]></category>
            <category><![CDATA[Google]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Telnetd Flaw Lets Attackers Get Root Before Login Prompt]]></title>
            <description><![CDATA[CVE-2026-32746 (CVSS 9.8) in GNU InetUtils telnetd enables unauthenticated root RCE via buffer overflow. FreeBSD, NetBSD, Citrix NetScaler affected.]]></description>
            <link>https://www.probablypwned.com/article/telnetd-cve-2026-32746-cvss-9-8-unauthenticated-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/telnetd-cve-2026-32746-cvss-9-8-unauthenticated-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-32746]]></category>
            <category><![CDATA[telnetd]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Citrix NetScaler]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:03:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Axios npm Hijack Drops Cross-Platform RAT on 100M+ Installs]]></title>
            <description><![CDATA[Attackers compromised the Axios npm package to deploy a cross-platform RAT targeting Windows, macOS, and Linux. Here's what happened and what you need to do.]]></description>
            <link>https://www.probablypwned.com/article/axios-npm-supply-chain-rat-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/axios-npm-supply-chain-rat-march-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[axios]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Telegram Disputes Critical Zero-Click Sticker RCE Claim]]></title>
            <description><![CDATA[Trend Micro ZDI disclosed a CVSS 9.8 flaw enabling device takeover via animated stickers. Telegram says the vulnerability doesn't exist. No patch until July 2026.]]></description>
            <link>https://www.probablypwned.com/article/telegram-zero-click-sticker-zdi-can-30207-disputed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/telegram-zero-click-sticker-zdi-can-30207-disputed</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[zero-click]]></category>
            <category><![CDATA[ZDI-CAN-30207]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[animated stickers]]></category>
            <category><![CDATA[mobile security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:06:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ChatGPT Bug Let Malicious Prompts Exfiltrate Data via DNS]]></title>
            <description><![CDATA[Check Point Research disclosed a ChatGPT vulnerability that abused DNS tunneling to silently steal conversation data. OpenAI patched the flaw on February 20, 2026.]]></description>
            <link>https://www.probablypwned.com/article/chatgpt-dns-tunneling-data-exfiltration-checkpoint</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chatgpt-dns-tunneling-data-exfiltration-checkpoint</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[DNS tunneling]]></category>
            <category><![CDATA[data exfiltration]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[prompt injection]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:06:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Exploiting FortiClient EMS SQLi Flaw in the Wild]]></title>
            <description><![CDATA[CVE-2026-21643 exploitation began March 26, six weeks after Fortinet's patch. Around 1,000 internet-exposed EMS instances remain vulnerable to unauthenticated RCE.]]></description>
            <link>https://www.probablypwned.com/article/forticlient-ems-cve-2026-21643-active-exploitation-march</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/forticlient-ems-cve-2026-21643-active-exploitation-march</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiClient EMS]]></category>
            <category><![CDATA[CVE-2026-21643]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[active exploitation]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:05:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Merge Node Flaw Exposes 615K Instances to RCE]]></title>
            <description><![CDATA[CVE-2026-33660 (CVSS 9.4) lets authenticated users escape n8n's AlaSQL sandbox via the Merge node. Over 615,000 public instances potentially vulnerable.]]></description>
            <link>https://www.probablypwned.com/article/n8n-merge-node-cve-2026-33660-alasql-sandbox-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-merge-node-cve-2026-33660-alasql-sandbox-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-33660]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[AlaSQL]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Citrix NetScaler Patches by April 2 After KEV Addition]]></title>
            <description><![CDATA[CVE-2026-3055 now actively exploited. CISA adds the CVSS 9.3 memory leak to KEV catalog, giving federal agencies until April 2 to patch SAML IdP configurations.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-citrix-netscaler-cve-2026-3055-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-citrix-netscaler-cve-2026-3055-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Citrix]]></category>
            <category><![CDATA[NetScaler]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[CVE-2026-3055]]></category>
            <category><![CDATA[active exploitation]]></category>
            <category><![CDATA[SAML]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FCC Bans Import of Foreign-Made Consumer Routers Over Supply Chain Risks]]></title>
            <description><![CDATA[All new overseas-manufactured routers prohibited from U.S. market after Volt Typhoon and Salt Typhoon exploited compromised devices. Existing routers unaffected.]]></description>
            <link>https://www.probablypwned.com/article/fcc-bans-foreign-routers-volt-typhoon-supply-chain-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fcc-bans-foreign-routers-volt-typhoon-supply-chain-security</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[FCC]]></category>
            <category><![CDATA[router ban]]></category>
            <category><![CDATA[supply chain security]]></category>
            <category><![CDATA[Volt Typhoon]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 30 Mar 2026 12:06:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lloyds App Glitch Exposed 450K Customers' Transactions to Other Users]]></title>
            <description><![CDATA[API defect in Lloyds, Halifax, and Bank of Scotland apps let users view strangers' transactions including account numbers and NI numbers. Bank paying compensation.]]></description>
            <link>https://www.probablypwned.com/article/lloyds-bank-app-glitch-450000-customers-transactions-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lloyds-bank-app-glitch-450000-customers-transactions-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Lloyds Bank]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[banking app]]></category>
            <category><![CDATA[API vulnerability]]></category>
            <category><![CDATA[UK banking]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 30 Mar 2026 12:05:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenClaw Bootstrap Replay Bug Enables Admin Takeover (CVE-2026-32987)]]></title>
            <description><![CDATA[Critical CVSS 9.8 flaw in OpenClaw AI agent platform lets attackers replay setup codes for privilege escalation. Patch to version 2026.3.13 immediately.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-cve-2026-32987-bootstrap-replay-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-cve-2026-32987-bootstrap-replay-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-32987]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[AI agents]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 30 Mar 2026 12:05:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Red Menshen Plants BPFDoor Sleeper Cells in Global Telecom Networks]]></title>
            <description><![CDATA[China-linked APT embeds kernel-level backdoors in telecom infrastructure across Middle East and Asia. Rapid7 finds stealthy implants evading detection for years.]]></description>
            <link>https://www.probablypwned.com/article/red-menshen-bpfdoor-telecom-espionage-sleeper-cells</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/red-menshen-bpfdoor-telecom-espionage-sleeper-cells</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Red Menshen]]></category>
            <category><![CDATA[BPFDoor]]></category>
            <category><![CDATA[telecom espionage]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[Linux backdoor]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 30 Mar 2026 12:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[800K Sites at Risk from Smart Slider 3 File Read Flaw]]></title>
            <description><![CDATA[CVE-2026-3098 lets subscribers read wp-config.php and any server file. Amelia Booking Pro also patched for admin password reset bug. Update these WordPress plugins now.]]></description>
            <link>https://www.probablypwned.com/article/smart-slider-amelia-wordpress-plugins-urgent-march-2026-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smart-slider-amelia-wordpress-plugins-urgent-march-2026-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-3098]]></category>
            <category><![CDATA[Smart Slider 3]]></category>
            <category><![CDATA[Amelia]]></category>
            <category><![CDATA[plugin vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 29 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pro-Ukraine Group Bearlyfy Deploys Custom GenieLocker Ransomware]]></title>
            <description><![CDATA[Bearlyfy has hit 70+ Russian companies since January 2025, now deploying custom GenieLocker ransomware. The group blends financial extortion with politically motivated sabotage.]]></description>
            <link>https://www.probablypwned.com/article/bearlyfy-genielocker-ransomware-70-russian-companies-ukraine</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bearlyfy-genielocker-ransomware-70-russian-companies-ukraine</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Bearlyfy]]></category>
            <category><![CDATA[GenieLocker]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[threat actor]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 29 Mar 2026 12:05:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[F5 BIG-IP Flaw Upgraded to RCE After Active Exploitation Confirmed]]></title>
            <description><![CDATA[CISA added CVE-2025-53521 to its KEV catalog after F5 reclassified the BIG-IP APM vulnerability from DoS to remote code execution. CVSS 9.8—federal deadline is March 30.]]></description>
            <link>https://www.probablypwned.com/article/f5-big-ip-apm-cve-2025-53521-cisa-kev-rce-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/f5-big-ip-apm-cve-2025-53521-cisa-kev-rce-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[F5]]></category>
            <category><![CDATA[BIG-IP]]></category>
            <category><![CDATA[CVE-2025-53521]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 29 Mar 2026 12:04:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TeamPCP Hijacks Telnyx PyPI Package to Deploy WAV-Hidden Stealer]]></title>
            <description><![CDATA[TeamPCP compromised the popular telnyx Python SDK on PyPI, hiding credential-stealing malware inside WAV audio files. Versions 4.87.1 and 4.87.2 affected—downgrade immediately.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-telnyx-pypi-supply-chain-wav-steganography</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-telnyx-pypi-supply-chain-wav-steganography</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[steganography]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 29 Mar 2026 12:04:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vidar Infostealer Spreads via Hacked WordPress Sites]]></title>
            <description><![CDATA[Malwarebytes researchers detected a Vidar infostealer campaign using fake CAPTCHA pages on compromised WordPress sites. ClickFix technique tricks users into running malicious PowerShell.]]></description>
            <link>https://www.probablypwned.com/article/vidar-infostealer-wordpress-fake-captcha-clickfix-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vidar-infostealer-wordpress-fake-captcha-clickfix-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[fake CAPTCHA]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 28 Mar 2026 12:05:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[European Commission Confirms AWS Cloud Breach]]></title>
            <description><![CDATA[Hackers compromised the European Commission's Amazon cloud infrastructure, claiming to steal 350GB of data including employee databases. Investigation ongoing.]]></description>
            <link>https://www.probablypwned.com/article/european-commission-aws-breach-350gb-data-stolen-cloud</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/european-commission-aws-breach-350gb-data-stolen-cloud</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[European Commission]]></category>
            <category><![CDATA[AWS]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Europa.eu]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 28 Mar 2026 12:04:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LangChain Flaws Expose Files, Secrets, and Databases]]></title>
            <description><![CDATA[Three vulnerabilities in LangChain and LangGraph expose filesystems, environment secrets, and conversation histories. CVE-2026-34070 enables path traversal. Patches available now.]]></description>
            <link>https://www.probablypwned.com/article/langchain-langgraph-cve-2026-34070-path-traversal-sql-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langchain-langgraph-cve-2026-34070-path-traversal-sql-injection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[LangChain]]></category>
            <category><![CDATA[LangGraph]]></category>
            <category><![CDATA[CVE-2026-34070]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[path traversal]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 28 Mar 2026 12:03:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake VS Code Security Alerts Flood GitHub to Spread Malware]]></title>
            <description><![CDATA[Attackers are posting thousands of fake Visual Studio Code vulnerability alerts in GitHub Discussions, using fabricated CVEs and urgent language to trick developers into downloading malware.]]></description>
            <link>https://www.probablypwned.com/article/github-phishing-fake-vscode-alerts-malware-socket</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/github-phishing-fake-vscode-alerts-malware-socket</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[Visual Studio Code]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Infiniti Stealer: macOS Malware Uses ClickFix and Nuitka Compilation]]></title>
            <description><![CDATA[A new macOS infostealer combines ClickFix social engineering with Nuitka-compiled Python to evade detection. First documented campaign pairing these techniques.]]></description>
            <link>https://www.probablypwned.com/article/infiniti-stealer-macos-clickfix-python-nuitka-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infiniti-stealer-macos-clickfix-python-nuitka-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Nuitka]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:11:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RedLine Infostealer Developer Faces 50 Years After US Extradition]]></title>
            <description><![CDATA[Armenian national Hambardzum Minasyan extradited to face charges for developing RedLine malware infrastructure. Follows 2024 international takedown operation.]]></description>
            <link>https://www.probablypwned.com/article/redline-infostealer-developer-extradited-hambardzum-minasyan-50-years</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/redline-infostealer-developer-extradited-hambardzum-minasyan-50-years</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[RedLine]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[extradition]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:09:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce]]></title>
            <description><![CDATA[A new payment skimmer uses WebRTC data channels instead of HTTP to exfiltrate stolen card data, bypassing Content Security Policy controls on Magento stores.]]></description>
            <link>https://www.probablypwned.com/article/webrtc-payment-skimmer-csp-bypass-magento-ecommerce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/webrtc-payment-skimmer-csp-bypass-magento-ecommerce</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[payment skimmer]]></category>
            <category><![CDATA[WebRTC]]></category>
            <category><![CDATA[Magento]]></category>
            <category><![CDATA[e-commerce]]></category>
            <category><![CDATA[CSP bypass]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:08:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ajax Amsterdam Breach Exposed 300K Fan Accounts to Ticket Theft]]></title>
            <description><![CDATA[An API vulnerability in AFC Ajax systems let attackers access fan data and transfer 42,000+ season tickets. Club patched after journalists demonstrated the flaw.]]></description>
            <link>https://www.probablypwned.com/article/ajax-amsterdam-breach-300000-fans-ticket-hijacking-api-flaw</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ajax-amsterdam-breach-300000-fans-ticket-hijacking-api-flaw</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Ajax Amsterdam]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[API security]]></category>
            <category><![CDATA[sports]]></category>
            <category><![CDATA[ticket fraud]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ubiquiti UniFi Flaw Scores CVSS 10—Patch Before Full Takeover]]></title>
            <description><![CDATA[CVE-2026-22557 lets unauthenticated attackers traverse paths and hijack UniFi Network accounts. CVSS 10.0 severity demands immediate patching to 10.1.89.]]></description>
            <link>https://www.probablypwned.com/article/ubiquiti-unifi-cve-2026-22557-cvss-10-path-traversal-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ubiquiti-unifi-cve-2026-22557-cvss-10-path-traversal-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ubiquiti]]></category>
            <category><![CDATA[CVE-2026-22557]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:05:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UK Sanctions Xinbi Marketplace Over $19B in Scam Laundering]]></title>
            <description><![CDATA[Britain becomes the first country to sanction Xinbi, a Telegram-based crypto marketplace that processed $19.9 billion for pig butchering scams and North Korean hackers.]]></description>
            <link>https://www.probablypwned.com/article/uk-sanctions-xinbi-telegram-marketplace-19-billion-pig-butchering</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uk-sanctions-xinbi-telegram-marketplace-19-billion-pig-butchering</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Xinbi]]></category>
            <category><![CDATA[UK sanctions]]></category>
            <category><![CDATA[pig butchering]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[money laundering]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Device Code Phishing Hits 340+ Microsoft 365 Orgs in 5 Countries]]></title>
            <description><![CDATA[EvilTokens phishing platform targets Microsoft 365 identities across US, Canada, Australia, New Zealand, and Germany. OAuth abuse bypasses MFA to steal access tokens.]]></description>
            <link>https://www.probablypwned.com/article/eviltokens-device-code-phishing-340-microsoft-365-oauth-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/eviltokens-device-code-phishing-340-microsoft-365-oauth-bypass</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[device code phishing]]></category>
            <category><![CDATA[EvilTokens]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[phishing-as-a-service]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:07:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russian Access Broker Gets 81 Months for Yanluowang Attacks]]></title>
            <description><![CDATA[Aleksei Volkov sentenced to nearly 7 years for selling network access to ransomware gangs. Facilitated dozens of attacks causing over $9 million in losses to US organizations.]]></description>
            <link>https://www.probablypwned.com/article/aleksei-volkov-sentenced-81-months-yanluowang-ransomware-broker</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aleksei-volkov-sentenced-81-months-yanluowang-ransomware-broker</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Yanluowang]]></category>
            <category><![CDATA[initial access broker]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[sentencing]]></category>
            <category><![CDATA[cybercrime]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:06:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Copyright Phishing Delivers PureLog Stealer to Healthcare, Gov]]></title>
            <description><![CDATA[Fake copyright infringement notices target healthcare and government organizations in Germany and Canada with fileless PureLog Stealer malware. Campaign uses language-matched lures.]]></description>
            <link>https://www.probablypwned.com/article/purelog-stealer-copyright-phishing-healthcare-government-germany</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/purelog-stealer-copyright-phishing-healthcare-government-germany</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PureLog Stealer]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[copyright]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[Germany]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:06:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TP-Link Archer Routers Vulnerable to Unauthenticated Takeover]]></title>
            <description><![CDATA[Critical CVE-2025-15517 allows attackers to bypass authentication on TP-Link Archer NX routers, upload malicious firmware, and modify configurations without credentials.]]></description>
            <link>https://www.probablypwned.com/article/tp-link-archer-nx-cve-2025-15517-auth-bypass-firmware-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tp-link-archer-nx-cve-2025-15517-auth-bypass-firmware-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[TP-Link]]></category>
            <category><![CDATA[router]]></category>
            <category><![CDATA[CVE-2025-15517]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[firmware]]></category>
            <category><![CDATA[IoT]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:05:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Torg Grabber Steals from 728 Crypto Wallets via ClickFix]]></title>
            <description><![CDATA[New Torg Grabber infostealer targets 728 cryptocurrency wallet extensions and 103 password managers. Spreads via ClickFix clipboard hijacking with Cloudflare-based exfiltration.]]></description>
            <link>https://www.probablypwned.com/article/torg-grabber-infostealer-728-crypto-wallets-clickfix</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/torg-grabber-infostealer-728-crypto-wallets-clickfix</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Torg Grabber]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[browser extensions]]></category>
            <category><![CDATA[wallet theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:04:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TeamPCP Hijacks Checkmarx KICS Using Stolen Trivy Tokens]]></title>
            <description><![CDATA[Stolen CI credentials from Trivy breach enabled TeamPCP to compromise Checkmarx KICS GitHub Actions, poisoning all 35 version tags with credential-stealing malware in four-hour window.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-checkmarx-kics-github-action-trivy-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-checkmarx-kics-github-action-trivy-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[Checkmarx]]></category>
            <category><![CDATA[KICS]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 25 Mar 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Extorts Infinite Campus After Salesforce Breach]]></title>
            <description><![CDATA[K-12 student information system provider Infinite Campus discloses breach affecting school staff data. ShinyHunters issued March 25 ransom deadline after claiming to steal Salesforce records.]]></description>
            <link>https://www.probablypwned.com/article/infinite-campus-shinyhunters-breach-11-million-students</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infinite-campus-shinyhunters-breach-11-million-students</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Infinite Campus]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[Salesforce]]></category>
            <category><![CDATA[extortion]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 25 Mar 2026 12:05:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TeamPCP Poisons LiteLLM Package With Three-Stage Backdoor]]></title>
            <description><![CDATA[Malicious LiteLLM versions 1.82.7 and 1.82.8 deployed credential harvester, Kubernetes lateral movement tools, and persistent backdoor. Package sees 3 million daily downloads.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-litellm-pypi-supply-chain-credential-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-litellm-pypi-supply-chain-credential-stealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[LiteLLM]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 25 Mar 2026 12:04:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PTC Windchill CVSS 10 RCE Bug Prompts German Police Response]]></title>
            <description><![CDATA[Critical deserialization flaw CVE-2026-4681 in PTC Windchill and FlexPLM threatens manufacturing sector. German federal police dispatched to warn companies of imminent exploitation.]]></description>
            <link>https://www.probablypwned.com/article/ptc-windchill-flexplm-cve-2026-4681-cvss-10-imminent-threat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ptc-windchill-flexplm-cve-2026-4681-cvss-10-imminent-threat</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-4681]]></category>
            <category><![CDATA[PTC Windchill]]></category>
            <category><![CDATA[FlexPLM]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[deserialization]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 25 Mar 2026 12:03:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Fixes Month-Long Outlook Gmail Sync Bug]]></title>
            <description><![CDATA[Classic Outlook users can finally sync Gmail again after Microsoft resolves OAuth token issue that blocked email synchronization since February 26. Here's what happened and how to restore access.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-fixes-classic-outlook-gmail-sync-bug-oauth</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-fixes-classic-outlook-gmail-sync-bug-oauth</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Outlook]]></category>
            <category><![CDATA[Gmail]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[email-sync]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Europol and Microsoft Dismantle Tycoon 2FA Phishing Empire]]></title>
            <description><![CDATA[Global coalition seizes 330 domains powering Tycoon 2FA, a phishing-as-a-service platform that bypassed MFA to compromise 96,000 victims across 500,000 organizations.]]></description>
            <link>https://www.probablypwned.com/article/tycoon-2fa-takedown-europol-microsoft-330-domains</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tycoon-2fa-takedown-europol-microsoft-330-domains</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Tycoon 2FA]]></category>
            <category><![CDATA[Europol]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[law enforcement]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:07:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Crunchyroll Breach Exposes 6.8 Million Users via Malware]]></title>
            <description><![CDATA[Hackers infected a contractor's device to steal Okta credentials, then pivoted to Crunchyroll's Zendesk. Support ticket data for 6.8 million subscribers extracted.]]></description>
            <link>https://www.probablypwned.com/article/crunchyroll-breach-6-8-million-zendesk-contractor-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crunchyroll-breach-6-8-million-zendesk-contractor-malware</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Crunchyroll]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Zendesk]]></category>
            <category><![CDATA[Okta]]></category>
            <category><![CDATA[third-party vendor]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:06:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Four Critical n8n Flaws Enable Unauthenticated RCE]]></title>
            <description><![CDATA[n8n patches CVE-2026-27577, CVE-2026-27493, and two more sandbox escapes. One flaw allows unauthenticated attackers to execute commands via public form endpoints.]]></description>
            <link>https://www.probablypwned.com/article/n8n-march-2026-four-critical-cves-sandbox-form-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-march-2026-four-critical-cves-sandbox-form-injection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-27577]]></category>
            <category><![CDATA[CVE-2026-27493]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:06:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Citrix NetScaler Memory Leak Exposes SAML SSO Secrets]]></title>
            <description><![CDATA[CVE-2026-3055 (CVSS 9.3) lets unauthenticated attackers read sensitive data from NetScaler memory. Affects appliances configured as SAML Identity Providers—patch now.]]></description>
            <link>https://www.probablypwned.com/article/citrix-netscaler-cve-2026-3055-saml-memory-leak</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/citrix-netscaler-cve-2026-3055-saml-memory-leak</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Citrix]]></category>
            <category><![CDATA[NetScaler]]></category>
            <category><![CDATA[CVE-2026-3055]]></category>
            <category><![CDATA[SAML]]></category>
            <category><![CDATA[memory leak]]></category>
            <category><![CDATA[out-of-bounds read]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:05:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Quest KACE SMA CVSS 10.0 Flaw Exploited in the Wild]]></title>
            <description><![CDATA[Attackers exploiting CVE-2025-32975 authentication bypass in Quest KACE to hijack admin accounts and deploy credential harvesters. Patched in May 2025—many remain exposed.]]></description>
            <link>https://www.probablypwned.com/article/quest-kace-sma-cve-2025-32975-cvss-10-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/quest-kace-sma-cve-2025-32975-cvss-10-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Quest KACE]]></category>
            <category><![CDATA[CVE-2025-32975]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[active exploitation]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CanisterWorm Adds Iran-Targeting Kubernetes Wiper]]></title>
            <description><![CDATA[TeamPCP's supply chain attack expands with a Kubernetes wiper that detects Iranian systems via timezone and locale, wiping clusters while backdooring everyone else.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-canisterworm-kubernetes-wiper-iran-docker-hub</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-canisterworm-kubernetes-wiper-iran-docker-hub</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[CanisterWorm]]></category>
            <category><![CDATA[Kubernetes]]></category>
            <category><![CDATA[wiper]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Docker Hub]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iranian APT Deploys Fake RedAlert App to Surveil Israeli Users]]></title>
            <description><![CDATA[Unit 42 uncovers phishing campaign distributing trojanized Israeli civil defense app. Malicious APK harvests location data, contacts, and messages from Android devices amid regional tensions.]]></description>
            <link>https://www.probablypwned.com/article/iran-redalert-android-malware-israel-surveillance-unit42</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-redalert-android-malware-israel-surveillance-unit42</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Android malware]]></category>
            <category><![CDATA[RedAlert]]></category>
            <category><![CDATA[surveillance]]></category>
            <category><![CDATA[Israel]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 12:13:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AVideo RCE Chain Gives Attackers Full Server Access Without Auth]]></title>
            <description><![CDATA[Three vulnerabilities in AVideo's CloneSite plugin chain together for unauthenticated remote code execution. CVE-2026-33478 has no patch available as attackers can extract admin credentials and inject OS commands.]]></description>
            <link>https://www.probablypwned.com/article/avideo-cve-2026-33478-unauthenticated-rce-chain-unpatched</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/avideo-cve-2026-33478-unauthenticated-rce-chain-unpatched</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AVideo]]></category>
            <category><![CDATA[CVE-2026-33478]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[unpatched]]></category>
            <category><![CDATA[video platform]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 12:10:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ubuntu Desktop Flaw Lets Local Users Escalate to Root]]></title>
            <description><![CDATA[CVE-2026-3888 exploits timing race between snap-confine and systemd-tmpfiles to grant root access on Ubuntu Desktop 24.04+. Qualys researchers demonstrate full privilege escalation.]]></description>
            <link>https://www.probablypwned.com/article/ubuntu-cve-2026-3888-snap-confine-root-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ubuntu-cve-2026-3888-snap-confine-root-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ubuntu]]></category>
            <category><![CDATA[CVE-2026-3888]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[snap-confine]]></category>
            <category><![CDATA[systemd]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 12:08:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Navia Benefit Solutions Breach Exposes 2.7 Million SSNs]]></title>
            <description><![CDATA[Workplace benefits administrator Navia discloses data breach affecting 2.7 million individuals. Social Security numbers, health plan data, and personal information stolen during December-January intrusion.]]></description>
            <link>https://www.probablypwned.com/article/navia-benefit-solutions-breach-2-7-million-ssn-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/navia-benefit-solutions-breach-2-7-million-ssn-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Navia]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SSN exposure]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[COBRA]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 12:06:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VoidStealer Bypasses Chrome ABE Using Debugger Trick]]></title>
            <description><![CDATA[VoidStealer v2.0 becomes the first infostealer to extract Chrome's v20_master_key using hardware breakpoints. No injection or privilege escalation required.]]></description>
            <link>https://www.probablypwned.com/article/voidstealer-chrome-master-key-debugger-abe-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/voidstealer-chrome-master-key-debugger-abe-bypass</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VoidStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[Application-Bound Encryption]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 22 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet Patches 11 Flaws in FortiManager, FortiAnalyzer, FortiSandbox]]></title>
            <description><![CDATA[Fortinet's March 2026 security advisory addresses 11 vulnerabilities including auth bypass, SQL injection, and buffer overflow flaws affecting enterprise management products.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-march-2026-eleven-cve-patch-fortimanager-fortianalyzer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-march-2026-eleven-cve-patch-fortimanager-fortianalyzer</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiManager]]></category>
            <category><![CDATA[FortiAnalyzer]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[patch]]></category>
            <category><![CDATA[SQL injection]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 22 Mar 2026 12:06:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Trivy Scanner Breach Spawns CanisterWorm Across 47 npm Packages]]></title>
            <description><![CDATA[TeamPCP threat actors hijacked Aqua Security's Trivy vulnerability scanner, compromising 75 GitHub Action tags and spreading credential-stealing malware to 47 npm packages via blockchain C2.]]></description>
            <link>https://www.probablypwned.com/article/trivy-supply-chain-teampcp-canisterworm-npm-github-actions</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trivy-supply-chain-teampcp-canisterworm-npm-github-actions</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Trivy]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[CanisterWorm]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 22 Mar 2026 12:05:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Warns Russian Hackers Compromised Thousands of Signal, WhatsApp Accounts]]></title>
            <description><![CDATA[FBI and CISA alert reveals Russian intelligence operatives have hijacked thousands of Signal and WhatsApp accounts belonging to US officials, military, and journalists through phishing attacks.]]></description>
            <link>https://www.probablypwned.com/article/fbi-cisa-russian-intelligence-signal-whatsapp-phishing-thousands</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-cisa-russian-intelligence-signal-whatsapp-phishing-thousands</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Signal]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Star Blizzard]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 22 Mar 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PolyShell Flaw Exposes All Magento Stores to RCE Attacks]]></title>
            <description><![CDATA[Unrestricted file upload in Magento and Adobe Commerce REST API allows unauthenticated attackers to upload executable files. No isolated patch available for production versions.]]></description>
            <link>https://www.probablypwned.com/article/polyshell-magento-adobe-commerce-unauthenticated-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/polyshell-magento-adobe-commerce-unauthenticated-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Magento]]></category>
            <category><![CDATA[Adobe Commerce]]></category>
            <category><![CDATA[PolyShell]]></category>
            <category><![CDATA[file upload]]></category>
            <category><![CDATA[ecommerce security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:06:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Apple, Craft CMS, Laravel Bugs to KEV Catalog]]></title>
            <description><![CDATA[Five vulnerabilities under active exploitation added to CISA's KEV catalog. Federal agencies must patch by April 3, 2026. Includes three Apple kernel flaws and Laravel RCE.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-apple-craftcms-laravel-livewire-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-apple-craftcms-laravel-livewire-march-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[Craft CMS]]></category>
            <category><![CDATA[Laravel Livewire]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:06:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Speagle Malware Hijacks Cobra DocGuard to Hunt Missile Data]]></title>
            <description><![CDATA[New infostealer parasitizes legitimate document security software, exfiltrating data through trusted server infrastructure. Targets include Dongfeng-27 ballistic missile documents.]]></description>
            <link>https://www.probablypwned.com/article/speagle-malware-cobra-docguard-chinese-missile-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/speagle-malware-cobra-docguard-chinese-missile-espionage</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Speagle]]></category>
            <category><![CDATA[Cobra DocGuard]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Runningcrab]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:05:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DOJ Disrupts 3M-Device Botnets Behind 31 Tbps DDoS Attacks]]></title>
            <description><![CDATA[International operation seizes C2 infrastructure for AISURU, Kimwolf, JackSkid, and Mossad botnets. Peak attacks hit 31.4 Tbps, targeting DOD systems and critical infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/doj-iot-botnet-aisuru-kimwolf-31-tbps-ddos-takedown</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/doj-iot-botnet-aisuru-kimwolf-31-tbps-ddos-takedown</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[IoT security]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[DOJ]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:04:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Langflow RCE Exploited Within 20 Hours of Disclosure]]></title>
            <description><![CDATA[CVE-2026-33017 (CVSS 9.3) lets attackers execute arbitrary Python code on Langflow AI pipelines without authentication. Exploitation began before any PoC existed.]]></description>
            <link>https://www.probablypwned.com/article/langflow-cve-2026-33017-critical-rce-20-hour-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langflow-cve-2026-33017-critical-rce-20-hour-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-33017]]></category>
            <category><![CDATA[Langflow]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:04:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Oracle Ships Emergency Patch for Critical Identity Manager RCE]]></title>
            <description><![CDATA[CVE-2026-21992 scores CVSS 9.8 and allows unauthenticated remote code execution on Oracle Identity Manager and Web Services Manager. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/oracle-identity-manager-cve-2026-21992-emergency-patch-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-identity-manager-cve-2026-21992-emergency-patch-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[CVE-2026-21992]]></category>
            <category><![CDATA[Identity Manager]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[out-of-band patch]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 20 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Baydöner Breach Exposes 3.7M Records With Plaintext Passwords]]></title>
            <description><![CDATA[Turkish restaurant chain Baydöner confirms breach affecting 3.7 million customers. Data includes 622,000 plaintext passwords and 42,000 national IDs now circulating on forums.]]></description>
            <link>https://www.probablypwned.com/article/baydoner-turkey-data-breach-3-7-million-plaintext-passwords</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/baydoner-turkey-data-breach-3-7-million-plaintext-passwords</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[Baydöner]]></category>
            <category><![CDATA[Turkey]]></category>
            <category><![CDATA[plaintext-passwords]]></category>
            <category><![CDATA[credential-exposure]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 20 Mar 2026 12:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Excel XSS Bug Weaponizes Copilot for Zero-Click Data Theft]]></title>
            <description><![CDATA[CVE-2026-26144 allows attackers to silently exfiltrate sensitive data through Microsoft Copilot Agent without user interaction. Patch now or disable Copilot.]]></description>
            <link>https://www.probablypwned.com/article/cve-2026-26144-excel-copilot-zero-click-data-exfiltration</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cve-2026-26144-excel-copilot-zero-click-data-exfiltration</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-26144]]></category>
            <category><![CDATA[Microsoft Excel]]></category>
            <category><![CDATA[Copilot]]></category>
            <category><![CDATA[zero-click]]></category>
            <category><![CDATA[data-exfiltration]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 20 Mar 2026 12:04:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GlassWorm Supply Chain Attack Surges to 433 Compromised Components]]></title>
            <description><![CDATA[GlassWorm campaign expands across Open VSX, npm, and GitHub with invisible Unicode payloads and Solana-based C2. Developers urged to audit dependencies immediately.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-supply-chain-433-extensions-npm-github-openvsx</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-supply-chain-433-extensions-npm-github-openvsx</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply-chain-attack]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[Visual Studio Code]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[developer-security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 20 Mar 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Honeywell BMS Controllers Ship With No Authentication by Design]]></title>
            <description><![CDATA[CVE-2026-3611 exposes Honeywell IQ4x building management controllers with CVSS 10 severity. Default configuration allows anyone to create admin accounts.]]></description>
            <link>https://www.probablypwned.com/article/honeywell-iq4x-bms-cve-2026-3611-cvss-10-no-authentication</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/honeywell-iq4x-bms-cve-2026-3611-cvss-10-no-authentication</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Honeywell]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[SCADA]]></category>
            <category><![CDATA[CVE-2026-3611]]></category>
            <category><![CDATA[building management]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:07:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT36 Floods Indian Government Networks With AI-Generated Malware]]></title>
            <description><![CDATA[Pakistan-linked APT36 uses LLM coding tools to mass-produce malware variants in Nim, Zig, and Crystal, targeting Indian government and embassies.]]></description>
            <link>https://www.probablypwned.com/article/apt36-transparent-tribe-vibeware-ai-malware-india</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt36-transparent-tribe-vibeware-ai-malware-india</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT36]]></category>
            <category><![CDATA[Transparent Tribe]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[India]]></category>
            <category><![CDATA[Pakistan]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:06:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VMware Aria Operations RCE Flaw Added to CISA KEV Catalog]]></title>
            <description><![CDATA[CISA confirms active exploitation of VMware Aria Operations CVE-2026-22719, a command injection flaw enabling unauthenticated RCE. Patch by March 24.]]></description>
            <link>https://www.probablypwned.com/article/vmware-aria-operations-cve-2026-22719-cisa-kev-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vmware-aria-operations-cve-2026-22719-cisa-kev-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[VMware]]></category>
            <category><![CDATA[Aria Operations]]></category>
            <category><![CDATA[CVE-2026-22719]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[command injection]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:05:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DarkSword Exploit Chain Hits iPhones Running iOS 18.4 to 18.7]]></title>
            <description><![CDATA[Multiple threat actors deploy DarkSword, a six-CVE iOS exploit chain stealing crypto wallets, credentials, and messages from millions of vulnerable iPhones.]]></description>
            <link>https://www.probablypwned.com/article/darksword-ios-exploit-chain-iphone-infostealer-unc6353</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/darksword-ios-exploit-chain-iphone-infostealer-unc6353</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[iPhone]]></category>
            <category><![CDATA[exploit chain]]></category>
            <category><![CDATA[DarkSword]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[UNC6353]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:04:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SharePoint RCE Flaw CVE-2026-20963 Under Active Exploitation]]></title>
            <description><![CDATA[CISA added Microsoft SharePoint CVE-2026-20963 to the KEV catalog after confirming active exploitation. Federal agencies must patch by March 21.]]></description>
            <link>https://www.probablypwned.com/article/sharepoint-cve-2026-20963-cisa-kev-deserialization-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sharepoint-cve-2026-20963-cisa-kev-deserialization-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[SharePoint]]></category>
            <category><![CDATA[CVE-2026-20963]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:04:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Interlock Ransomware Exploited Cisco FMC Flaw 36 Days Before Disclosure]]></title>
            <description><![CDATA[Interlock ransomware operators weaponized Cisco Secure Firewall Management Center CVE-2026-20131 as a zero-day since January 26, gaining root access to enterprise networks.]]></description>
            <link>https://www.probablypwned.com/article/interlock-ransomware-cisco-fmc-cve-2026-20131-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/interlock-ransomware-cisco-fmc-cve-2026-20131-zero-day</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-20131]]></category>
            <category><![CDATA[Interlock]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:03:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Data Broker Infutor Breach Exposes 676 Million Consumer Records]]></title>
            <description><![CDATA[Infutor data breach reportedly exposes 676 million consumer records including Social Security numbers. Misconfigured Elasticsearch database blamed for the exposure.]]></description>
            <link>https://www.probablypwned.com/article/infutor-data-breach-676-million-records-ssn-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infutor-data-breach-676-million-records-ssn-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Infutor]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[data broker]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[Elasticsearch]]></category>
            <category><![CDATA[consumer data]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:07:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EU Sanctions Chinese and Iranian Firms Over 65K Compromised Devices]]></title>
            <description><![CDATA[The EU sanctioned Integrity Technology Group, Anxun Information Technology, and Emennet Pasargad for cyberattacks against member states including the Paris Olympics.]]></description>
            <link>https://www.probablypwned.com/article/eu-sanctions-china-iran-integrity-technology-emennet-pasargad</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/eu-sanctions-china-iran-integrity-technology-emennet-pasargad</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[EU sanctions]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[Integrity Technology]]></category>
            <category><![CDATA[Emennet Pasargad]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:06:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Custom Fonts Let Attackers Hide Commands from AI Assistants]]></title>
            <description><![CDATA[LayerX researchers found that custom font rendering can hide malicious prompts from ChatGPT, Claude, Gemini, and other AI assistants while displaying them to users.]]></description>
            <link>https://www.probablypwned.com/article/font-rendering-attack-poisons-ai-assistants-layerx</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/font-rendering-attack-poisons-ai-assistants-layerx</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[Claude]]></category>
            <category><![CDATA[font rendering]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:05:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LeakNet Ransomware Ditches IABs for ClickFix and Deno]]></title>
            <description><![CDATA[LeakNet ransomware now uses ClickFix social engineering via hacked websites and a Deno-based in-memory loader to evade detection. Here's how the attack chain works.]]></description>
            <link>https://www.probablypwned.com/article/leaknet-ransomware-clickfix-deno-in-memory-loader</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/leaknet-ransomware-clickfix-deno-in-memory-loader</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[LeakNet]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Deno]]></category>
            <category><![CDATA[in-memory malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:04:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GNU telnetd Flaw Grants Root Access Before Login Prompt]]></title>
            <description><![CDATA[CVE-2026-32746 in GNU InetUtils telnetd allows unauthenticated root RCE via buffer overflow. CVSS 9.8, no patch available, over 200K servers exposed.]]></description>
            <link>https://www.probablypwned.com/article/gnu-inetutils-telnetd-cve-2026-32746-rce-unpatched</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gnu-inetutils-telnetd-cve-2026-32746-rce-unpatched</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-32746]]></category>
            <category><![CDATA[GNU InetUtils]]></category>
            <category><![CDATA[telnetd]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:03:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[No Malware Needed: Stryker Attackers Weaponized Intune]]></title>
            <description><![CDATA[Iran-linked hackers wiped tens of thousands of Stryker devices using Microsoft Intune's remote wipe feature. Here's what security teams should learn.]]></description>
            <link>https://www.probablypwned.com/article/stryker-wiper-attack-no-malware-intune-mdm-lessons</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stryker-wiper-attack-no-malware-intune-mdm-lessons</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Microsoft Intune]]></category>
            <category><![CDATA[MDM security]]></category>
            <category><![CDATA[Stryker]]></category>
            <category><![CDATA[Handala]]></category>
            <category><![CDATA[wiper attack]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russia-Linked DRILLAPP Backdoor Weaponizes Edge Browser Debugging]]></title>
            <description><![CDATA[New JavaScript backdoor targets Ukrainian entities using Microsoft Edge's debugging features for stealth. S2 Grupo links campaign to Laundry Bear threat group.]]></description>
            <link>https://www.probablypwned.com/article/drillapp-backdoor-ukraine-edge-browser-debugging-russia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/drillapp-backdoor-ukraine-edge-browser-debugging-russia</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DRILLAPP]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Laundry Bear]]></category>
            <category><![CDATA[Microsoft Edge]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:09:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Claims 1 Petabyte Theft from Telus Digital, Demands $65M]]></title>
            <description><![CDATA[Canadian BPO giant confirms breach after ShinyHunters claims massive data theft including call recordings, source code, and FBI background checks. Ransom ignored.]]></description>
            <link>https://www.probablypwned.com/article/telus-digital-shinyhunters-breach-1-petabyte-65m-ransom</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/telus-digital-shinyhunters-breach-1-petabyte-65m-ransom</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Telus Digital]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[BPO]]></category>
            <category><![CDATA[ransom]]></category>
            <category><![CDATA[Canada]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:08:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Companies House UK Flaw Exposed 5 Million Firms to Data Theft]]></title>
            <description><![CDATA[British government registry's WebFiling vulnerability let logged-in users access other companies' dashboards since October 2025. Unauthorized filings were possible.]]></description>
            <link>https://www.probablypwned.com/article/companies-house-uk-webfiling-flaw-5-million-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/companies-house-uk-webfiling-flaw-5-million-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Companies House]]></category>
            <category><![CDATA[UK]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[WebFiling]]></category>
            <category><![CDATA[data exposure]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:08:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MacSync Stealer Spreads via Fake AI Tool Installers in ClickFix Wave]]></title>
            <description><![CDATA[Three ClickFix campaigns target macOS users with MacSync infostealer disguised as ChatGPT and AI coding tools. Latest variant adds in-memory execution to evade detection.]]></description>
            <link>https://www.probablypwned.com/article/macsync-infostealer-clickfix-ai-tools-fake-chatgpt</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/macsync-infostealer-clickfix-ai-tools-fake-chatgpt</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[MacSync]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[malvertising]]></category>
            <category><![CDATA[AI tools]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:07:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Konni APT Hijacks KakaoTalk to Spread EndRAT Across Contacts]]></title>
            <description><![CDATA[North Korean threat group Konni weaponizes KakaoTalk messaging app after compromising victims via spear-phishing. EndRAT, RftRAT deployed in multi-stage campaign.]]></description>
            <link>https://www.probablypwned.com/article/konni-apt-kakaotalk-endrat-north-korea-spear-phishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/konni-apt-kakaotalk-endrat-north-korea-spear-phishing</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Konni]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[KakaoTalk]]></category>
            <category><![CDATA[EndRAT]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[spear-phishing]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:06:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Wing FTP Server RCE Flaw Still Exploited Eight Months After Patch]]></title>
            <description><![CDATA[CISA renews warnings about CVE-2025-47812, a CVSS 10.0 vulnerability in Wing FTP Server that grants attackers root/SYSTEM access. Over 8,000 servers remain exposed.]]></description>
            <link>https://www.probablypwned.com/article/wing-ftp-server-cve-2025-47812-cisa-kev-10000-servers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wing-ftp-server-cve-2025-47812-cisa-kev-10000-servers</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Wing FTP]]></category>
            <category><![CDATA[CVE-2025-47812]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[file transfer]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Claims 400 Companies Breached via Salesforce Aura Flaw]]></title>
            <description><![CDATA[Threat group ShinyHunters exploits misconfigured Salesforce Experience Cloud sites, stealing data from 100+ organizations including 921K records from Aura.com.]]></description>
            <link>https://www.probablypwned.com/article/shinyhunters-salesforce-aura-breach-921k-records-400-companies</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shinyhunters-salesforce-aura-breach-921k-records-400-companies</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Salesforce]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Aura.com]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 12:08:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[250+ WordPress Sites Compromised to Deliver Infostealers via ClickFix]]></title>
            <description><![CDATA[Global campaign hijacks WordPress sites in 12 countries to serve fake Cloudflare CAPTCHAs that deploy Vidar, VodkaStealer, and other credential theft malware.]]></description>
            <link>https://www.probablypwned.com/article/wordpress-clickfix-campaign-250-sites-vidar-vodka-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wordpress-clickfix-campaign-250-sites-vidar-vodka-stealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[VodkaStealer]]></category>
            <category><![CDATA[web compromise]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 12:07:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AuraStealer Spreads via TikTok ClickFix Scams, Targets 110+ Browsers]]></title>
            <description><![CDATA[Russian-linked AuraStealer infostealer uses TikTok videos and 48 C2 domains to steal credentials. ABE bypass defeats Chrome's cookie encryption.]]></description>
            <link>https://www.probablypwned.com/article/aurastealer-infostealer-tiktok-clickfix-48-c2-domains</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aurastealer-infostealer-tiktok-clickfix-48-c2-domains</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AuraStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[TikTok]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 12:07:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[HPE AOS-CX Switches Vulnerable to Admin Password Reset (CVSS 9.8)]]></title>
            <description><![CDATA[CVE-2026-23813 allows unauthenticated attackers to reset admin passwords on HPE Aruba AOS-CX switches. No exploitation seen yet, but patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/hpe-aruba-aos-cx-cve-2026-23813-admin-password-reset</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hpe-aruba-aos-cx-cve-2026-23813-admin-password-reset</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[HPE]]></category>
            <category><![CDATA[Aruba]]></category>
            <category><![CDATA[CVE-2026-23813]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 12:06:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Betterleaks: Gitleaks Creator Launches Faster Secrets Scanner]]></title>
            <description><![CDATA[Zach Rice, creator of Gitleaks, releases Betterleaks with BPE tokenization achieving 98.6% recall vs entropy's 70.4%. Drop-in replacement now available.]]></description>
            <link>https://www.probablypwned.com/article/betterleaks-gitleaks-secrets-scanner-zach-rice-aikido</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/betterleaks-gitleaks-secrets-scanner-zach-rice-aikido</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[secrets-scanning]]></category>
            <category><![CDATA[open-source]]></category>
            <category><![CDATA[gitleaks]]></category>
            <category><![CDATA[betterleaks]]></category>
            <category><![CDATA[devsecops]]></category>
            <dc:creator><![CDATA[David Okonkwo]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese APT Targets Qatar Within Hours of Middle East Escalation]]></title>
            <description><![CDATA[Camaro Dragon weaponized missile strike lure documents to deploy PlugX backdoor against Qatari targets, exploiting Operation Epic Fury tensions for access.]]></description>
            <link>https://www.probablypwned.com/article/china-nexus-plugx-qatar-middle-east-conflict-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/china-nexus-plugx-qatar-middle-east-conflict-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Camaro Dragon]]></category>
            <category><![CDATA[PlugX]]></category>
            <category><![CDATA[Qatar]]></category>
            <category><![CDATA[Middle East]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:06:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT37 Deploys Five New Tools to Breach Air-Gapped Networks]]></title>
            <description><![CDATA[North Korean APT37's Ruby Jumper campaign uses RESTLEAF, THUMBSBD, and FOOTWINE malware to exfiltrate data from isolated systems via USB drives.]]></description>
            <link>https://www.probablypwned.com/article/apt37-ruby-jumper-air-gapped-systems-restleaf-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt37-ruby-jumper-air-gapped-systems-restleaf-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT37]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[air-gapped networks]]></category>
            <category><![CDATA[RESTLEAF]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:05:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korean Hackers Pose as Recruiters to Backdoor Developers]]></title>
            <description><![CDATA[Contagious Interview campaign weaponizes fake job interviews to deploy OtterCookie and FlexibleFerret malware. Targets crypto and AI developers for credentials.]]></description>
            <link>https://www.probablypwned.com/article/contagious-interview-north-korea-developer-job-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/contagious-interview-north-korea-developer-job-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[Contagious Interview]]></category>
            <category><![CDATA[developer security]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:04:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[A0Backdoor Hits Finance and Healthcare via Teams Impersonation]]></title>
            <description><![CDATA[Storm-1811 actors flood inboxes with spam, then call via Microsoft Teams posing as IT support. Quick Assist grants access for A0Backdoor deployment.]]></description>
            <link>https://www.probablypwned.com/article/a0backdoor-microsoft-teams-phishing-finance-healthcare</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/a0backdoor-microsoft-teams-phishing-finance-healthcare</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[A0Backdoor]]></category>
            <category><![CDATA[Microsoft Teams]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[Storm-1811]]></category>
            <category><![CDATA[finance]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GlassWorm Escalates: 72 Malicious VSCode Extensions Steal Credentials]]></title>
            <description><![CDATA[GlassWorm supply chain attack spreads via 72 Open VSX extensions using invisible Unicode obfuscation. Targets crypto wallets, API tokens, and CI/CD pipelines.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-vscode-extensions-72-malicious-supply-chain-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-vscode-extensions-72-malicious-supply-chain-attack</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[VSCode]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[developer security]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:03:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AppsFlyer SDK Hijacked to Steal Crypto via Supply Chain Attack]]></title>
            <description><![CDATA[Attackers compromised AppsFlyer's domain registrar to inject crypto-stealing JavaScript into their Web SDK. The malware swaps wallet addresses for Bitcoin, Ethereum, Solana, and more.]]></description>
            <link>https://www.probablypwned.com/article/appsflyer-sdk-supply-chain-crypto-clipper-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/appsflyer-sdk-supply-chain-crypto-clipper-attack</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AppsFlyer]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[clipper malware]]></category>
            <category><![CDATA[JavaScript]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Starbucks Breach Exposes SSNs of 889 Employees via Phishing]]></title>
            <description><![CDATA[Attackers compromised 889 Starbucks Partner Central accounts using fake login portals, exposing employee names, Social Security numbers, and bank details.]]></description>
            <link>https://www.probablypwned.com/article/starbucks-partner-central-breach-889-employees-ssn-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/starbucks-partner-central-breach-889-employees-ssn-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Starbucks]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[employee data]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:07:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Storm-2561 Spreads Trojanized VPN Clients via SEO Poisoning]]></title>
            <description><![CDATA[Microsoft exposes Storm-2561 campaign using SEO manipulation to distribute fake Cisco, Fortinet, and Ivanti VPN clients that steal enterprise credentials.]]></description>
            <link>https://www.probablypwned.com/article/storm-2561-fake-vpn-clients-seo-poisoning-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/storm-2561-fake-vpn-clients-seo-poisoning-credential-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Storm-2561]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:06:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[INTERPOL Operation Synergia III: 94 Arrests, 45K IPs Taken Down]]></title>
            <description><![CDATA[Global law enforcement operation spanning 72 countries arrests 94 cybercriminals and dismantles 45,000 malicious IPs tied to phishing, ransomware, and fraud networks.]]></description>
            <link>https://www.probablypwned.com/article/interpol-operation-synergia-iii-94-arrests-45000-ips-takedown</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/interpol-operation-synergia-iii-94-arrests-45000-ips-takedown</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[INTERPOL]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[cybercrime]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[takedown]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:05:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrackArmor: 9 AppArmor Flaws Expose 12.6M Linux Servers to Root]]></title>
            <description><![CDATA[Qualys discloses nine confused deputy vulnerabilities in Linux AppArmor that enable local privilege escalation to root. Ubuntu, Debian, and SUSE affected since 2017.]]></description>
            <link>https://www.probablypwned.com/article/crackarmor-apparmor-nine-flaws-12-million-linux-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crackarmor-apparmor-nine-flaws-12-million-linux-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[AppArmor]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Qualys]]></category>
            <category><![CDATA[kernel]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:04:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Zero-Days CVE-2026-3909, CVE-2026-3910 Hit CISA KEV]]></title>
            <description><![CDATA[Google patches two actively exploited Chrome zero-days affecting Skia graphics and V8 JavaScript engine. CISA adds both to KEV catalog with March 27 deadline.]]></description>
            <link>https://www.probablypwned.com/article/chrome-zero-days-cve-2026-3909-3910-skia-v8-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-zero-days-cve-2026-3909-3910-skia-v8-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[V8]]></category>
            <category><![CDATA[Skia]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:03:39 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI-Generated Slopoly Backdoor Powers Interlock Ransomware Attacks]]></title>
            <description><![CDATA[IBM X-Force discovers Hive0163 using LLM-generated Slopoly malware in Interlock ransomware attacks, marking a shift in how threat actors weaponize AI to accelerate malware development.]]></description>
            <link>https://www.probablypwned.com/article/slopoly-ai-generated-malware-interlock-ransomware-hive0163</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/slopoly-ai-generated-malware-interlock-ransomware-hive0163</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[AI-generated malware]]></category>
            <category><![CDATA[Interlock]]></category>
            <category><![CDATA[Hive0163]]></category>
            <category><![CDATA[ClickFix]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Salt Typhoon Affiliate Hits Telecoms in 30+ Countries With TernDoor]]></title>
            <description><![CDATA[China-linked UAT-9244 deploys TernDoor backdoor and peer-to-peer implants against telecom infrastructure across South America, North America, and Europe.]]></description>
            <link>https://www.probablypwned.com/article/uat-9244-salt-typhoon-terndoor-telecom-30-countries</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-9244-salt-typhoon-terndoor-telecom-30-countries</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Salt Typhoon]]></category>
            <category><![CDATA[UAT-9244]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[telecom]]></category>
            <category><![CDATA[TernDoor]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 12:06:53 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BeatBanker Malware Drains Brazilian Phones for Crypto and Creds]]></title>
            <description><![CDATA[New Android trojan BeatBanker mines Monero while stealing banking credentials. Spreads via fake Starlink and government apps in Brazil.]]></description>
            <link>https://www.probablypwned.com/article/beatbanker-android-malware-brazil-crypto-mining-banking</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/beatbanker-android-malware-brazil-crypto-mining-banking</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[BeatBanker]]></category>
            <category><![CDATA[Android malware]]></category>
            <category><![CDATA[cryptocurrency mining]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[Brazil]]></category>
            <category><![CDATA[BTMOB]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 12:06:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MicroStealer Evades Detection With Electron-to-Java Payload Chain]]></title>
            <description><![CDATA[New infostealer MicroStealer uses NSIS, Electron, and Java in a layered delivery chain that bypasses most security tools. Targets browser credentials and crypto wallets.]]></description>
            <link>https://www.probablypwned.com/article/microstealer-infostealer-electron-java-delivery-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microstealer-infostealer-electron-java-delivery-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[MicroStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Discord]]></category>
            <category><![CDATA[malware analysis]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 12:05:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Membership Plugin Flaw Lets Anyone Become Admin]]></title>
            <description><![CDATA[CVE-2026-1492 in User Registration & Membership plugin enables unauthenticated admin account creation. CVSS 9.8—over 100,000 sites at risk.]]></description>
            <link>https://www.probablypwned.com/article/cve-2026-1492-wordpress-membership-plugin-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cve-2026-1492-wordpress-membership-plugin-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-1492]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[plugin vulnerability]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 12:04:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Veeam Patches Five Critical RCE Flaws in Backup & Replication]]></title>
            <description><![CDATA[Veeam releases emergency patches for five critical RCE vulnerabilities (CVSS 9.9) affecting Backup & Replication. Domain users can fully compromise backup servers.]]></description>
            <link>https://www.probablypwned.com/article/veeam-critical-rce-vulnerabilities-cvss-9-9-backup-servers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/veeam-critical-rce-vulnerabilities-cvss-9-9-backup-servers</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Veeam]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[backup security]]></category>
            <category><![CDATA[CVE-2026-21666]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 12 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Handala Wipes 200,000 Stryker Devices Using Microsoft Intune]]></title>
            <description><![CDATA[Iranian-linked hacktivists claim devastating attack on medical device maker Stryker, weaponizing Intune's remote wipe capability to erase systems in 79 countries.]]></description>
            <link>https://www.probablypwned.com/article/stryker-handala-wiper-200000-devices-intune-iran</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stryker-handala-wiper-200000-devices-intune-iran</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Handala]]></category>
            <category><![CDATA[Stryker]]></category>
            <category><![CDATA[wiper malware]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[Microsoft Intune]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 12 Mar 2026 12:06:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Deploys Dindoor Backdoor Against US Bank, Airport]]></title>
            <description><![CDATA[Iranian APT group breaches US critical infrastructure using novel Dindoor malware built on Deno runtime. Symantec links campaign to MOIS.]]></description>
            <link>https://www.probablypwned.com/article/muddywater-dindoor-backdoor-us-bank-airport-mois</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/muddywater-dindoor-backdoor-us-bank-airport-mois</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[Dindoor]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 12 Mar 2026 12:05:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds n8n RCE Flaw to KEV as 24,700 Instances Sit Exposed]]></title>
            <description><![CDATA[CVE-2025-68613 allows authenticated attackers to execute arbitrary code on n8n workflow servers. CISA gives federal agencies until March 25 to patch.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-n8n-cve-2025-68613-expression-injection-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-n8n-cve-2025-68613-expression-injection-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2025-68613]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 12 Mar 2026 12:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FIN6 Targets Recruiters with Resume-Themed Malware and EDR Killer]]></title>
            <description><![CDATA[Year-long campaign delivers BlackSanta EDR killer through fake job applications. Malware disables endpoint security before deploying final payloads.]]></description>
            <link>https://www.probablypwned.com/article/fin6-hr-recruiter-malware-blacksanta-edr-killer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fin6-hr-recruiter-malware-blacksanta-edr-killer</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FIN6]]></category>
            <category><![CDATA[BlackSanta]]></category>
            <category><![CDATA[EDR killer]]></category>
            <category><![CDATA[HR phishing]]></category>
            <category><![CDATA[resume malware]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:35:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Five Malicious Rust Crates Posed as Time Utilities to Steal .env Files]]></title>
            <description><![CDATA[Researchers discovered five packages on crates.io masquerading as time utilities while exfiltrating developer credentials and API keys to attacker infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/malicious-rust-crates-time-utilities-env-file-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/malicious-rust-crates-time-utilities-env-file-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Rust]]></category>
            <category><![CDATA[crates.io]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[developer security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:28:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[KadNap Malware Hijacks 14,000 Routers for Underground Proxy Network]]></title>
            <description><![CDATA[New KadNap botnet targets Asus routers using peer-to-peer Kademlia protocol for stealth C2. Over 60% of infections in the US, linked to Faceless proxy service.]]></description>
            <link>https://www.probablypwned.com/article/kadnap-malware-14000-asus-routers-proxy-botnet</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kadnap-malware-14000-asus-routers-proxy-botnet</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[KadNap]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[Asus]]></category>
            <category><![CDATA[router malware]]></category>
            <category><![CDATA[proxy network]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:20:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ivanti EPM Auth Bypass Now Under Active Exploitation, CISA Warns]]></title>
            <description><![CDATA[CVE-2026-1603 allows unauthenticated attackers to steal credential vaults from Ivanti Endpoint Manager. CISA added it to KEV catalog after exploitation detected.]]></description>
            <link>https://www.probablypwned.com/article/ivanti-epm-cve-2026-1603-auth-bypass-cisa-kev-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ivanti-epm-cve-2026-1603-auth-bypass-cisa-kev-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CVE-2026-1603]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:12:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches 83 Flaws in March 2026, Two Zero-Days Disclosed]]></title>
            <description><![CDATA[Microsoft's March 2026 Patch Tuesday addresses 83 vulnerabilities including two publicly disclosed zero-days in SQL Server and .NET. Eight flaws rated Critical.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-march-2026-patch-tuesday-83-cves-two-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-march-2026-patch-tuesday-83-cves-two-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-21262]]></category>
            <category><![CDATA[CVE-2026-26127]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:05:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Enables Windows Hotpatch Updates by Default in May]]></title>
            <description><![CDATA[Windows Autopatch will deliver rebootless security updates automatically for eligible devices starting May 2026. IT admins can opt out beginning April 1.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-windows-autopatch-hotpatch-default-may-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-windows-autopatch-hotpatch-default-may-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Windows 11]]></category>
            <category><![CDATA[Autopatch]]></category>
            <category><![CDATA[hotpatch]]></category>
            <category><![CDATA[security updates]]></category>
            <category><![CDATA[enterprise]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ericsson US Discloses Breach After Vendor Hack Exposes SSNs]]></title>
            <description><![CDATA[Ericsson's U.S. subsidiary confirms data theft affecting employees and customers after attackers compromised a service provider. SSNs, medical info, and financial details exposed.]]></description>
            <link>https://www.probablypwned.com/article/ericsson-us-vendor-data-breach-ssn-employee-customer-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ericsson-us-vendor-data-breach-ssn-employee-customer-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Ericsson]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[vendor breach]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[third-party risk]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 12:07:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TriZetto Breach Exposes 3.4 Million Healthcare Records]]></title>
            <description><![CDATA[Cognizant subsidiary TriZetto Provider Solutions confirms breach affecting 3.4 million patients. SSNs, Medicare IDs, and health data exposed after attackers went undetected for nearly a year.]]></description>
            <link>https://www.probablypwned.com/article/trizetto-cognizant-data-breach-3-4-million-healthcare-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trizetto-cognizant-data-breach-3-4-million-healthcare-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[TriZetto]]></category>
            <category><![CDATA[Cognizant]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[HIPAA]]></category>
            <category><![CDATA[PHI]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 12:06:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Velvet Tempest Deploys CastleRAT via ClickFix Attacks]]></title>
            <description><![CDATA[Ransomware affiliate Velvet Tempest uses ClickFix social engineering to deploy DonutLoader and CastleRAT in 12-day intrusion linked to Termite ransomware staging.]]></description>
            <link>https://www.probablypwned.com/article/velvet-tempest-clickfix-donutloader-castlerat-termite-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/velvet-tempest-clickfix-donutloader-castlerat-termite-ransomware</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Velvet Tempest]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[CastleRAT]]></category>
            <category><![CDATA[DonutLoader]]></category>
            <category><![CDATA[Termite]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 12:06:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Uses BEARDSHELL and COVENANT to Spy on Ukraine]]></title>
            <description><![CDATA[Russian GRU-linked APT28 deploys BEARDSHELL and COVENANT implants for long-term surveillance of Ukrainian military personnel. ESET research reveals cloud storage abuse for C2.]]></description>
            <link>https://www.probablypwned.com/article/apt28-beardshell-covenant-ukraine-military-surveillance</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-beardshell-covenant-ukraine-military-surveillance</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[BEARDSHELL]]></category>
            <category><![CDATA[COVENANT]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 12:05:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI Assistants Are Rewriting the Defensive Security Playbook]]></title>
            <description><![CDATA[Autonomous AI agents expand attack surfaces faster than defenders can adapt. The economics make adoption inevitable—here's how security teams are responding.]]></description>
            <link>https://www.probablypwned.com/article/ai-assistants-defensive-security-attack-surface-expansion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-assistants-defensive-security-attack-surface-expansion</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[autonomous agents]]></category>
            <category><![CDATA[SOC automation]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[attack surface]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 16:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Silver Dragon Uses Google Drive as C2 in Government Attacks]]></title>
            <description><![CDATA[APT41-linked threat group deploys GearDoor backdoor via Google Drive for covert command-and-control. Check Point tracks campaigns across Europe and Southeast Asia.]]></description>
            <link>https://www.probablypwned.com/article/silver-dragon-apt41-geardoor-bamboloader-google-drive-c2</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/silver-dragon-apt41-geardoor-bamboloader-google-drive-c2</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Silver Dragon]]></category>
            <category><![CDATA[APT41]]></category>
            <category><![CDATA[GearDoor]]></category>
            <category><![CDATA[BamboLoader]]></category>
            <category><![CDATA[China]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 12:08:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VOID#GEIST Delivers XWorm and AsyncRAT via Fileless Injection]]></title>
            <description><![CDATA[Multi-stage malware campaign uses Python loaders and Early Bird APC injection to deploy encrypted RATs. TryCloudflare tunnels mask C2 infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/void-geist-malware-xworm-asyncrat-xenorat-fileless-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/void-geist-malware-xworm-asyncrat-xenorat-fileless-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VOID#GEIST]]></category>
            <category><![CDATA[XWorm]]></category>
            <category><![CDATA[AsyncRAT]]></category>
            <category><![CDATA[Xeno RAT]]></category>
            <category><![CDATA[fileless malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 12:06:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Atop EHG2408 Industrial Switch RCE Hits CVSS 9.3]]></title>
            <description><![CDATA[CVE-2026-3823 allows unauthenticated attackers to execute code on Atop Technologies industrial switches. Firmware 3.36 patches the critical buffer overflow.]]></description>
            <link>https://www.probablypwned.com/article/atop-ehg2408-switch-cve-2026-3823-rce-industrial-networks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/atop-ehg2408-switch-cve-2026-3823-rce-industrial-networks</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Atop Technologies]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[CVE-2026-3823]]></category>
            <category><![CDATA[industrial switch]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 12:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Delta Electronics COMMGR2 Flaws Score CVSS 9.8]]></title>
            <description><![CDATA[Two critical vulnerabilities in Delta Electronics COMMGR2 enable remote code execution without authentication. ICS operators should patch to v2.11.1 immediately.]]></description>
            <link>https://www.probablypwned.com/article/delta-electronics-commgr2-cve-2026-3630-3631-buffer-overflow</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/delta-electronics-commgr2-cve-2026-3630-3631-buffer-overflow</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Delta Electronics]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[CVE-2026-3630]]></category>
            <category><![CDATA[CVE-2026-3631]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 12:04:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[White House Unveils 2026 Cybersecurity Strategy Prioritizing Offense]]></title>
            <description><![CDATA[New National Cybersecurity Strategy emphasizes offensive operations, deregulation, and emerging tech superiority. Six pillars outline federal cyber priorities through 2029.]]></description>
            <link>https://www.probablypwned.com/article/us-national-cybersecurity-strategy-2026-six-pillars-offense</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/us-national-cybersecurity-strategy-2026-six-pillars-offense</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[National Cybersecurity Strategy]]></category>
            <category><![CDATA[US policy]]></category>
            <category><![CDATA[offensive cyber]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[regulation]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Sun, 08 Mar 2026 12:08:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SloppyLemming Espionage Campaign Targets South Asian Governments]]></title>
            <description><![CDATA[India-linked APT deploys BurrowShell backdoor and Rust-based RAT against Pakistan nuclear agencies, Bangladesh banks, and Sri Lankan government. 112 C2 domains identified.]]></description>
            <link>https://www.probablypwned.com/article/sloppylemming-apt-pakistan-bangladesh-burrowshell-rust-rat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sloppylemming-apt-pakistan-bangladesh-burrowshell-rust-rat</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[SloppyLemming]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Pakistan]]></category>
            <category><![CDATA[Bangladesh]]></category>
            <category><![CDATA[BurrowShell]]></category>
            <category><![CDATA[India]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 08 Mar 2026 12:07:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Caddy Server Flaw Lets Users Impersonate Admins]]></title>
            <description><![CDATA[CVE-2026-30851 in Caddy's forward_auth module enables identity injection and privilege escalation. Any valid user can impersonate administrators. Update to 2.11.2.]]></description>
            <link>https://www.probablypwned.com/article/caddy-cve-2026-30851-forward-auth-header-injection-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/caddy-cve-2026-30851-forward-auth-header-injection-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-30851]]></category>
            <category><![CDATA[Caddy]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[header injection]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 08 Mar 2026 12:06:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WeKnora AI Framework Hit with Twin CVSS 9.9 RCE Flaws]]></title>
            <description><![CDATA[Critical command injection and SQL bypass vulnerabilities in Tencent's WeKnora LLM framework allow unauthenticated RCE. Patch to versions 0.2.10 and 0.2.12 now.]]></description>
            <link>https://www.probablypwned.com/article/weknora-cve-2026-30860-30861-ai-framework-rce-cvss-9-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/weknora-cve-2026-30860-30861-ai-framework-rce-cvss-9-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-30860]]></category>
            <category><![CDATA[CVE-2026-30861]]></category>
            <category><![CDATA[WeKnora]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[LLM]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 08 Mar 2026 12:05:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran-Linked Dust Specter APT Deploys AI-Assisted Malware Against Iraq]]></title>
            <description><![CDATA[Zscaler uncovers Dust Specter campaign targeting Iraqi government officials with novel SPLITDROP and GHOSTFORM malware. Evidence suggests AI-assisted development.]]></description>
            <link>https://www.probablypwned.com/article/dust-specter-iran-apt-iraq-splitdrop-ghostform-ai-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dust-specter-iran-apt-iraq-splitdrop-ghostform-ai-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[Iraq]]></category>
            <category><![CDATA[Dust Specter]]></category>
            <category><![CDATA[SPLITDROP]]></category>
            <category><![CDATA[GHOSTFORM]]></category>
            <category><![CDATA[AI malware]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:17:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Flaws CVE-2026-20122 and 20128 Under Active Attack]]></title>
            <description><![CDATA[Cisco confirms active exploitation of two more SD-WAN Manager vulnerabilities. Attackers deploying web shells through arbitrary file overwrite and credential exposure flaws.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20122-20128-web-shell-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20122-20128-web-shell-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <category><![CDATA[CVE-2026-20122]]></category>
            <category><![CDATA[CVE-2026-20128]]></category>
            <category><![CDATA[web shell]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:13:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Investigating Hack of Wiretap Surveillance System]]></title>
            <description><![CDATA[The FBI confirms a sophisticated cyberattack targeted its internal wiretap and FISA warrant management system. Investigation ongoing with CISA and NSA involvement.]]></description>
            <link>https://www.probablypwned.com/article/fbi-surveillance-system-hack-wiretap-fisa-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-surveillance-system-hack-wiretap-fisa-march-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[surveillance]]></category>
            <category><![CDATA[wiretap]]></category>
            <category><![CDATA[FISA]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[government breach]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:08:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Manager Flaws Actively Exploited for Web Shells]]></title>
            <description><![CDATA[Cisco confirmed CVE-2026-20122 and CVE-2026-20128 in Catalyst SD-WAN Manager are under active exploitation, with attackers deploying web shells globally.]]></description>
            <link>https://www.probablypwned.com/article/cisco-catalyst-sd-wan-cve-2026-20122-20128-web-shell-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-catalyst-sd-wan-cve-2026-20122-20128-web-shell-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <category><![CDATA[CVE-2026-20122]]></category>
            <category><![CDATA[CVE-2026-20128]]></category>
            <category><![CDATA[web shell]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Wikipedia Hit by Self-Propagating JavaScript Worm]]></title>
            <description><![CDATA[A dormant JavaScript worm activated during a security review vandalized 4,000 Wikipedia pages in 23 minutes. Here's what happened and why it matters.]]></description>
            <link>https://www.probablypwned.com/article/wikipedia-javascript-worm-4000-pages-wikimedia-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wikipedia-javascript-worm-4000-pages-wikimedia-march-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Wikipedia]]></category>
            <category><![CDATA[JavaScript]]></category>
            <category><![CDATA[worm]]></category>
            <category><![CDATA[Wikimedia]]></category>
            <category><![CDATA[self-propagating malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Wikipedia Hit by Self-Propagating JavaScript Worm]]></title>
            <description><![CDATA[A dormant JavaScript worm activated during a Wikimedia security review modified 4,000 pages and infected 85 user scripts in 23 minutes before containment.]]></description>
            <link>https://www.probablypwned.com/article/wikipedia-javascript-worm-user-script-incident-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wikipedia-javascript-worm-user-script-incident-march-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Wikipedia]]></category>
            <category><![CDATA[JavaScript]]></category>
            <category><![CDATA[worm]]></category>
            <category><![CDATA[Wikimedia]]></category>
            <category><![CDATA[user scripts]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dutch Paint Giant AkzoNobel Hit by Anubis Ransomware]]></title>
            <description><![CDATA[Anubis gang claims 170GB of data including passport scans and client agreements from AkzoNobel's US operations. Company says breach contained.]]></description>
            <link>https://www.probablypwned.com/article/akzonobel-anubis-ransomware-170gb-data-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/akzonobel-anubis-ransomware-170gb-data-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[AkzoNobel]]></category>
            <category><![CDATA[Anubis ransomware]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[manufacturing]]></category>
            <category><![CDATA[RaaS]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 06 Mar 2026 13:06:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Coruna iOS Exploit Kit: 23 Attacks From Spies to Criminals]]></title>
            <description><![CDATA[Government-grade iPhone exploits targeting iOS 13-17.2.1 now wielded by Russian spies and Chinese criminals. Lockdown Mode stops it cold.]]></description>
            <link>https://www.probablypwned.com/article/coruna-ios-exploit-kit-23-exploits-us-government-tools</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/coruna-ios-exploit-kit-23-exploits-us-government-tools</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Coruna]]></category>
            <category><![CDATA[iOS exploits]]></category>
            <category><![CDATA[spyware]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[Apple]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 06 Mar 2026 13:05:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Hikvision and Rockwell CVSS 9.8 Flaws to KEV Catalog]]></title>
            <description><![CDATA[Federal agencies must patch CVE-2017-7921 and CVE-2021-22681 by March 26. Hikvision cameras face active exploitation; Rockwell PLCs at risk.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-hikvision-rockwell-cvss-9-8-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-hikvision-rockwell-cvss-9-8-march-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[Hikvision]]></category>
            <category><![CDATA[Rockwell Automation]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[CVE-2017-7921]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 06 Mar 2026 13:05:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FreeScout Zero-Click RCE Lets Hackers Hijack Servers via Email]]></title>
            <description><![CDATA[CVE-2026-28289 allows unauthenticated attackers to achieve full server compromise by sending a single crafted email. CVSS 10.0—patch to 1.8.207 now.]]></description>
            <link>https://www.probablypwned.com/article/freescout-cve-2026-28289-zero-click-rce-email-cvss-10</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/freescout-cve-2026-28289-zero-click-rce-email-cvss-10</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[FreeScout]]></category>
            <category><![CDATA[CVE-2026-28289]]></category>
            <category><![CDATA[zero-click]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 06 Mar 2026 13:04:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Use Bing AI Search to Distribute GhostSocks Malware]]></title>
            <description><![CDATA[Malicious GitHub repositories exploiting Bing AI search results to distribute infostealers and GhostSocks proxy malware. Fake OpenClaw installers turn victims into residential proxies.]]></description>
            <link>https://www.probablypwned.com/article/bing-ai-ghostsocks-malware-fake-openclaw-github-repos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bing-ai-ghostsocks-malware-fake-openclaw-github-repos</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Bing AI]]></category>
            <category><![CDATA[GhostSocks]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[residential proxy]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 05 Mar 2026 13:07:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[HungerRush POS Extortion: Threat Actor Mass-Mails Restaurant Customers]]></title>
            <description><![CDATA[Attacker leverages infostealer-compromised credentials to extort restaurant POS provider HungerRush, sending threatening emails directly to customers demanding response.]]></description>
            <link>https://www.probablypwned.com/article/hungerrush-pos-extortion-infostealer-restaurant-customers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hungerrush-pos-extortion-infostealer-restaurant-customers</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[HungerRush]]></category>
            <category><![CDATA[POS]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[restaurant]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 05 Mar 2026 13:06:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LastPass Warns of Phishing Campaign Targeting Master Passwords]]></title>
            <description><![CDATA[Active phishing campaign uses spoofed email chains to trick LastPass users into revealing master passwords. Attackers generate thousands of URL variants leading to fake SSO pages.]]></description>
            <link>https://www.probablypwned.com/article/lastpass-phishing-campaign-master-password-theft-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lastpass-phishing-campaign-master-password-theft-march-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[LastPass]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[password manager]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 05 Mar 2026 13:05:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious Laravel Packages on Packagist Deploy Cross-Platform RAT]]></title>
            <description><![CDATA[Supply chain attack targets PHP developers via fake Laravel utilities containing encrypted RAT payload. The malware gains full access to database credentials and API keys.]]></description>
            <link>https://www.probablypwned.com/article/packagist-laravel-rat-supply-chain-attack-nhattuanbl</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/packagist-laravel-rat-supply-chain-attack-nhattuanbl</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[PHP]]></category>
            <category><![CDATA[Laravel]]></category>
            <category><![CDATA[Packagist]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[developer security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 05 Mar 2026 13:05:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco FMC RADIUS Flaw Scores CVSS 10 for Pre-Auth RCE]]></title>
            <description><![CDATA[CVE-2025-20265 in Cisco Secure Firewall Management Center allows unauthenticated attackers to execute commands as root via RADIUS authentication. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/cisco-fmc-cve-2025-20265-radius-rce-cvss-10</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-fmc-cve-2025-20265-radius-rce-cvss-10</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2025-20265]]></category>
            <category><![CDATA[RADIUS]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[firewall management]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 04 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran's Electronic Operations Room Coordinates 60 Hacktivist Groups]]></title>
            <description><![CDATA[Unit 42 threat brief details Iran's cyber response to Operation Epic Fury, with 60+ hacktivist groups claiming 150+ incidents in 72 hours despite severe connectivity loss.]]></description>
            <link>https://www.probablypwned.com/article/iran-electronic-operations-room-unit-42-hacktivist-surge</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-electronic-operations-room-unit-42-hacktivist-surge</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[hacktivism]]></category>
            <category><![CDATA[Unit 42]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[cyber warfare]]></category>
            <category><![CDATA[Middle East]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 04 Mar 2026 13:04:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AuraStealer Expands to 48 C2 Domains Filling Lumma Void]]></title>
            <description><![CDATA[Russian-speaking developers behind AuraStealer infostealer scale infrastructure to 48 command-and-control domains, targeting 110+ browsers and 250+ extensions.]]></description>
            <link>https://www.probablypwned.com/article/aurastealer-infostealer-48-c2-domains-lumma-successor</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aurastealer-infostealer-48-c2-domains-lumma-successor</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AuraStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[C2 infrastructure]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 04 Mar 2026 13:03:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LexisNexis Breach Exposes Government and Law Firm Data]]></title>
            <description><![CDATA[FulcrumSec threat actor exploits React2Shell vulnerability to breach LexisNexis AWS infrastructure, leaking 2GB of customer data including .gov email addresses and federal employee records.]]></description>
            <link>https://www.probablypwned.com/article/lexisnexis-fulcrumsec-react2shell-aws-breach-gov-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lexisnexis-fulcrumsec-react2shell-aws-breach-gov-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[LexisNexis]]></category>
            <category><![CDATA[FulcrumSec]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[CVE-2025-55182]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[AWS]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korean StegaBin Campaign Hides C2 in Pastebin Essays]]></title>
            <description><![CDATA[Security researchers uncover 26 malicious npm packages using steganography to hide command infrastructure in computer science essays. Famous Chollima cluster targets developers with RAT.]]></description>
            <link>https://www.probablypwned.com/article/stegabin-north-korea-npm-pastebin-steganography-rat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stegabin-north-korea-npm-pastebin-steganography-rat</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[Famous Chollima]]></category>
            <category><![CDATA[StegaBin]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 13:04:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Eclipse OpenMQ Ships With Critical Default Admin Credentials]]></title>
            <description><![CDATA[CVE-2026-22886 exposes Eclipse OpenMQ to remote takeover via default admin/admin credentials. CVSS 9.8 critical vulnerability requires immediate attention from Java messaging users.]]></description>
            <link>https://www.probablypwned.com/article/openmq-cve-2026-22886-default-credentials-cvss-9-8</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openmq-cve-2026-22886-default-credentials-cvss-9-8</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenMQ]]></category>
            <category><![CDATA[Eclipse]]></category>
            <category><![CDATA[default credentials]]></category>
            <category><![CDATA[CVE-2026-22886]]></category>
            <category><![CDATA[Java]]></category>
            <category><![CDATA[message queue]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 13:04:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Linked to MSHTML Zero-Day Exploited Before Patch]]></title>
            <description><![CDATA[Security researchers tie Russia's APT28 to CVE-2026-21513 exploitation using malicious LNK files. The MSHTML zero-day was weaponized weeks before Microsoft's February patch.]]></description>
            <link>https://www.probablypwned.com/article/apt28-mshtml-zero-day-cve-2026-21513-russia-attribution</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-mshtml-zero-day-cve-2026-21513-russia-attribution</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[MSHTML]]></category>
            <category><![CDATA[CVE-2026-21513]]></category>
            <category><![CDATA[Fancy Bear]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 13:03:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Android March Patch Fixes Qualcomm Zero-Day Under Attack]]></title>
            <description><![CDATA[Google's March 2026 Android security update patches 129 vulnerabilities including CVE-2026-21385, a Qualcomm graphics flaw affecting 234 chipsets under active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/android-march-2026-qualcomm-zero-day-cve-2026-21385</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/android-march-2026-qualcomm-zero-day-cve-2026-21385</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[Qualcomm]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-21385]]></category>
            <category><![CDATA[mobile security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 13:02:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Two Cybersecurity Pros Face 20 Years for ALPHV Ransomware Role]]></title>
            <description><![CDATA[Ryan Goldberg and Kevin Martin pleaded guilty to deploying ALPHV BlackCat ransomware while working in incident response and negotiation roles. Sentencing set for March 12.]]></description>
            <link>https://www.probablypwned.com/article/alphv-blackcat-cybersecurity-pros-guilty-plea-20-years</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/alphv-blackcat-cybersecurity-pros-guilty-plea-20-years</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[ALPHV]]></category>
            <category><![CDATA[BlackCat]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[insider threat]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[cybercrime]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 02 Mar 2026 13:07:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DDoS Attacks Now a Permanent Threat, Link11 Report Finds]]></title>
            <description><![CDATA[Link11's European Cyber Report 2026 reveals DDoS attacks increased 75% with systems under fire 88% of the year. Follow-up attacks surged 80% as attackers adopt persistence tactics.]]></description>
            <link>https://www.probablypwned.com/article/link11-european-ddos-report-2026-permanent-threat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/link11-european-ddos-report-2026-permanent-threat</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Link11]]></category>
            <category><![CDATA[Europe]]></category>
            <category><![CDATA[cybersecurity report]]></category>
            <category><![CDATA[threat trends]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 02 Mar 2026 13:06:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Disrupts UNC2814 GRIDTIDE Campaign Targeting 53 Orgs]]></title>
            <description><![CDATA[China-linked UNC2814 breached 53 organizations across 42 countries using GRIDTIDE malware that abuses Google Sheets for C2. Google terminates attacker infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/unc2814-gridtide-google-sheets-china-espionage-53-breaches</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unc2814-gridtide-google-sheets-china-espionage-53-breaches</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UNC2814]]></category>
            <category><![CDATA[GRIDTIDE]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Google Sheets]]></category>
            <category><![CDATA[cyberespionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 02 Mar 2026 13:05:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[U-Office Force CVE-2026-3422 Enables Unauthenticated RCE]]></title>
            <description><![CDATA[Critical insecure deserialization vulnerability in U-Office Force allows remote attackers to execute arbitrary code without authentication. CVSS 9.8, no patch available yet.]]></description>
            <link>https://www.probablypwned.com/article/u-office-force-cve-2026-3422-insecure-deserialization-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/u-office-force-cve-2026-3422-insecure-deserialization-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-3422]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[deserialization]]></category>
            <category><![CDATA[U-Office Force]]></category>
            <category><![CDATA[e-Excellence]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 02 Mar 2026 13:04:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Samsung Halts Texas TV Data Collection Without Consent]]></title>
            <description><![CDATA[Texas AG Ken Paxton secures settlement forcing Samsung to stop ACR surveillance of Texans' viewing habits without express consent. Four other TV makers still facing lawsuits.]]></description>
            <link>https://www.probablypwned.com/article/samsung-texas-acr-data-collection-express-consent-settlement</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/samsung-texas-acr-data-collection-express-consent-settlement</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Samsung]]></category>
            <category><![CDATA[privacy]]></category>
            <category><![CDATA[ACR]]></category>
            <category><![CDATA[Texas]]></category>
            <category><![CDATA[smart TV]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA: RESURGE Malware Can Remain Dormant on Ivanti Devices]]></title>
            <description><![CDATA[Updated CISA analysis reveals RESURGE implant uses advanced evasion techniques and can persist undetected on Ivanti Connect Secure devices until remote activation.]]></description>
            <link>https://www.probablypwned.com/article/cisa-resurge-malware-ivanti-dormant-persistence-update</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-resurge-malware-ivanti-dormant-persistence-update</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[RESURGE]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[CVE-2025-0282]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[rootkit]]></category>
            <category><![CDATA[backdoor]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 13:05:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UnsolicitedBooker APT Targets Central Asian Telecoms]]></title>
            <description><![CDATA[China-aligned threat group deploys LuciDoor and MarsSnake backdoors against telecom providers in Kyrgyzstan and Tajikistan, expanding from prior Saudi operations.]]></description>
            <link>https://www.probablypwned.com/article/unsolicitedbooker-china-apt-lucidoor-marssnake-central-asia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unsolicitedbooker-china-apt-lucidoor-marssnake-central-asia</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UnsolicitedBooker]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[LuciDoor]]></category>
            <category><![CDATA[MarsSnake]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[telecommunications]]></category>
            <category><![CDATA[Central Asia]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 13:05:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[wpForo Forum Plugin Hit by Six Critical Vulnerabilities]]></title>
            <description><![CDATA[WordPress plugin wpForo 2.4.14 contains unauthenticated SQL injection, PHP object injection, and multiple authorization bypass flaws. Over 80,000 sites at risk.]]></description>
            <link>https://www.probablypwned.com/article/wpforo-forum-multiple-cves-sqli-rce-wordpress-plugin</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wpforo-forum-multiple-cves-sqli-rce-wordpress-plugin</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[wpForo]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[CVE-2026-28562]]></category>
            <category><![CDATA[CVE-2026-1581]]></category>
            <category><![CDATA[plugin vulnerabilities]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 13:04:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Juniper PTX Routers Vulnerable to Unauthenticated Root RCE]]></title>
            <description><![CDATA[Critical CVE-2026-21902 in Junos OS Evolved allows remote attackers to gain root access on PTX routers via exposed anomaly detection service. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/juniper-ptx-cve-2026-21902-root-rce-anomaly-detection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/juniper-ptx-cve-2026-21902-root-rce-anomaly-detection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Juniper]]></category>
            <category><![CDATA[CVE-2026-21902]]></category>
            <category><![CDATA[PTX routers]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[network infrastructure]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 13:03:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[QuickLens Chrome Extension Steals Crypto via ClickFix]]></title>
            <description><![CDATA[Malicious QuickLens browser add-on combines Google Lens functionality with ClickFix social engineering to drain cryptocurrency wallets through fake CAPTCHA prompts.]]></description>
            <link>https://www.probablypwned.com/article/quicklens-chrome-extension-clickfix-crypto-wallet-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/quicklens-chrome-extension-clickfix-crypto-wallet-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[QuickLens]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Chrome extension]]></category>
            <category><![CDATA[cryptocurrency theft]]></category>
            <category><![CDATA[StealC]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious OpenClaw Skills Trick AI Agents Into Installing macOS Stealer]]></title>
            <description><![CDATA[Trend Micro finds 2,200+ malicious skills weaponizing AI agents to deploy AMOS. The campaign marks a shift from prompt injection to using AI as a trusted intermediary for malware delivery.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-malicious-skills-amos-macos-stealer-ai-agents</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-malicious-skills-amos-macos-stealer-ai-agents</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[AMOS]]></category>
            <category><![CDATA[macOS stealer]]></category>
            <category><![CDATA[AI agent security]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:07:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Aeternum Botnet Uses Polygon Blockchain as Takedown-Proof C2]]></title>
            <description><![CDATA[New botnet loader stores encrypted commands in smart contracts on Polygon, making traditional infrastructure takedowns ineffective. Operating costs are under $1 for 100+ commands.]]></description>
            <link>https://www.probablypwned.com/article/aeternum-c2-botnet-polygon-blockchain-smart-contracts</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aeternum-c2-botnet-polygon-blockchain-smart-contracts</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Aeternum]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[blockchain C2]]></category>
            <category><![CDATA[Polygon]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:06:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1667984390527-850f63192709?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1667984390527-850f63192709?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious NuGet Package Impersonated Stripe to Steal API Tokens]]></title>
            <description><![CDATA[ReversingLabs caught StripeApi.Net typosquatting the official Stripe library. The package processed payments normally while exfiltrating API keys in the background.]]></description>
            <link>https://www.probablypwned.com/article/stripeapi-net-nuget-typosquat-supply-chain-attack-api-tokens</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stripeapi-net-nuget-typosquat-supply-chain-attack-api-tokens</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[NuGet]]></category>
            <category><![CDATA[typosquatting]]></category>
            <category><![CDATA[Stripe]]></category>
            <category><![CDATA[API token theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:05:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WeGIA Charity Management Platform Exposes Three Critical Flaws]]></title>
            <description><![CDATA[CVE-2026-28408 and related vulnerabilities allow unauthenticated attackers to bypass security, inject data, and execute code on WeGIA servers. Patch to version 3.6.5 immediately.]]></description>
            <link>https://www.probablypwned.com/article/wegia-cve-2026-28408-critical-auth-bypass-charitable-institutions</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wegia-cve-2026-28408-critical-auth-bypass-charitable-institutions</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-28408]]></category>
            <category><![CDATA[WeGIA]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <category><![CDATA[nonprofit security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:04:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Centreon Open Tickets Hit by Critical CVSS 9.9 Path Traversal Flaw]]></title>
            <description><![CDATA[CVE-2026-2749 enables unauthenticated attackers to write or delete arbitrary files on Centreon Central Servers. Patches now available for all supported versions.]]></description>
            <link>https://www.probablypwned.com/article/centreon-open-tickets-cve-2026-2749-critical-path-traversal</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/centreon-open-tickets-cve-2026-2749-critical-path-traversal</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-2749]]></category>
            <category><![CDATA[Centreon]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <category><![CDATA[IT monitoring]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT37 Ruby Jumper Campaign Targets Air-Gapped Networks]]></title>
            <description><![CDATA[North Korean APT37 deploys six new malware tools to breach air-gapped systems using USB drives and cloud C2. Zscaler reveals RESTLEAF, THUMBSBD, and FOOTWINE surveillance capabilities.]]></description>
            <link>https://www.probablypwned.com/article/apt37-ruby-jumper-air-gapped-network-usb-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt37-ruby-jumper-air-gapped-network-usb-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT37]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[air-gapped networks]]></category>
            <category><![CDATA[USB malware]]></category>
            <category><![CDATA[state-sponsored]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vikunja Auth Flaw Lets Attackers Maintain Access After Password Reset]]></title>
            <description><![CDATA[CVE-2026-27575 combines weak password enforcement with persistent sessions in Vikunja, enabling attackers to retain access even after victims change credentials.]]></description>
            <link>https://www.probablypwned.com/article/vikunja-cve-2026-27575-weak-password-persistent-sessions</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vikunja-cve-2026-27575-weak-password-persistent-sessions</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-27575]]></category>
            <category><![CDATA[Vikunja]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[session management]]></category>
            <category><![CDATA[open source]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 13:06:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dohdoor Backdoor Targets US Healthcare and Education Sectors]]></title>
            <description><![CDATA[Cisco Talos uncovers UAT-10027 deploying Dohdoor malware against American hospitals and schools. The backdoor uses DNS-over-HTTPS to evade detection.]]></description>
            <link>https://www.probablypwned.com/article/uat-10027-dohdoor-backdoor-us-healthcare-education</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-10027-dohdoor-backdoor-us-healthcare-education</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Dohdoor]]></category>
            <category><![CDATA[UAT-10027]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[DNS-over-HTTPS]]></category>
            <category><![CDATA[backdoor]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 13:05:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CVSS 9.4 Flaw Lets Attackers Hijack EV Charging Stations]]></title>
            <description><![CDATA[CVE-2026-20781 exposes OCPP WebSocket endpoints to unauthenticated station impersonation, enabling attackers to manipulate EV charging infrastructure and steal energy.]]></description>
            <link>https://www.probablypwned.com/article/ocpp-websocket-cve-2026-20781-ev-charging-impersonation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ocpp-websocket-cve-2026-20781-ev-charging-impersonation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-20781]]></category>
            <category><![CDATA[OCPP]]></category>
            <category><![CDATA[EV charging]]></category>
            <category><![CDATA[IoT security]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 13:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Xerox FreeFlow Core RCE Flaw Lets Attackers Hijack Print Servers]]></title>
            <description><![CDATA[CVE-2026-2251 is a CVSS 9.8 path traversal vulnerability in Xerox FreeFlow Core that enables unauthenticated remote code execution. Upgrade to version 8.1.0 now.]]></description>
            <link>https://www.probablypwned.com/article/xerox-freeflow-cve-2026-2251-path-traversal-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/xerox-freeflow-cve-2026-2251-path-traversal-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-2251]]></category>
            <category><![CDATA[Xerox]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[print security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 13:03:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Next.js Job Tests Deploy In-Memory Malware via VS Code]]></title>
            <description><![CDATA[Microsoft uncovers developer-targeting campaign using fake coding assessments to deliver JavaScript backdoors through VS Code automation triggers and Vercel-hosted payloads.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-nextjs-fake-job-interview-malware-vscode-trigger</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-nextjs-fake-job-interview-malware-vscode-trigger</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[developer security]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[Contagious Interview]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 26 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LAPSUS$ Supergroup Paying Women $1,000 Per Vishing Call]]></title>
            <description><![CDATA[Scattered Lapsus$ Hunters offers $500-$1,000 to recruit women for IT help desk social engineering attacks. The supergroup combines LAPSUS$, Scattered Spider, and ShinyHunters tactics.]]></description>
            <link>https://www.probablypwned.com/article/scattered-lapsus-hunters-vishing-women-recruitment-it-helpdesk</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/scattered-lapsus-hunters-vishing-women-recruitment-it-helpdesk</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[LAPSUS$]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[SLH]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 26 Feb 2026 13:08:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Claude Code Flaws Let Malicious Repos Steal API Keys, Run Code]]></title>
            <description><![CDATA[Check Point found CVE-2025-59536 and CVE-2026-21852 in Anthropic's Claude Code. Opening a cloned repo could execute code and leak API credentials.]]></description>
            <link>https://www.probablypwned.com/article/claude-code-rce-api-key-exfiltration-hooks-mcp-check-point</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/claude-code-rce-api-key-exfiltration-hooks-mcp-check-point</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Claude Code]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[CVE-2025-59536]]></category>
            <category><![CDATA[CVE-2026-21852]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 26 Feb 2026 13:06:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenLIT GitHub Actions Flaw Exposes API Keys, Cloud Credentials]]></title>
            <description><![CDATA[CVE-2026-27941 (CVSS 9.9) lets attackers execute code via pull requests to OpenLIT, stealing GITHUB_TOKEN and cloud secrets. Patch to 1.37.1 now.]]></description>
            <link>https://www.probablypwned.com/article/openlit-cve-2026-27941-github-actions-critical-rce-secrets</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openlit-cve-2026-27941-github-actions-critical-rce-secrets</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-27941]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <category><![CDATA[OpenLIT]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[CI/CD security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 26 Feb 2026 13:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Zero-Day Exploited Since 2023 Prompts CISA Alert]]></title>
            <description><![CDATA[CVE-2026-20127 gives attackers full admin access to Cisco SD-WAN infrastructure. CISA emergency directive requires federal patches by Feb 27.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20127-zero-day-uat-8616</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20127-zero-day-uat-8616</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <category><![CDATA[CVE-2026-20127]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[UAT-8616]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Copilot Bug Exposed Confidential Emails for Weeks]]></title>
            <description><![CDATA[Microsoft confirms Copilot bug bypassed DLP policies, reading confidential emails without authorization. European Parliament blocked Copilot over concerns.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-copilot-dlp-bypass-confidential-emails-cw1226324</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-copilot-dlp-bypass-confidential-emails-cw1226324</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Copilot]]></category>
            <category><![CDATA[DLP]]></category>
            <category><![CDATA[data leak]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 13:09:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Matanbuchus 3.0 Loader Delivers AstarionRAT in Hands-On Intrusion]]></title>
            <description><![CDATA[Huntress responds to ClickFix intrusion deploying Matanbuchus 3.0 and custom AstarionRAT. Attackers achieved lateral movement within 40 minutes.]]></description>
            <link>https://www.probablypwned.com/article/matanbuchus-3-astarionrat-clickfix-hands-on-keyboard-intrusion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/matanbuchus-3-astarionrat-clickfix-hands-on-keyboard-intrusion</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Matanbuchus]]></category>
            <category><![CDATA[AstarionRAT]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 13:08:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Anthropic Accuses Chinese AI Labs of Industrial-Scale Model Theft]]></title>
            <description><![CDATA[Anthropic alleges DeepSeek, Moonshot AI, and MiniMax used 24,000 fake accounts to extract Claude capabilities through 16 million distillation queries.]]></description>
            <link>https://www.probablypwned.com/article/anthropic-accuses-deepseek-moonshot-minimax-distillation-16m-queries</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/anthropic-accuses-deepseek-moonshot-minimax-distillation-16m-queries</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[DeepSeek]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[model distillation]]></category>
            <category><![CDATA[China]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 13:06:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds FileZen CVE-2026-25108 to KEV After Active Exploitation]]></title>
            <description><![CDATA[CISA flags FileZen command injection flaw (CVE-2026-25108, CVSS 8.7) as actively exploited. Federal agencies must patch by March 17, 2026.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-filezen-cve-2026-25108-command-injection-soliton</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-filezen-cve-2026-25108-command-injection-soliton</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-25108]]></category>
            <category><![CDATA[FileZen]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[Soliton Systems]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 13:05:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SolarWinds Patches Four Critical Serv-U Flaws With Root Access]]></title>
            <description><![CDATA[Serv-U 15.5.4 fixes four CVSS 9.1 bugs including type confusion and access control flaws. Admin access required, but file transfer platforms remain high-value targets.]]></description>
            <link>https://www.probablypwned.com/article/solarwinds-serv-u-15-5-4-four-critical-rce-vulnerabilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/solarwinds-serv-u-15-5-4-four-critical-rce-vulnerabilities</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[Serv-U]]></category>
            <category><![CDATA[CVE-2025-40538]]></category>
            <category><![CDATA[CVE-2025-40539]]></category>
            <category><![CDATA[file transfer]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 18:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PayPal Breach Exposed SSNs for Six Months Before Detection]]></title>
            <description><![CDATA[A coding error in PayPal Working Capital exposed customer SSNs and business data since July 2025. Unauthorized transactions detected on some affected accounts.]]></description>
            <link>https://www.probablypwned.com/article/paypal-working-capital-breach-ssn-six-months-exposure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/paypal-working-capital-breach-ssn-six-months-exposure</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[PayPal]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[fintech]]></category>
            <category><![CDATA[Working Capital]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 13:06:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chip Testing Giant Advantest Confirms Ransomware Attack]]></title>
            <description><![CDATA[Japanese semiconductor test equipment maker Advantest hit by ransomware on Feb 15. Investigation ongoing as company assesses potential data exposure.]]></description>
            <link>https://www.probablypwned.com/article/advantest-ransomware-semiconductor-testing-february-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/advantest-ransomware-semiconductor-testing-february-2026</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Advantest]]></category>
            <category><![CDATA[semiconductor]]></category>
            <category><![CDATA[Japan]]></category>
            <category><![CDATA[manufacturing]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 13:06:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Weaponize ClawHub Comments to Deliver Infostealers]]></title>
            <description><![CDATA[Threat actors bypass ClawHub security by hiding Base64 payloads in fake troubleshooting comments. Atomic Stealer delivered to unsuspecting OpenClaw users.]]></description>
            <link>https://www.probablypwned.com/article/clawhub-malicious-comments-atomic-stealer-base64-payload</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clawhub-malicious-comments-atomic-stealer-base64-payload</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ClawHub]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[Atomic Stealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[AI agent]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 13:05:49 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Serv-U Type Confusion Bug Enables Privileged Code Execution]]></title>
            <description><![CDATA[CVE-2025-40540 is a critical type confusion vulnerability in SolarWinds Serv-U with CVSS 9.1. Attackers with admin access can execute arbitrary code.]]></description>
            <link>https://www.probablypwned.com/article/serv-u-cve-2025-40540-critical-type-confusion-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/serv-u-cve-2025-40540-critical-type-confusion-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-40540]]></category>
            <category><![CDATA[Serv-U]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[type confusion]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 13:05:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cloudflare's 6-Hour Outage Traced to API Query Bug]]></title>
            <description><![CDATA[Cloudflare's February 20 outage withdrew 25% of BYOIP customer prefixes after API query misinterpretation. 1,100 prefixes went offline for over six hours.]]></description>
            <link>https://www.probablypwned.com/article/cloudflare-byoip-outage-six-hours-api-bug-february-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cloudflare-byoip-outage-six-hours-api-bug-february-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cloudflare]]></category>
            <category><![CDATA[outage]]></category>
            <category><![CDATA[BYOIP]]></category>
            <category><![CDATA[BGP]]></category>
            <category><![CDATA[infrastructure]]></category>
            <category><![CDATA[incident response]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 23 Feb 2026 13:05:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Demands $1.5M From Wynn Resorts Over Stolen Data]]></title>
            <description><![CDATA[ShinyHunters claims 800,000+ Wynn Resorts employee records including SSNs, salaries, and personal details. Group demands 22 Bitcoin by February 23, exploited Oracle PeopleSoft.]]></description>
            <link>https://www.probablypwned.com/article/shinyhunters-wynn-resorts-800k-employee-records-oracle-peoplesoft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shinyhunters-wynn-resorts-800k-employee-records-oracle-peoplesoft</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Wynn Resorts]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Oracle PeopleSoft]]></category>
            <category><![CDATA[employee data]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 23 Feb 2026 13:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Australian Court Files Exposed via Third-Party Offshoring Breach]]></title>
            <description><![CDATA[VIQ Solutions confirms sensitive Australian court data including domestic violence and national security cases accessed by unauthorized Indian subcontractor e24 Technologies.]]></description>
            <link>https://www.probablypwned.com/article/viq-solutions-australian-court-data-breach-e24-technologies</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/viq-solutions-australian-court-data-breach-e24-technologies</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Australia]]></category>
            <category><![CDATA[VIQ Solutions]]></category>
            <category><![CDATA[court records]]></category>
            <category><![CDATA[third-party risk]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 23 Feb 2026 13:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Deploys GhostFetch and Telegram-Based Backdoors]]></title>
            <description><![CDATA[Iranian APT MuddyWater launches Operation Olalampo against MENA organizations, deploying four new malware families including GhostFetch and CHAR, a Rust backdoor controlled via Telegram.]]></description>
            <link>https://www.probablypwned.com/article/muddywater-operation-olalampo-ghostfetch-mena-telegram</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/muddywater-operation-olalampo-ghostfetch-mena-telegram</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[GhostFetch]]></category>
            <category><![CDATA[Telegram malware]]></category>
            <category><![CDATA[MENA]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 23 Feb 2026 13:03:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Arkanix Stealer: AI-Assisted MaaS Infostealer Folds Fast]]></title>
            <description><![CDATA[Kaspersky exposes Arkanix Stealer, a Python and C++ infostealer likely built with LLM assistance. After two months of targeting crypto wallets and VPNs, the operation vanished.]]></description>
            <link>https://www.probablypwned.com/article/arkanix-stealer-ai-assisted-maas-infostealer-shutdown</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/arkanix-stealer-ai-assisted-maas-infostealer-shutdown</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[AI-generated malware]]></category>
            <category><![CDATA[MaaS]]></category>
            <category><![CDATA[cryptocurrency theft]]></category>
            <category><![CDATA[Kaspersky]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[France's National Bank Database Breached, 1.2M Accounts Exposed]]></title>
            <description><![CDATA[Attacker impersonating civil servant accessed French FICOBA registry containing 300M+ bank account records. 1.2 million accounts compromised in late January attack.]]></description>
            <link>https://www.probablypwned.com/article/france-ficoba-bank-database-breach-1-2-million-accounts</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/france-ficoba-bank-database-breach-1-2-million-accounts</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[France]]></category>
            <category><![CDATA[FICOBA]]></category>
            <category><![CDATA[government breach]]></category>
            <category><![CDATA[banking data]]></category>
            <category><![CDATA[identity theft]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 13:07:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Massiv Android Trojan Spreads via Fake IPTV Apps]]></title>
            <description><![CDATA[Banking trojan disguised as IPTV streaming apps targets users in Portugal and Greece, enabling device takeover and credential theft through overlay attacks.]]></description>
            <link>https://www.probablypwned.com/article/massiv-android-trojan-iptv-apps-banking-fraud</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/massiv-android-trojan-iptv-apps-banking-fraud</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Android malware]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[IPTV]]></category>
            <category><![CDATA[Massiv]]></category>
            <category><![CDATA[mobile security]]></category>
            <category><![CDATA[overlay attacks]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 13:06:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CRESCENTHARVEST RAT Targets Iranian Protest Supporters]]></title>
            <description><![CDATA[New espionage campaign uses protest-themed lures and Chrome DLL side-loading to deploy RAT malware against Iranian diaspora, activists, and journalists.]]></description>
            <link>https://www.probablypwned.com/article/crescentharvest-iran-protest-espionage-chrome-dll-sideload</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crescentharvest-iran-protest-espionage-chrome-dll-sideload</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <category><![CDATA[CRESCENTHARVEST]]></category>
            <category><![CDATA[Chrome abuse]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 13:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI-Assisted Attacker Compromises 600+ FortiGate Firewalls]]></title>
            <description><![CDATA[Amazon threat intelligence exposes Russian-speaking actor using generative AI to breach 600+ FortiGate devices across 55 countries. Attack used ARXON tool with DeepSeek and Claude.]]></description>
            <link>https://www.probablypwned.com/article/ai-assisted-threat-actor-fortigate-600-devices-arxon</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-assisted-threat-actor-fortigate-600-devices-arxon</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FortiGate]]></category>
            <category><![CDATA[AI attacks]]></category>
            <category><![CDATA[credential stuffing]]></category>
            <category><![CDATA[ARXON]]></category>
            <category><![CDATA[Amazon threat intel]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 13:04:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mississippi's Largest Hospital System Closes All Clinics After Ransomware Attack]]></title>
            <description><![CDATA[University of Mississippi Medical Center shuts 35 clinics statewide after ransomware attack disables Epic EHR access. FBI investigating as doctors resort to pen and paper for patient care.]]></description>
            <link>https://www.probablypwned.com/article/ummc-mississippi-ransomware-attack-clinics-closed-fbi</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ummc-mississippi-ransomware-attack-clinics-closed-fbi</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[UMMC]]></category>
            <category><![CDATA[Mississippi]]></category>
            <category><![CDATA[FBI]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 21 Feb 2026 13:06:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PromptSpy: First Android Malware Using Gemini AI at Runtime]]></title>
            <description><![CDATA[ESET discovers PromptSpy, the first Android malware weaponizing Google's Gemini AI to maintain persistence by analyzing UI and generating real-time tap instructions to stay pinned in recent apps.]]></description>
            <link>https://www.probablypwned.com/article/promptspy-android-malware-gemini-ai-persistence</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/promptspy-android-malware-gemini-ai-persistence</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[Gemini]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[PromptSpy]]></category>
            <category><![CDATA[ESET]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 21 Feb 2026 13:05:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ClickFix Campaign Deploys MIMICRAT Through Compromised BIN Sites]]></title>
            <description><![CDATA[Elastic Security Labs uncovers ClickFix campaign abusing compromised bincheck.io to deliver MIMICRAT, a custom C++ RAT with SOCKS5 tunneling and token impersonation capabilities.]]></description>
            <link>https://www.probablypwned.com/article/clickfix-mimicrat-compromised-sites-elastic-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clickfix-mimicrat-compromised-sites-elastic-security</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[MIMICRAT]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 21 Feb 2026 13:04:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Two Roundcube Flaws to KEV After Active Exploitation]]></title>
            <description><![CDATA[CISA adds CVE-2025-49113 (CVSS 9.9) and CVE-2025-68461 to KEV catalog after attackers weaponized the deserialization flaw within 48 hours. Federal agencies must patch by March 13.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-roundcube-cve-2025-49113-cve-2025-68461-actively-exploited</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-roundcube-cve-2025-49113-cve-2025-68461-actively-exploited</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[Roundcube]]></category>
            <category><![CDATA[CVE-2025-49113]]></category>
            <category><![CDATA[webmail]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 21 Feb 2026 13:03:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hacking AI Platform WormGPT Breached, 19,000 Users Exposed]]></title>
            <description><![CDATA[WormGPT database allegedly leaked on dark web forums, exposing emails, payment data, and subscription details of cybercriminals using the service.]]></description>
            <link>https://www.probablypwned.com/article/wormgpt-data-breach-19000-users-exposed-dark-web</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wormgpt-data-breach-19000-users-exposed-dark-web</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[WormGPT]]></category>
            <category><![CDATA[Data Breach]]></category>
            <category><![CDATA[Dark Web]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[Cybercrime]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 20 Feb 2026 13:07:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Unit 42 Tracks SparkRAT, VShell in BeyondTrust Attacks]]></title>
            <description><![CDATA[Attackers exploiting CVE-2026-1731 deploy cross-platform backdoors across finance, healthcare, and tech. Over 10,600 instances remain exposed.]]></description>
            <link>https://www.probablypwned.com/article/beyondtrust-sparkrat-vshell-unit42-exploitation-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/beyondtrust-sparkrat-vshell-unit42-exploitation-campaign</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[BeyondTrust]]></category>
            <category><![CDATA[SparkRAT]]></category>
            <category><![CDATA[VShell]]></category>
            <category><![CDATA[Unit 42]]></category>
            <category><![CDATA[CVE-2026-1731]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 20 Feb 2026 13:07:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Windows Admin Center Flaw Enables Full Domain Takeover]]></title>
            <description><![CDATA[CVE-2026-26119 lets attackers escalate from standard user to domain admin via improper authentication. Microsoft rates exploitation 'more likely.']]></description>
            <link>https://www.probablypwned.com/article/windows-admin-center-cve-2026-26119-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/windows-admin-center-cve-2026-26119-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Windows Admin Center]]></category>
            <category><![CDATA[CVE-2026-26119]]></category>
            <category><![CDATA[Privilege Escalation]]></category>
            <category><![CDATA[Active Directory]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 20 Feb 2026 13:06:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Semantic Kernel RCE Flaw Scores Perfect 10.0 CVSS]]></title>
            <description><![CDATA[CVE-2026-26030 in Microsoft's Semantic Kernel Python SDK enables unauthenticated RCE through InMemoryVectorStore. Upgrade to 1.39.4 immediately.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-semantic-kernel-cve-2026-26030-critical-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-semantic-kernel-cve-2026-26030-critical-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Semantic Kernel]]></category>
            <category><![CDATA[CVE-2026-26030]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[Python]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 20 Feb 2026 13:05:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Feds to Patch Dell Flaw Within 3 Days]]></title>
            <description><![CDATA[Federal agencies must patch CVE-2026-22769 by Saturday after CISA confirms Chinese hackers exploited the Dell RecoverPoint vulnerability since 2024.]]></description>
            <link>https://www.probablypwned.com/article/cisa-dell-recoverpoint-cve-2026-22769-3-day-patch-deadline</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-dell-recoverpoint-cve-2026-22769-3-day-patch-deadline</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Dell]]></category>
            <category><![CDATA[CVE-2026-22769]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[patch management]]></category>
            <category><![CDATA[federal agencies]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 19:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Secure AI Factory with NVIDIA: Partner Revenue at Scale]]></title>
            <description><![CDATA[Cisco 360 Partner Program offers new AI specializations and certifications tied to NVIDIA partnership, with $267B in projected partner-delivered AI services by 2030.]]></description>
            <link>https://www.probablypwned.com/article/cisco-secure-ai-factory-nvidia-partner-opportunity-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-secure-ai-factory-nvidia-partner-opportunity-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[NVIDIA]]></category>
            <category><![CDATA[AI infrastructure]]></category>
            <category><![CDATA[partner program]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco AI Security Report: 83% Want Agents, 29% Ready]]></title>
            <description><![CDATA[Cisco's State of AI Security 2026 report reveals a dangerous gap between agentic AI adoption ambitions and enterprise security readiness. Here's what the threat landscape looks like.]]></description>
            <link>https://www.probablypwned.com/article/cisco-state-of-ai-security-2026-report-threat-landscape</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-state-of-ai-security-2026-report-threat-landscape</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[agentic AI]]></category>
            <category><![CDATA[shadow AI]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[MCP]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Inside DynoWiper: Mersenne Twister PRNG and File Destruction]]></title>
            <description><![CDATA[SANS ISC analyzes DynoWiper's internals revealing Mersenne Twister seeding, 16-byte overwrite buffers, and directory exclusions. Technical breakdown of Sandworm's latest wiper.]]></description>
            <link>https://www.probablypwned.com/article/dynowiper-technical-analysis-mersenne-twister-sandworm</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dynowiper-technical-analysis-mersenne-twister-sandworm</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[DynoWiper]]></category>
            <category><![CDATA[Sandworm]]></category>
            <category><![CDATA[wiper malware]]></category>
            <category><![CDATA[malware analysis]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DDoS Attacks Surge 168% as NoName057 Sets Attack Record]]></title>
            <description><![CDATA[Radware's 2026 threat report reveals network-layer DDoS attacks jumped 168% year-over-year. NoName057 claimed 4,693 attacks, setting a new hacktivist record.]]></description>
            <link>https://www.probablypwned.com/article/radware-ddos-report-2026-168-percent-increase-noname057</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/radware-ddos-report-2026-168-percent-increase-noname057</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Radware]]></category>
            <category><![CDATA[NoName057]]></category>
            <category><![CDATA[Threat Report]]></category>
            <category><![CDATA[Hacktivism]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 13:06:04 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ClickFix Attacks Now Abuse DNS to Evade Security Tools]]></title>
            <description><![CDATA[Microsoft warns of ClickFix variant using nslookup commands to stage malware via DNS traffic. Delivers ModeloRAT through fileless attack chain.]]></description>
            <link>https://www.probablypwned.com/article/clickfix-dns-nslookup-modelorat-microsoft-disclosure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clickfix-dns-nslookup-modelorat-microsoft-disclosure</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[ModeloRAT]]></category>
            <category><![CDATA[DNS Abuse]]></category>
            <category><![CDATA[Social Engineering]]></category>
            <category><![CDATA[Malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 13:05:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Grandstream VoIP Phones Vulnerable to Silent Eavesdropping]]></title>
            <description><![CDATA[CVE-2026-2329 (CVSS 9.3) enables unauthenticated RCE on Grandstream GXP1600 VoIP phones. Attackers can intercept calls, steal credentials. Patch to 1.0.7.81.]]></description>
            <link>https://www.probablypwned.com/article/grandstream-voip-cve-2026-2329-critical-rce-eavesdropping</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/grandstream-voip-cve-2026-2329-critical-rce-eavesdropping</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-2329]]></category>
            <category><![CDATA[VoIP]]></category>
            <category><![CDATA[Grandstream]]></category>
            <category><![CDATA[Buffer Overflow]]></category>
            <category><![CDATA[IoT Security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 13:04:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CleanTalk WordPress Plugin Flaw Exposes 200K Sites to Takeover]]></title>
            <description><![CDATA[Critical CVE-2026-1490 (CVSS 9.8) in CleanTalk anti-spam plugin allows unauthenticated attackers to install malicious plugins via DNS spoofing. Update to 6.72 now.]]></description>
            <link>https://www.probablypwned.com/article/cleantalk-wordpress-cve-2026-1490-critical-auth-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cleantalk-wordpress-cve-2026-1490-critical-auth-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-1490]]></category>
            <category><![CDATA[Plugin Vulnerability]]></category>
            <category><![CDATA[CleanTalk]]></category>
            <category><![CDATA[Authorization Bypass]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 13:03:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GPT-OSS-Safeguard Models Fail Multi-Turn Jailbreak Testing]]></title>
            <description><![CDATA[Cisco AI Defense research finds OpenAI's safeguard models perform worse than standard versions under sustained attack. Multi-turn jailbreaks spike success rates up to 92%.]]></description>
            <link>https://www.probablypwned.com/article/cisco-gpt-oss-safeguard-jailbreak-testing-ai-safety</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-gpt-oss-safeguard-jailbreak-testing-ai-safety</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[jailbreaking]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[GPT-OSS]]></category>
            <category><![CDATA[LLM safety]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco DevNet Launches AI Repos Catalog for MCP Servers]]></title>
            <description><![CDATA[New catalog at developer.cisco.com/codeexchange/ai centralizes AI agents and MCP servers for network automation, with built-in testing tools.]]></description>
            <link>https://www.probablypwned.com/article/cisco-devnet-code-exchange-ai-repos-catalog-mcp-agents</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-devnet-code-exchange-ai-repos-catalog-mcp-agents</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[DevNet]]></category>
            <category><![CDATA[MCP]]></category>
            <category><![CDATA[AI agents]]></category>
            <category><![CDATA[network automation]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 19:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dell Zero-Day Exploited by Chinese Hackers Since 2024]]></title>
            <description><![CDATA[Chinese threat group UNC6201 exploited a critical hardcoded credential flaw (CVE-2026-22769) in Dell RecoverPoint for 18 months before disclosure. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/dell-recoverpoint-cve-2026-22769-unc6201-china-apt-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dell-recoverpoint-cve-2026-22769-unc6201-china-apt-zero-day</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Dell]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-22769]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[UNC6201]]></category>
            <category><![CDATA[BRICKSTORM]]></category>
            <category><![CDATA[GRIMBOLT]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Talos Fuzzes Industrial Gateway, Finds Six DoS Vulnerabilities]]></title>
            <description><![CDATA[Cisco Talos researcher uses 'good enough' emulation to fuzz Socomec DIRIS M-70 energy gateway, discovering CVE-2025-54848 through CVE-2025-55222 in Modbus protocol handling.]]></description>
            <link>https://www.probablypwned.com/article/talos-good-enough-emulation-fuzzing-socomec-modbus-cves</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/talos-good-enough-emulation-fuzzing-socomec-modbus-cves</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[fuzzing]]></category>
            <category><![CDATA[Modbus]]></category>
            <category><![CDATA[CVE-2025-54848]]></category>
            <category><![CDATA[Socomec]]></category>
            <category><![CDATA[industrial-security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft: macOS Infostealers Surge With ClickFix and Python]]></title>
            <description><![CDATA[Microsoft Defender Experts track expanding infostealer campaigns hitting macOS via ClickFix prompts, malicious DMG installers, and Python-based stealers. DigitStealer, MacSync, and AMOS lead the wave.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-macos-infostealers-clickfix-python-cross-platform</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-macos-infostealers-clickfix-python-cross-platform</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[DigitStealer]]></category>
            <category><![CDATA[MacSync]]></category>
            <category><![CDATA[Atomic Stealer]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 13:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TeamPCP Worm Turns Cloud Misconfigs Into Cybercrime Platform]]></title>
            <description><![CDATA[Cloud-native worm campaign by TeamPCP has compromised 60,000+ servers by exploiting Docker APIs, Kubernetes, and React2Shell. Flare researchers detail the industrialized operation.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-worm-cloud-infrastructure-react2shell-cryptomining</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-worm-cloud-infrastructure-react2shell-cryptomining</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[worm]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[Kubernetes]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[cryptomining]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 13:03:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1667984390527-850f63192709?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1667984390527-850f63192709?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Four Flaws to KEV, Including 17-Year-Old ActiveX Bug]]></title>
            <description><![CDATA[CISA confirms active exploitation of Chrome CVE-2026-2441, Zimbra SSRF, Windows ActiveX CVE-2008-0015, and ThreatSonar flaws. Federal agencies face March 10 deadline.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-chrome-zimbra-activex-threatsonar-february-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-chrome-zimbra-activex-threatsonar-february-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[Zimbra]]></category>
            <category><![CDATA[ActiveX]]></category>
            <category><![CDATA[CVE-2026-2441]]></category>
            <category><![CDATA[CVE-2008-0015]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 13:02:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SANS Analyst Tracks Malware Using Recycled PNG Payload]]></title>
            <description><![CDATA[Xavier Mertens discovers 846 images reusing the same Base64 steganography technique to deliver .NET malware via Equation Editor exploits. Here's how defenders can hunt for copycats.]]></description>
            <link>https://www.probablypwned.com/article/sans-isc-malware-campaign-tracking-reused-png-payloads</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sans-isc-malware-campaign-tracking-reused-png-payloads</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[SANS]]></category>
            <category><![CDATA[threat hunting]]></category>
            <category><![CDATA[YARA]]></category>
            <category><![CDATA[CVE-2017-11882]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 11:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Moltbook Breach Exposes 1.5 Million AI Agent API Keys]]></title>
            <description><![CDATA[Wiz researchers found Moltbook's Supabase database exposed without authentication, leaking 1.5M API tokens, private messages, and plaintext OpenAI keys.]]></description>
            <link>https://www.probablypwned.com/article/moltbook-exposed-database-1-5-million-ai-agent-api-keys</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/moltbook-exposed-database-1-5-million-ai-agent-api-keys</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Moltbook]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[API keys]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Supabase]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Warns TLS Certificate Changes Could Break mTLS]]></title>
            <description><![CDATA[Public CAs will stop issuing TLS certificates with clientAuth EKU by June 2026. Cisco outlines the impact on CUBE, Expressway, and mTLS deployments.]]></description>
            <link>https://www.probablypwned.com/article/cisco-tls-clientauth-certificate-changes-june-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-tls-clientauth-certificate-changes-june-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[TLS]]></category>
            <category><![CDATA[mTLS]]></category>
            <category><![CDATA[certificates]]></category>
            <category><![CDATA[PKI]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Report Shows 8x Enterprise AI Growth—Networks Are the Bottleneck]]></title>
            <description><![CDATA[OpenAI's State of Enterprise AI shows 8x adoption growth and 320x reasoning usage. Cisco explains why your network architecture probably can't keep up.]]></description>
            <link>https://www.probablypwned.com/article/openai-enterprise-ai-report-cisco-network-infrastructure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-enterprise-ai-report-cisco-network-infrastructure</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[enterprise AI]]></category>
            <category><![CDATA[network infrastructure]]></category>
            <category><![CDATA[AgenticOps]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 15:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Infostealers Now Targeting AI Agent Configurations]]></title>
            <description><![CDATA[Hudson Rock detects Vidar infostealer exfiltrating OpenClaw AI agent files for the first time. Stolen configs include gateway tokens and cryptographic keys.]]></description>
            <link>https://www.probablypwned.com/article/vidar-infostealer-openclaw-ai-agent-configuration-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vidar-infostealer-openclaw-ai-agent-configuration-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 13:03:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Patches Chrome Zero-Day Under Active Exploitation]]></title>
            <description><![CDATA[CVE-2026-2441 is a high-severity CSS use-after-free in Chrome being exploited in the wild. Update to version 145.0.7632.75 immediately.]]></description>
            <link>https://www.probablypwned.com/article/chrome-zero-day-cve-2026-2441-css-use-after-free-active-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-zero-day-cve-2026-2441-css-use-after-free-active-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-2441]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 13:02:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MetaMask Users Hit by Phishing Using Fake Security Reports]]></title>
            <description><![CDATA[SANS ISC documents phishing campaign using fabricated incident reports to steal MetaMask wallet credentials. Attackers host phishing pages on AWS S3.]]></description>
            <link>https://www.probablypwned.com/article/metamask-fake-incident-report-phishing-aws-s3</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/metamask-fake-incident-report-phishing-aws-s3</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[MetaMask]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[AWS]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 11:22:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lumma Stealer Abuses Google Groups for C2 in New Campaign]]></title>
            <description><![CDATA[CTM360 exposes 4,000+ malicious Google Groups delivering Lumma Stealer and Ninja Browser malware. Attackers pose as tech support in forums to bypass network detection.]]></description>
            <link>https://www.probablypwned.com/article/lumma-stealer-ninja-browser-google-groups-c2-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lumma-stealer-ninja-browser-google-groups-c2-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Lumma Stealer]]></category>
            <category><![CDATA[Google Groups]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[command and control]]></category>
            <category><![CDATA[Ninja Browser]]></category>
            <category><![CDATA[CTM360]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 18:23:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrashFix Malware Crashes Browsers to Trick Enterprise Users]]></title>
            <description><![CDATA[Microsoft warns of ClickFix variant that deliberately crashes Chrome, then social-engineers victims into running PowerShell. Only domain-joined hosts targeted.]]></description>
            <link>https://www.probablypwned.com/article/crashfix-clickfix-malware-enterprise-browser-crash</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crashfix-clickfix-malware-enterprise-browser-crash</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[CrashFix]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[ModeloRAT]]></category>
            <category><![CDATA[enterprise malware]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 13:03:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Sandbox Escape CVE-2026-25049 Bypasses Prior Fix]]></title>
            <description><![CDATA[New n8n RCE flaw bypasses December patch through type confusion. CVSS 9.4 vulnerability enables unauthenticated command execution via malicious workflows.]]></description>
            <link>https://www.probablypwned.com/article/n8n-cve-2026-25049-sandbox-escape-rce-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-cve-2026-25049-sandbox-escape-rce-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-25049]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[type confusion]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 13:02:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dutch Telecom Odido Breach Exposes 6.2 Million Customers]]></title>
            <description><![CDATA[Odido confirms cyberattack exposed names, IBANs, passport numbers, and personal data of 6.2 million Dutch customers. Services remain operational.]]></description>
            <link>https://www.probablypwned.com/article/odido-netherlands-breach-6-million-customer-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/odido-netherlands-breach-6-million-customer-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Odido]]></category>
            <category><![CDATA[Netherlands]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[telecom]]></category>
            <category><![CDATA[IBAN]]></category>
            <category><![CDATA[GDPR]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 13:02:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apple Patches Zero-Day Used in 'Sophisticated' Attacks]]></title>
            <description><![CDATA[CVE-2026-20700 memory corruption flaw in dyld exploited against targeted individuals. Google TAG credited with discovery. Patch now for iOS, macOS, watchOS.]]></description>
            <link>https://www.probablypwned.com/article/apple-zero-day-cve-2026-20700-dyld-sophisticated-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apple-zero-day-cve-2026-20700-dyld-sophisticated-attacks</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-20700]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[Google TAG]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 13:01:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Valentine's Day Phishing Domains Surge 44% Ahead of Feb 14]]></title>
            <description><![CDATA[Check Point documents 44% spike in fake Valentine's domains with 97.5% unclassified. Four in ten Valentine-themed emails are scams targeting U.S. consumers.]]></description>
            <link>https://www.probablypwned.com/article/valentines-day-phishing-44-percent-domain-surge-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/valentines-day-phishing-44-percent-domain-surge-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Valentine's Day]]></category>
            <category><![CDATA[romance scams]]></category>
            <category><![CDATA[domain abuse]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:41:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious Chrome Extensions Target Meta Business, VK, AI Tools]]></title>
            <description><![CDATA[Researchers expose three Chrome extension campaigns stealing Meta Business Suite exports, VK accounts, and AI chatbot conversations from over 760,000 users.]]></description>
            <link>https://www.probablypwned.com/article/chrome-extension-malware-meta-business-vk-ai-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-extension-malware-meta-business-vk-ai-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[Meta Business]]></category>
            <category><![CDATA[VKontakte]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:41:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lazarus Plants Malicious Packages in npm and PyPI Registries]]></title>
            <description><![CDATA[North Korea's Lazarus Group targets blockchain developers with fake recruitment campaign distributing RAT malware through 36 poisoned npm and PyPI packages.]]></description>
            <link>https://www.probablypwned.com/article/lazarus-graphalgo-npm-pypi-supply-chain-blockchain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lazarus-graphalgo-npm-pypi-supply-chain-blockchain</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Lazarus]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[RAT]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:40:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UAT-9921 Deploys VoidLink Against Tech and Finance Sectors]]></title>
            <description><![CDATA[Cisco Talos links previously unknown threat actor UAT-9921 to VoidLink malware campaigns targeting technology and financial services since September 2025.]]></description>
            <link>https://www.probablypwned.com/article/uat-9921-voidlink-tech-finance-campaigns-talos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-9921-voidlink-tech-finance-campaigns-talos</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UAT-9921]]></category>
            <category><![CDATA[VoidLink]]></category>
            <category><![CDATA[Talos]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[cloud]]></category>
            <category><![CDATA[financial services]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:40:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China's UNC3886 Breached All Four Singapore Telcos]]></title>
            <description><![CDATA[Singapore confirms China-linked APT compromised M1, Singtel, StarHub, and SIMBA using zero-day exploits and rootkits. 11-month Operation Cyber Guardian response disclosed.]]></description>
            <link>https://www.probablypwned.com/article/singapore-unc3886-telecom-breach-zero-day-rootkits</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/singapore-unc3886-telecom-breach-zero-day-rootkits</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UNC3886]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Singapore]]></category>
            <category><![CDATA[telecommunications]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[rootkit]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:39:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Single IP Behind 83% of Ivanti EPMM Attacks, Sleepers Found]]></title>
            <description><![CDATA[GreyNoise traces Ivanti EPMM exploitation to bulletproof hosting on PROSPERO network. Defenders find dormant webshells—signs of initial access broker activity.]]></description>
            <link>https://www.probablypwned.com/article/ivanti-epmm-exploitation-bulletproof-hosting-sleeper-shells</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ivanti-epmm-exploitation-bulletproof-hosting-sleeper-shells</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CVE-2026-1281]]></category>
            <category><![CDATA[bulletproof hosting]]></category>
            <category><![CDATA[initial access broker]]></category>
            <category><![CDATA[exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:38:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1590859808308-3d2d9c515b1a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1590859808308-3d2d9c515b1a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI Knowledge Graphs Transform APT Threat Intelligence]]></title>
            <description><![CDATA[SANS researchers demonstrate how open-source AI tools extract actionable relationships from unstructured threat reports, mapping GRU and APT28 TTPs in interactive visualizations.]]></description>
            <link>https://www.probablypwned.com/article/ai-knowledge-graph-generator-apt-threat-intelligence-sans</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-knowledge-graph-generator-apt-threat-intelligence-sans</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[knowledge graph]]></category>
            <category><![CDATA[AI threat intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[GRU]]></category>
            <category><![CDATA[SANS ISC]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 13 Feb 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[How to Become a Cybersecurity Analyst: Career Guide]]></title>
            <description><![CDATA[How to become a cybersecurity analyst in 2026. Learn the skills, certifications, education paths, and salary expectations for breaking into this high-demand field.]]></description>
            <link>https://www.probablypwned.com/article/how-to-become-cybersecurity-analyst-career-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/how-to-become-cybersecurity-analyst-career-guide</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[cybersecurity analyst]]></category>
            <category><![CDATA[career guide]]></category>
            <category><![CDATA[Security+]]></category>
            <category><![CDATA[SIEM]]></category>
            <category><![CDATA[certifications]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Fri, 13 Feb 2026 01:00:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1497215728101-856f4ea42174?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1497215728101-856f4ea42174?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[State Hackers Weaponize Gemini AI Across Attack Lifecycle]]></title>
            <description><![CDATA[Google's threat intelligence reveals APT groups from China, Iran, North Korea, and Russia using Gemini for recon, malware development, and phishing. Two AI-powered malware families discovered.]]></description>
            <link>https://www.probablypwned.com/article/google-gemini-ai-abuse-nation-state-hackers-honestcue-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-gemini-ai-abuse-nation-state-hackers-honestcue-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Google Gemini]]></category>
            <category><![CDATA[AI abuse]]></category>
            <category><![CDATA[APT42]]></category>
            <category><![CDATA[APT31]]></category>
            <category><![CDATA[nation-state hackers]]></category>
            <category><![CDATA[HonestCue malware]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Snort 3 MIME Flaws Expose Firewalls to DoS and Data Leaks]]></title>
            <description><![CDATA[CVE-2025-20359 and CVE-2025-20360 affect Cisco FTD, Meraki, and open-source Snort 3. No workarounds exist—patches rolling out through February.]]></description>
            <link>https://www.probablypwned.com/article/cisco-snort3-mime-dos-cve-2025-20359-20360</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-snort3-mime-dos-cve-2025-20359-20360</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[Snort 3]]></category>
            <category><![CDATA[CVE-2025-20359]]></category>
            <category><![CDATA[denial of service]]></category>
            <category><![CDATA[firewall security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 15:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet Patches Critical SQLi-to-RCE Flaw in FortiClientEMS]]></title>
            <description><![CDATA[CVE-2026-21643 allows unauthenticated attackers to chain SQL injection with command execution in FortiClient EMS. CVSS 9.8 affects version 7.4.4—upgrade to 7.4.5 immediately.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-forticlientems-cve-2026-21643-sql-injection-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-forticlientems-cve-2026-21643-sql-injection-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2026-21643]]></category>
            <category><![CDATA[FortiClientEMS]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:06:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Uses Deepfake Zoom Calls in Crypto Heists]]></title>
            <description><![CDATA[Google Mandiant exposes UNC1069's use of AI-generated deepfake video, compromised executive accounts, and ClickFix attacks to deploy macOS malware against cryptocurrency firms.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-unc1069-deepfake-clickfix-crypto-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-unc1069-deepfake-clickfix-crypto-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[UNC1069]]></category>
            <category><![CDATA[deepfake]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[macOS malware]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:06:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Germany Warns of Signal Phishing Targeting Officials]]></title>
            <description><![CDATA[Germany's BfV and BSI issued a joint advisory warning of state-sponsored phishing campaigns targeting politicians, military officials, and journalists through Signal's device linking feature.]]></description>
            <link>https://www.probablypwned.com/article/germany-signal-phishing-warning-politicians-military</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/germany-signal-phishing-warning-politicians-military</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Signal]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Germany]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[BSI]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:05:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BeyondTrust Pre-Auth RCE Exposes 11,000 Systems]]></title>
            <description><![CDATA[CVE-2026-1731 allows unauthenticated remote code execution on BeyondTrust Remote Support and Privileged Remote Access products. CVSS 9.9 vulnerability affects 11,000+ exposed instances.]]></description>
            <link>https://www.probablypwned.com/article/beyondtrust-cve-2026-1731-pre-auth-rce-11000-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/beyondtrust-cve-2026-1731-pre-auth-rce-11000-exposed</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[BeyondTrust]]></category>
            <category><![CDATA[CVE-2026-1731]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[pre-authentication]]></category>
            <category><![CDATA[remote access]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:04:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SSHStalker Botnet Compromises 7,000 Linux Servers via SSH]]></title>
            <description><![CDATA[New Linux botnet SSHStalker infected 7,000 cloud servers using brute-force SSH attacks and 2009-era kernel exploits. Uses IRC for command-and-control while apparently staging for future operations.]]></description>
            <link>https://www.probablypwned.com/article/sshstalker-botnet-7000-linux-servers-irc-c2</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sshstalker-botnet-7000-linux-servers-irc-c2</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[SSHStalker]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[SSH]]></category>
            <category><![CDATA[IRC]]></category>
            <category><![CDATA[cloud security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:04:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Reynolds Ransomware Bundles EDR-Killing Driver Into Payload]]></title>
            <description><![CDATA[New ransomware family Reynolds embeds a vulnerable NsecSoft driver directly into its payload to disable CrowdStrike, Sophos, and other EDR tools before encryption begins.]]></description>
            <link>https://www.probablypwned.com/article/reynolds-ransomware-byovd-edr-killer-embedded</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/reynolds-ransomware-byovd-edr-killer-embedded</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Reynolds]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[BYOVD]]></category>
            <category><![CDATA[EDR]]></category>
            <category><![CDATA[NsecSoft]]></category>
            <category><![CDATA[defense evasion]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:03:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches Six Zero-Days in February Patch Tuesday]]></title>
            <description><![CDATA[Microsoft's February 2026 Patch Tuesday fixes 59 flaws including six actively exploited zero-days. CrowdStrike confirmed CVE-2026-21533 was used in attacks targeting US and Canada since December.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-patch-tuesday-february-2026-six-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-patch-tuesday-february-2026-six-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-21510]]></category>
            <category><![CDATA[CVE-2026-21533]]></category>
            <category><![CDATA[Windows]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:02:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is MFA? Multi-Factor Authentication Explained]]></title>
            <description><![CDATA[What is MFA? Learn how multi-factor authentication works, the three authentication factors, and why FIDO2 passkeys are the future of phishing-resistant security.]]></description>
            <link>https://www.probablypwned.com/article/what-is-mfa-multi-factor-authentication</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-mfa-multi-factor-authentication</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[MFA]]></category>
            <category><![CDATA[multi-factor authentication]]></category>
            <category><![CDATA[FIDO2]]></category>
            <category><![CDATA[passkeys]]></category>
            <category><![CDATA[security]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 01:01:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486501-0cf524a07213?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486501-0cf524a07213?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[How to Detect Deepfakes: Signs, Tools, and Protection]]></title>
            <description><![CDATA[Learn how to detect deepfakes with visual clues, audio patterns, and authentication methods. Covers detection signs, AI tools, and practical defense strategies.]]></description>
            <link>https://www.probablypwned.com/article/how-to-detect-deepfakes-signs-tools-protection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/how-to-detect-deepfakes-signs-tools-protection</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[deepfakes]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[authentication]]></category>
            <category><![CDATA[fraud prevention]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Wed, 11 Feb 2026 01:01:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1535378620166-273708d44e4c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1535378620166-273708d44e4c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ZeroDayRAT Spyware Grants Full Access to Mobile Devices]]></title>
            <description><![CDATA[Commercial mobile spyware on Telegram offers live surveillance, OTP interception, and crypto theft across Android 5-16 and iOS up to version 26.]]></description>
            <link>https://www.probablypwned.com/article/zerodayrat-spyware-full-access-android-ios</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zerodayrat-spyware-full-access-android-ios</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ZeroDayRAT]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[spyware]]></category>
            <category><![CDATA[mobile malware]]></category>
            <category><![CDATA[RAT]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 10 Feb 2026 14:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[How Cisco IT Cut Incidents 25% With Unified Observability]]></title>
            <description><![CDATA[Cisco IT unified fragmented monitoring tools into a centralized observability platform, achieving zero network incidents and 45% faster detection using Splunk, ThousandEyes, and AI automation.]]></description>
            <link>https://www.probablypwned.com/article/cisco-it-observability-transformation-unified-insights</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-it-observability-transformation-unified-insights</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[observability]]></category>
            <category><![CDATA[Splunk]]></category>
            <category><![CDATA[ThousandEyes]]></category>
            <category><![CDATA[AppDynamics]]></category>
            <category><![CDATA[enterprise IT]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 09 Feb 2026 21:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco XDR Powers Black Hat Europe NOC With Beta Integrations]]></title>
            <description><![CDATA[Cisco XDR showcased production-ready integrations with Corelight NDR and Palo Alto Networks firewalls at Black Hat Europe, processing 25 log bundles per minute.]]></description>
            <link>https://www.probablypwned.com/article/cisco-xdr-integration-black-hat-europe-2025</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-xdr-integration-black-hat-europe-2025</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco XDR]]></category>
            <category><![CDATA[Black Hat Europe]]></category>
            <category><![CDATA[Corelight]]></category>
            <category><![CDATA[Palo Alto Networks]]></category>
            <category><![CDATA[OCSF]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 09 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[How Cisco Locked Down DNS at Black Hat Europe]]></title>
            <description><![CDATA[Cisco deployed Secure Access to process 66 million DNS queries at Black Hat Europe 2025, tracking ApateWeb domains and a surge in GenAI apps across the conference network.]]></description>
            <link>https://www.probablypwned.com/article/cisco-secure-access-dns-black-hat-europe-2025</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-secure-access-dns-black-hat-europe-2025</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[DNS security]]></category>
            <category><![CDATA[Black Hat Europe]]></category>
            <category><![CDATA[Secure Access]]></category>
            <category><![CDATA[ApateWeb]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 09 Feb 2026 16:20:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is EDR? Endpoint Detection and Response Explained]]></title>
            <description><![CDATA[Endpoint detection and response (EDR) monitors devices to catch threats antivirus misses. Learn how EDR works, key features, and how it compares to EPP and XDR.]]></description>
            <link>https://www.probablypwned.com/article/what-is-edr-endpoint-detection-response</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-edr-endpoint-detection-response</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[endpoint detection and response]]></category>
            <category><![CDATA[EDR]]></category>
            <category><![CDATA[endpoint security]]></category>
            <category><![CDATA[cybersecurity tools]]></category>
            <category><![CDATA[threat detection]]></category>
            <dc:creator><![CDATA[David Okonkwo]]></dc:creator>
            <pubDate>Mon, 09 Feb 2026 01:01:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Tirith Blocks Homoglyph Attacks Before They Hit Your Shell]]></title>
            <description><![CDATA[Open-source Tirith tool hooks into bash, zsh, fish, and PowerShell to catch Unicode imposter commands, ANSI injection, and pipe-to-shell tricks in real time.]]></description>
            <link>https://www.probablypwned.com/article/tirith-open-source-shell-homoglyph-command-detection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tirith-open-source-shell-homoglyph-command-detection</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[Tirith]]></category>
            <category><![CDATA[homoglyph]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[shell security]]></category>
            <category><![CDATA[open source]]></category>
            <dc:creator><![CDATA[David Okonkwo]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AT&T Breach Data Resurfaces with 176M Enriched Records]]></title>
            <description><![CDATA[Enriched AT&T breach dataset with 148M Social Security numbers and 133M addresses is circulating privately, creating fresh identity theft and SIM-swap risks.]]></description>
            <link>https://www.probablypwned.com/article/att-breach-176-million-records-enriched-ssn-data-resurfaces</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/att-breach-176-million-records-enriched-ssn-data-resurfaces</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[AT&T]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[identity theft]]></category>
            <category><![CDATA[SIM swap]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 13:11:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Flickr Breach Exposes User Data via Email Vendor Flaw]]></title>
            <description><![CDATA[Flickr discloses a data breach through a third-party email provider vulnerability that exposed names, emails, and IP addresses for up to 35 million users.]]></description>
            <link>https://www.probablypwned.com/article/flickr-data-breach-third-party-email-provider-user-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/flickr-data-breach-third-party-email-provider-user-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Flickr]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[third-party risk]]></category>
            <category><![CDATA[email provider]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 13:10:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran's Infy APT Drops Tornado v51 After Internet Blackout]]></title>
            <description><![CDATA[SafeBreach tracks Infy APT deploying Tornado v51 malware with blockchain-based C2 after Iran's internet blackout, confirming state sponsorship ties.]]></description>
            <link>https://www.probablypwned.com/article/infy-tornado-v51-iran-blackout-blockchain-c2</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infy-tornado-v51-iran-blackout-blockchain-c2</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Infy]]></category>
            <category><![CDATA[Prince of Persia]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Tornado]]></category>
            <category><![CDATA[blockchain]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 13:09:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BridgePay Ransomware Attack Knocks Payment Gateway Offline]]></title>
            <description><![CDATA[BridgePay confirms ransomware attack crippled its payment processing platform, forcing merchants nationwide to cash-only. FBI and Secret Service are investigating.]]></description>
            <link>https://www.probablypwned.com/article/bridgepay-ransomware-attack-payment-gateway-outage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bridgepay-ransomware-attack-payment-gateway-outage</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[BridgePay]]></category>
            <category><![CDATA[payment processing]]></category>
            <category><![CDATA[outage]]></category>
            <category><![CDATA[financial services]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 13:08:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Shadow Campaigns: Spies Breach 70 Orgs in 37 Nations]]></title>
            <description><![CDATA[Asia-based APT TGR-STA-1030 compromised 70+ government and critical infrastructure targets across 37 countries using eBPF rootkits and Cobalt Strike.]]></description>
            <link>https://www.probablypwned.com/article/shadow-campaigns-tgr-sta-1030-espionage-37-countries</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shadow-campaigns-tgr-sta-1030-espionage-37-countries</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[eBPF rootkit]]></category>
            <category><![CDATA[Unit 42]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Substack Breach Exposes 700K Users' Emails and Phones]]></title>
            <description><![CDATA[Substack's October 2025 breach went undetected for four months. 700,000 users' email addresses and phone numbers were accessed by an unauthorized third party.]]></description>
            <link>https://www.probablypwned.com/article/substack-data-breach-700000-users-email-phone-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/substack-data-breach-700000-users-email-phone-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Substack]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[email exposure]]></category>
            <category><![CDATA[platform security]]></category>
            <category><![CDATA[user data]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:10:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Hits Romania's Oil Pipeline Operator]]></title>
            <description><![CDATA[Conpet, operator of 3,800km of Romanian oil pipelines, confirms cyberattack. Qilin claims 1TB of stolen data including financial records and passports.]]></description>
            <link>https://www.probablypwned.com/article/conpet-romania-oil-pipeline-qilin-ransomware-1tb</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/conpet-romania-oil-pipeline-qilin-ransomware-1tb</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Conpet]]></category>
            <category><![CDATA[Romania]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[oil pipeline]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:08:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Conduent Breach Now Affects 25.9 Million Americans]]></title>
            <description><![CDATA[The January 2025 ransomware attack on govtech giant Conduent keeps growing—15.4M in Texas, 10.5M in Oregon, with more states still counting.]]></description>
            <link>https://www.probablypwned.com/article/conduent-data-breach-25-million-americans-safeway-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/conduent-data-breach-25-million-americans-safeway-ransomware</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Conduent]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Safeway ransomware]]></category>
            <category><![CDATA[government data]]></category>
            <category><![CDATA[Social Security numbers]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:07:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Federal Agencies to Dump End-of-Life Edge Gear]]></title>
            <description><![CDATA[Binding Operational Directive 26-02 gives federal agencies 12-18 months to remove unsupported routers, firewalls, and switches from networks.]]></description>
            <link>https://www.probablypwned.com/article/cisa-bod-26-02-edge-device-replacement-federal-agencies</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-bod-26-02-edge-device-replacement-federal-agencies</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[BOD 26-02]]></category>
            <category><![CDATA[edge devices]]></category>
            <category><![CDATA[federal agencies]]></category>
            <category><![CDATA[network security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:06:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[vLLM CVSS 9.8 Flaw Lets Attackers Own AI Servers via Video]]></title>
            <description><![CDATA[CVE-2026-22778 chains a heap leak and buffer overflow in vLLM's video processing to achieve full RCE on AI inference servers. Patch to 0.14.1 now.]]></description>
            <link>https://www.probablypwned.com/article/vllm-cve-2026-22778-rce-ai-servers-video-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vllm-cve-2026-22778-rce-ai-servers-video-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[vLLM]]></category>
            <category><![CDATA[CVE-2026-22778]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[CVSS 9.8]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is Red Teaming? Methodology, Tools, and Benefits]]></title>
            <description><![CDATA[Red teaming tests your defenses by simulating real attacks. Learn how red team engagements work, the key phases, tools used, and how they differ from pen testing.]]></description>
            <link>https://www.probablypwned.com/article/what-is-red-teaming-methodology-tools-benefits</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-red-teaming-methodology-tools-benefits</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[red teaming]]></category>
            <category><![CDATA[penetration testing]]></category>
            <category><![CDATA[offensive security]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <category><![CDATA[threat simulation]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 01:01:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AIUC-1 Becomes First Standard for Securing AI Agents]]></title>
            <description><![CDATA[Cisco helps build AIUC-1, the first AI agent security standard, mapping its AI Security Framework to testable controls for prompt injection, jailbreaks, and more.]]></description>
            <link>https://www.probablypwned.com/article/aiuc-1-cisco-ai-security-framework-standard-agents</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aiuc-1-cisco-ai-security-framework-standard-agents</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[AIUC-1]]></category>
            <category><![CDATA[agentic AI]]></category>
            <category><![CDATA[AI governance]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware Gangs Share ISPsystem VMs to Hide Attacks]]></title>
            <description><![CDATA[Sophos finds 7,000+ servers with identical hostnames from ISPsystem VMmanager templates. LockBit, Qilin, and Conti all used the same bulletproof hosting VMs.]]></description>
            <link>https://www.probablypwned.com/article/ransomware-ispsystem-vmmanager-bulletproof-hosting-sophos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ransomware-ispsystem-vmmanager-bulletproof-hosting-sophos</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[ISPsystem]]></category>
            <category><![CDATA[bulletproof hosting]]></category>
            <category><![CDATA[Sophos]]></category>
            <category><![CDATA[virtual machines]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 18:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Super Bowl LX's Cyber Defense Playbook]]></title>
            <description><![CDATA[Inside the cyber command center protecting Super Bowl LX at Levi's Stadium, where Cisco deployed 1,500 Wi-Fi 7 access points and blocked 400,000+ threats before kickoff.]]></description>
            <link>https://www.probablypwned.com/article/super-bowl-lx-cisco-cybersecurity-wifi7-levis-stadium</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/super-bowl-lx-cisco-cybersecurity-wifi7-levis-stadium</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[Super Bowl]]></category>
            <category><![CDATA[Wi-Fi 7]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[Talos]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 17:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NetOp AI Tackles the Network Readiness Gap for AI]]></title>
            <description><![CDATA[NetOp AI's network assessment tool helps Cisco partners identify infrastructure gaps blocking AI deployments. Here's how it works and why it matters.]]></description>
            <link>https://www.probablypwned.com/article/netop-ai-cisco-network-assessment-ai-readiness-scale</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/netop-ai-cisco-network-assessment-ai-readiness-scale</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[NetOp AI]]></category>
            <category><![CDATA[network assessment]]></category>
            <category><![CDATA[AI readiness]]></category>
            <category><![CDATA[MSP]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Rapid7 Links Notepad++ Breach to Lotus Blossom APT]]></title>
            <description><![CDATA[Rapid7 attributes the six-month Notepad++ supply chain compromise to Chinese APT Lotus Blossom, revealing a custom Chrysalis backdoor and three distinct infection chains.]]></description>
            <link>https://www.probablypwned.com/article/notepad-plus-plus-lotus-blossom-chrysalis-backdoor-rapid7</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/notepad-plus-plus-lotus-blossom-chrysalis-backdoor-rapid7</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Notepad++]]></category>
            <category><![CDATA[Lotus Blossom]]></category>
            <category><![CDATA[Chrysalis]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 13:05:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Talos Exposes DKnife: China-Linked Router AitM Framework]]></title>
            <description><![CDATA[Seven-implant Linux toolkit intercepts traffic on compromised routers, delivering ShadowPad and hijacking Android updates. Active C2 infrastructure dates to 2019.]]></description>
            <link>https://www.probablypwned.com/article/dknife-aitm-framework-talos-china-routers-shadowpad</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dknife-aitm-framework-talos-china-routers-shadowpad</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DKnife]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[ShadowPad]]></category>
            <category><![CDATA[adversary-in-the-middle]]></category>
            <category><![CDATA[router compromise]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 13:04:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Confirms VMware ESXi Flaw Used in Ransomware]]></title>
            <description><![CDATA[CVE-2025-22225 sandbox escape now confirmed as a ransomware attack vector. Exploitation toolkit predates Broadcom's patch by a full year.]]></description>
            <link>https://www.probablypwned.com/article/vmware-esxi-cve-2025-22225-ransomware-cisa-confirms</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vmware-esxi-cve-2025-22225-ransomware-cisa-confirms</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-22225]]></category>
            <category><![CDATA[VMware ESXi]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 13:04:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SmarterMail Flaw Exploited in Ransomware Attacks]]></title>
            <description><![CDATA[CVE-2026-24423 lets unauthenticated attackers execute OS commands on SmarterMail servers. CISA confirms active ransomware exploitation and sets a February 26 patch deadline.]]></description>
            <link>https://www.probablypwned.com/article/smartermail-cve-2026-24423-ransomware-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smartermail-cve-2026-24423-ransomware-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-24423]]></category>
            <category><![CDATA[SmarterMail]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 13:03:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco AI Summit: Security Takes Center Stage]]></title>
            <description><![CDATA[Cisco's second AI Summit unveiled AI Defense, AgenticOps, and Silicon One P200. Here's what security teams need to know about agentic AI governance.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ai-summit-2026-agenticops-ai-defense-silicon-one</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ai-summit-2026-agenticops-ai-defense-silicon-one</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[AgenticOps]]></category>
            <category><![CDATA[AI Defense]]></category>
            <category><![CDATA[Silicon One]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 11:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1531482615713-2afd69097998?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1531482615713-2afd69097998?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is Access Control? Models, Types, and Best Practices]]></title>
            <description><![CDATA[Learn what access control means in cybersecurity, the four main models (DAC, MAC, RBAC, ABAC), and how to implement effective access control policies.]]></description>
            <link>https://www.probablypwned.com/article/what-is-access-control-models-types-best-practices</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-access-control-models-types-best-practices</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[access control]]></category>
            <category><![CDATA[RBAC]]></category>
            <category><![CDATA[zero trust]]></category>
            <category><![CDATA[identity management]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 01:02:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Talos Warns AI Adoption Is Outrunning Security]]></title>
            <description><![CDATA[Cisco Talos sounds the alarm on AI tools that demand root access and store credentials in plaintext, calling the current adoption frenzy a security crisis.]]></description>
            <link>https://www.probablypwned.com/article/talos-ai-adoption-security-sacrifice-convenience</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/talos-ai-adoption-security-sacrifice-convenience</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[agentic AI]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 21:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Targets European Maritime Sector via Office Flaw]]></title>
            <description><![CDATA[Russia's APT28 exploited CVE-2026-21509 to hit maritime and transport organizations across nine countries, with shipping firms making up 35% of targets.]]></description>
            <link>https://www.probablypwned.com/article/apt28-maritime-transport-cve-2026-21509-office-europe</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-maritime-transport-cve-2026-21509-office-europe</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[CVE-2026-21509]]></category>
            <category><![CDATA[maritime]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Microsoft Office]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Live Amsterdam Tackles AI Policy Gap]]></title>
            <description><![CDATA[Cisco Live EMEA 2026 features a fireside chat on AI governance, digital sovereignty, and infrastructure readiness for government and enterprise leaders.]]></description>
            <link>https://www.probablypwned.com/article/cisco-live-amsterdam-ai-revolution-policy-government</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-live-amsterdam-ai-revolution-policy-government</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco Live]]></category>
            <category><![CDATA[AI policy]]></category>
            <category><![CDATA[digital sovereignty]]></category>
            <category><![CDATA[AI governance]]></category>
            <category><![CDATA[Amsterdam]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 19:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Outlines Two-Pillar Post-Quantum Strategy]]></title>
            <description><![CDATA[Cisco details its post-quantum cryptography approach targeting harvest-now-decrypt-later threats and quantum-resistant product foundations.]]></description>
            <link>https://www.probablypwned.com/article/cisco-post-quantum-cryptography-pqc-hndl-threat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-post-quantum-cryptography-pqc-hndl-threat</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[post-quantum cryptography]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[NIST]]></category>
            <category><![CDATA[encryption]]></category>
            <category><![CDATA[HNDL]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Broken Phishing URLs Are Bypassing Your Filters]]></title>
            <description><![CDATA[SANS ISC handler Xavier Mertens documents phishing campaigns using malformed URL parameters to evade regex detection, URL normalization, and IOC extraction.]]></description>
            <link>https://www.probablypwned.com/article/broken-phishing-urls-cloudflare-workers-regex-evasion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/broken-phishing-urls-cloudflare-workers-regex-evasion</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[URL evasion]]></category>
            <category><![CDATA[Cloudflare Workers]]></category>
            <category><![CDATA[SANS ISC]]></category>
            <category><![CDATA[regex bypass]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 14:20:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[React2Shell Exploits Fuel Massive NGINX Traffic Hijacking]]></title>
            <description><![CDATA[Over 1,000 IPs exploit CVE-2025-55182 to inject malicious NGINX configs that redirect web traffic through attacker infrastructure, targeting Asian government and education sites.]]></description>
            <link>https://www.probablypwned.com/article/react2shell-nginx-hijacking-web-traffic-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/react2shell-nginx-hijacking-web-traffic-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[NGINX]]></category>
            <category><![CDATA[CVE-2025-55182]]></category>
            <category><![CDATA[traffic hijacking]]></category>
            <category><![CDATA[Baota panel]]></category>
            <category><![CDATA[cryptomining]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 13:09:39 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DEAD#VAX Campaign Hides AsyncRAT in Memory-Only Attack]]></title>
            <description><![CDATA[Securonix uncovers multi-stage fileless campaign using IPFS-hosted VHD files and process injection into signed Windows binaries to deploy AsyncRAT.]]></description>
            <link>https://www.probablypwned.com/article/deadvax-asyncrat-fileless-ipfs-vhd-phishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/deadvax-asyncrat-fileless-ipfs-vhd-phishing</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AsyncRAT]]></category>
            <category><![CDATA[fileless malware]]></category>
            <category><![CDATA[IPFS]]></category>
            <category><![CDATA[DEAD#VAX]]></category>
            <category><![CDATA[process injection]]></category>
            <category><![CDATA[Securonix]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 13:08:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Weaponized Office Zero-Day in Three Days Flat]]></title>
            <description><![CDATA[Operation Neusploit saw Russia's APT28 exploit CVE-2026-21509 against 60+ Ukrainian targets within 72 hours of Microsoft's disclosure, delivering MiniDoor and BEARDSHELL backdoors.]]></description>
            <link>https://www.probablypwned.com/article/apt28-operation-neusploit-cve-2026-21509-eastern-europe</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-operation-neusploit-cve-2026-21509-eastern-europe</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[CVE-2026-21509]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Operation Neusploit]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Microsoft Office]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 13:08:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Patches Five Critical Flaws Including CVSS 9.4 RCE]]></title>
            <description><![CDATA[CVE-2026-25049 bypasses n8n's previous sandbox fix to enable system command execution. Four additional vulnerabilities disclosed simultaneously.]]></description>
            <link>https://www.probablypwned.com/article/n8n-cve-2026-25049-expression-escape-rce-five-flaws</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-cve-2026-25049-expression-escape-rce-five-flaws</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-25049]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 13:07:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Three Days to Patch: CISA's Urgent SolarWinds Deadline Explained]]></title>
            <description><![CDATA[Federal agencies face an aggressive Friday deadline to patch CVE-2025-40551 in SolarWinds Web Help Desk. The compressed timeline signals serious active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/solarwinds-whd-three-day-patch-deadline-federal-agencies</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/solarwinds-whd-three-day-patch-deadline-federal-agencies</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[BOD 22-01]]></category>
            <category><![CDATA[patching]]></category>
            <category><![CDATA[federal agencies]]></category>
            <category><![CDATA[CVE-2025-40551]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco 8375 Router Earns NetSecOPEN Validation for Branch Security]]></title>
            <description><![CDATA[Independent testing confirms 99.3% IPS effectiveness and 99.8% malware detection for Cisco's unified routing and firewall platform.]]></description>
            <link>https://www.probablypwned.com/article/netsecopen-cisco-8375-secure-router-branch-validation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/netsecopen-cisco-8375-secure-router-branch-validation</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[NetSecOPEN]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[branch security]]></category>
            <category><![CDATA[firewall]]></category>
            <category><![CDATA[RFC 9411]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 17:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Live EMEA 2026: Developer Sessions You Can't Miss]]></title>
            <description><![CDATA[From AI-driven network automation to Meraki's OAuth 2.0 rollout, here's what developers should target at Cisco Live Amsterdam.]]></description>
            <link>https://www.probablypwned.com/article/cisco-live-emea-2026-developer-guide-ai-meraki-mcp</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-live-emea-2026-developer-guide-ai-meraki-mcp</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco Live]]></category>
            <category><![CDATA[DevNet]]></category>
            <category><![CDATA[MCP]]></category>
            <category><![CDATA[Meraki]]></category>
            <category><![CDATA[AI automation]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 17:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Prime Infrastructure XSS Flaw Targets Admins]]></title>
            <description><![CDATA[CVE-2026-20111 enables stored cross-site scripting attacks against administrators of Cisco Prime Infrastructure network management systems.]]></description>
            <link>https://www.probablypwned.com/article/cisco-prime-infrastructure-xss-cve-2026-20111-network-management</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-prime-infrastructure-xss-cve-2026-20111-network-management</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[CVE-2026-20111]]></category>
            <category><![CDATA[network management]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Maps the Five Domains of AI Security]]></title>
            <description><![CDATA[New taxonomy from Cisco's CISO and security leadership defines five AI security domains and the organizational functions needed to secure enterprise AI systems.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ai-security-domains-organizational-functions-taxonomy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ai-security-domains-organizational-functions-taxonomy</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[governance]]></category>
            <category><![CDATA[CISO]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 16:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[XWorm RAT Hides in PNG Image via Steganography Attack]]></title>
            <description><![CDATA[SANS researcher uncovers multi-stage malware attack hiding XWorm payload inside a legitimate travel website image using steganography and obfuscated batch scripts.]]></description>
            <link>https://www.probablypwned.com/article/xworm-rat-steganography-png-batch-script-sans</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/xworm-rat-steganography-png-batch-script-sans</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[XWorm]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[SANS]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[Telegram]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 15:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Service Finder Plugin Exploit Hits 13,800 Sites]]></title>
            <description><![CDATA[Attackers exploiting CVE-2025-5947 in Service Finder Bookings plugin to hijack admin accounts through cookie manipulation. Over 6,000 sites potentially exposed.]]></description>
            <link>https://www.probablypwned.com/article/wordpress-service-finder-cve-2025-5947-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wordpress-service-finder-cve-2025-5947-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2025-5947]]></category>
            <category><![CDATA[admin takeover]]></category>
            <category><![CDATA[Service Finder]]></category>
            <category><![CDATA[plugin vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:05:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[1 in 5 Infostealer Infections Will Expose Enterprise Creds]]></title>
            <description><![CDATA[Flare research finds enterprise identity compromise doubled in 2025, with Microsoft Entra ID appearing in 79% of logs. Session cookies enable MFA bypass at scale.]]></description>
            <link>https://www.probablypwned.com/article/flare-infostealer-enterprise-credentials-microsoft-entra-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/flare-infostealer-enterprise-credentials-microsoft-entra-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[Microsoft Entra ID]]></category>
            <category><![CDATA[credentials]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[Flare]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:04:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[59 KEV Entries Quietly Flagged for Ransomware Use in 2025]]></title>
            <description><![CDATA[GreyNoise reveals CISA silently updated ransomware indicators on 59 vulnerabilities without alerts. New RSS feed tool catches changes within an hour.]]></description>
            <link>https://www.probablypwned.com/article/greynoise-cisa-kev-ransomware-silent-updates-rss-tool</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/greynoise-cisa-kev-ransomware-silent-updates-rss-tool</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[GreyNoise]]></category>
            <category><![CDATA[vulnerability management]]></category>
            <category><![CDATA[patching]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds SolarWinds, Sangoma, GitLab Flaws to KEV]]></title>
            <description><![CDATA[Four actively exploited vulnerabilities added to CISA's catalog including SolarWinds Web Help Desk deserialization flaw with CVSS 9.8. Federal agencies have until February 6 to patch.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-solarwinds-sangoma-gitlab-february-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-solarwinds-sangoma-gitlab-february-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[Sangoma FreePBX]]></category>
            <category><![CDATA[GitLab]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:03:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Looker Flaws Let Attackers Hijack BI Servers]]></title>
            <description><![CDATA[Tenable discloses 'LookOut' vulnerabilities in Google Looker enabling remote code execution and full database theft. Self-hosted deployments at 60,000+ organizations exposed.]]></description>
            <link>https://www.probablypwned.com/article/google-looker-lookout-vulnerabilities-cve-2025-12743-rce-database</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-looker-lookout-vulnerabilities-cve-2025-12743-rce-database</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Google Looker]]></category>
            <category><![CDATA[CVE-2025-12743]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[database theft]]></category>
            <category><![CDATA[Tenable]]></category>
            <category><![CDATA[business intelligence]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:03:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco's ACE Framework Cuts LLM Token Costs by Up to 90%]]></title>
            <description><![CDATA[Analytics Context Engineering addresses three failure modes when LLMs process machine data, delivering dramatic token savings and accuracy gains.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ace-analytics-context-engineering-llm-token-reduction</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ace-analytics-context-engineering-llm-token-reduction</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[LLM]]></category>
            <category><![CDATA[context engineering]]></category>
            <category><![CDATA[observability]]></category>
            <category><![CDATA[AI agents]]></category>
            <dc:creator><![CDATA[David Okonkwo]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 11:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OWASP Top 10 Explained: Critical Web Application Security Risks]]></title>
            <description><![CDATA[The OWASP Top 10 lists the most critical web application security vulnerabilities. Learn what each risk means, see real-world examples, and understand how to protect your applications.]]></description>
            <link>https://www.probablypwned.com/article/owasp-top-10-2025-web-application-security-risks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/owasp-top-10-2025-web-application-security-risks</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OWASP Top 10]]></category>
            <category><![CDATA[web application security]]></category>
            <category><![CDATA[vulnerabilities]]></category>
            <category><![CDATA[secure coding]]></category>
            <category><![CDATA[application security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 01:02:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cybersecurity's Talent Crisis Puts STEM Education in the Spotlight]]></title>
            <description><![CDATA[With 4.8 million cybersecurity jobs unfilled globally, STEM programs from K-12 through career training are racing to close the gap.]]></description>
            <link>https://www.probablypwned.com/article/stem-education-cybersecurity-workforce-cisco-academy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stem-education-cybersecurity-workforce-cisco-academy</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[STEM education]]></category>
            <category><![CDATA[cybersecurity workforce]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[career development]]></category>
            <category><![CDATA[training]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WhatsApp Bug Lets Malicious Media Spread via Group Chats]]></title>
            <description><![CDATA[Researchers disclose zero-click attack vector on Android where adding a user to a group can trigger malware execution through manipulated media files.]]></description>
            <link>https://www.probablypwned.com/article/whatsapp-group-chat-media-vulnerability-zero-click</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/whatsapp-group-chat-media-vulnerability-zero-click</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[zero-click]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[mobile security]]></category>
            <category><![CDATA[Meta]]></category>
            <category><![CDATA[vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 13:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Breaches Tulsa International Airport]]></title>
            <description><![CDATA[Russian-linked gang dumps executive emails, employee IDs, and banking communications in first airline sector attack of 2026.]]></description>
            <link>https://www.probablypwned.com/article/qilin-ransomware-tulsa-airport-aviation-sector-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/qilin-ransomware-tulsa-airport-aviation-sector-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[aviation]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Russia]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 13:04:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[341 Malicious OpenClaw Skills Distribute Atomic Stealer]]></title>
            <description><![CDATA[Security researchers uncover ClawHavoc campaign distributing Atomic Stealer through fake cryptocurrency and productivity tools on ClawHub marketplace.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-clawhub-malicious-skills-atomic-stealer-crypto</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-clawhub-malicious-skills-atomic-stealer-crypto</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[ClawHub]]></category>
            <category><![CDATA[Atomic Stealer]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[AI agent]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 13:03:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Notepad++ Update Hijacked by Chinese APT for Six Months]]></title>
            <description><![CDATA[Violet Typhoon compromised the text editor's hosting provider to redirect updates to malicious servers targeting telecom and financial firms.]]></description>
            <link>https://www.probablypwned.com/article/notepad-plus-plus-supply-chain-attack-violet-typhoon-apt31</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/notepad-plus-plus-supply-chain-attack-violet-typhoon-apt31</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Notepad++]]></category>
            <category><![CDATA[Violet Typhoon]]></category>
            <category><![CDATA[APT31]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Lotus Blossom]]></category>
            <category><![CDATA[Chrysalis]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 13:03:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[New Tools Help Defenders Track OpenClaw AI Agent Activity]]></title>
            <description><![CDATA[SANS ISC highlights openclaw-detect and openclaw-telemetry tools as security teams scramble to monitor the viral AI assistant amid ongoing vulnerability disclosures.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-detection-monitoring-tools-sans-isc-telemetry</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-detection-monitoring-tools-sans-isc-telemetry</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[AI agents]]></category>
            <category><![CDATA[detection]]></category>
            <category><![CDATA[SIEM integration]]></category>
            <category><![CDATA[security monitoring]]></category>
            <dc:creator><![CDATA[David Okonkwo]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Scan for Exposed Self-Hosted Anthropic Models]]></title>
            <description><![CDATA[SANS ISC detects reconnaissance activity targeting locally hosted Claude API endpoints. Researchers warn of growing risk from misconfigured AI deployments.]]></description>
            <link>https://www.probablypwned.com/article/anthropic-api-scanning-exposed-self-hosted-models-sans</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/anthropic-api-scanning-exposed-self-hosted-models-sans</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[Claude]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[API exposure]]></category>
            <category><![CDATA[self-hosted LLM]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrossCurve Bridge Drained of $3M in Smart Contract Exploit]]></title>
            <description><![CDATA[Attackers exploited a validation flaw to send spoofed cross-chain messages and unlock tokens across Ethereum, Arbitrum, and six other networks.]]></description>
            <link>https://www.probablypwned.com/article/crosscurve-bridge-exploit-3-million-smart-contract-vulnerability</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crosscurve-bridge-exploit-3-million-smart-contract-vulnerability</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CrossCurve]]></category>
            <category><![CDATA[DeFi]]></category>
            <category><![CDATA[smart contract]]></category>
            <category><![CDATA[bridge exploit]]></category>
            <category><![CDATA[Ethereum]]></category>
            <category><![CDATA[Arbitrum]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 13:07:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Leaks 10M Records from Tinder, Hinge, OkCupid]]></title>
            <description><![CDATA[Match Group confirms breach after ShinyHunters dumps 1.7GB of user data. Attackers used voice phishing to compromise an Okta SSO account.]]></description>
            <link>https://www.probablypwned.com/article/match-group-tinder-hinge-breach-shinyhunters-10-million-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/match-group-tinder-hinge-breach-shinyhunters-10-million-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Match Group]]></category>
            <category><![CDATA[Tinder]]></category>
            <category><![CDATA[Hinge]]></category>
            <category><![CDATA[OkCupid]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[SSO]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 13:06:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA KEV Deadline Hits Today for Unpatched Gogs Zero-Day]]></title>
            <description><![CDATA[CVE-2025-8110 allows authenticated attackers to achieve RCE on self-hosted Git servers via path traversal. Over 700 instances already compromised.]]></description>
            <link>https://www.probablypwned.com/article/gogs-cve-2025-8110-zero-day-rce-cisa-kev-no-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gogs-cve-2025-8110-zero-day-rce-cisa-kev-no-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-8110]]></category>
            <category><![CDATA[Gogs]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[Git]]></category>
            <category><![CDATA[path traversal]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 13:05:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is Phishing? Types of Attacks and How to Spot Them]]></title>
            <description><![CDATA[Learn what phishing is, the different types of phishing attacks (email, SMS, voice), red flags to watch for, and how to protect yourself from scams.]]></description>
            <link>https://www.probablypwned.com/article/what-is-phishing-types-how-to-spot-prevent</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-phishing-types-how-to-spot-prevent</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[email security]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <category><![CDATA[scams]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 01:02:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[208,000 MongoDB Servers Exposed, 1,400 Already Hit by Extortion]]></title>
            <description><![CDATA[Flare researchers find a single threat actor wiping misconfigured MongoDB databases and demanding $500 Bitcoin ransoms. Nearly half of unauthenticated instances already compromised.]]></description>
            <link>https://www.probablypwned.com/article/mongodb-exposed-instances-data-extortion-attacks-flare</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mongodb-exposed-instances-data-extortion-attacks-flare</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[MongoDB]]></category>
            <category><![CDATA[data extortion]]></category>
            <category><![CDATA[database security]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Flare]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 01 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Redis RCE Exploit More Severe Than Initially Rated]]></title>
            <description><![CDATA[JFrog researchers develop working remote code execution exploit for CVE-2025-62507, a stack buffer overflow in Redis discovered by Google's AI security agent.]]></description>
            <link>https://www.probablypwned.com/article/redis-cve-2025-62507-rce-exploit-jfrog</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/redis-cve-2025-62507-rce-exploit-jfrog</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Redis]]></category>
            <category><![CDATA[CVE-2025-62507]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[buffer-overflow]]></category>
            <category><![CDATA[AI-discovered]]></category>
            <category><![CDATA[database]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 01 Feb 2026 13:08:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iconics SCADA Flaw Allows System File Corruption]]></title>
            <description><![CDATA[CVE-2025-0921 enables privileged file system operations that can disrupt industrial control systems in automotive, energy, and manufacturing environments.]]></description>
            <link>https://www.probablypwned.com/article/iconics-scada-cve-2025-0921-file-system-dos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iconics-scada-cve-2025-0921-file-system-dos</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SCADA]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[CVE-2025-0921]]></category>
            <category><![CDATA[Iconics]]></category>
            <category><![CDATA[OT]]></category>
            <category><![CDATA[industrial-control]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 01 Feb 2026 13:08:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Deploys Rust-Based RAT in Middle East Campaign]]></title>
            <description><![CDATA[Iranian APT group shifts tactics with RustyWater implant targeting diplomatic, financial, and telecom sectors across the Middle East via spear-phishing.]]></description>
            <link>https://www.probablypwned.com/article/muddywater-rustywater-rust-rat-middle-east-spearphishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/muddywater-rustywater-rust-rat-middle-east-spearphishing</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[RustyWater]]></category>
            <category><![CDATA[Rust]]></category>
            <category><![CDATA[Middle East]]></category>
            <category><![CDATA[spear-phishing]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 01 Feb 2026 13:07:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RedKitten Malware Targets Iranian Protest Documenters]]></title>
            <description><![CDATA[French researchers uncover SloppyMIO, an AI-assisted malware campaign using fabricated victim lists to target individuals documenting human rights abuses during Iranian protests.]]></description>
            <link>https://www.probablypwned.com/article/redkitten-sloppymio-malware-iran-protests</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/redkitten-sloppymio-malware-iran-protests</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[SloppyMIO]]></category>
            <category><![CDATA[RedKitten]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[human rights]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 13:05:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SHADOW#REACTOR: Multi-Stage Remcos RAT Hits Enterprises]]></title>
            <description><![CDATA[Security researchers expose an active campaign using layered evasion techniques to deliver Remcos RAT through MSBuild abuse and .NET Reactor-protected loaders.]]></description>
            <link>https://www.probablypwned.com/article/remcos-rat-shadow-reactor-multi-stage-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/remcos-rat-shadow-reactor-multi-stage-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Remcos RAT]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[initial access broker]]></category>
            <category><![CDATA[LOLBin]]></category>
            <category><![CDATA[evasion]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 13:04:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco ISE XXE Flaw Has Public PoC, Patch Now]]></title>
            <description><![CDATA[Cisco patches CVE-2026-20029, an XML external entity vulnerability in Identity Services Engine with proof-of-concept exploit code already publicly available.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ise-xxe-cve-2026-20029-poc-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ise-xxe-cve-2026-20029-poc-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20029]]></category>
            <category><![CDATA[XXE]]></category>
            <category><![CDATA[ISE]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[exploit]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 13:04:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Dismantles IPIDEA Proxy Network Used by 550+ APTs]]></title>
            <description><![CDATA[Google Threat Intelligence Group disrupts one of the world's largest residential proxy networks, cutting off infrastructure used by nation-state actors from China, Russia, Iran, and North Korea.]]></description>
            <link>https://www.probablypwned.com/article/google-ipidea-residential-proxy-network-disruption</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-ipidea-residential-proxy-network-disruption</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[proxy network]]></category>
            <category><![CDATA[residential proxy]]></category>
            <category><![CDATA[threat actors]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[malware infrastructure]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 13:03:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ex-Google Engineer Convicted in First US AI Espionage Case]]></title>
            <description><![CDATA[Federal jury convicts Linwei Ding on 14 counts of economic espionage and trade secret theft for stealing Google's AI infrastructure secrets for China.]]></description>
            <link>https://www.probablypwned.com/article/linwei-ding-google-ai-trade-secrets-china-conviction</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/linwei-ding-google-ai-trade-secrets-china-conviction</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[trade-secrets]]></category>
            <category><![CDATA[insider-threat]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 10:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is Ransomware? How It Works and How to Protect Yourself]]></title>
            <description><![CDATA[Learn what ransomware is, how attacks work, the main types including double extortion, and practical steps to defend against this growing threat.]]></description>
            <link>https://www.probablypwned.com/article/what-is-ransomware-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-ransomware-guide</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <category><![CDATA[data protection]]></category>
            <category><![CDATA[extortion]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 01:01:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Top 5 Threat Intelligence Data APIs for Security Teams]]></title>
            <description><![CDATA[The best threat intelligence APIs for enriching IOCs, detecting malware, and integrating threat data into your SIEM and security workflows.]]></description>
            <link>https://www.probablypwned.com/article/top-5-threat-intelligence-data-apis-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/top-5-threat-intelligence-data-apis-2026</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[threat-intelligence]]></category>
            <category><![CDATA[API]]></category>
            <category><![CDATA[SIEM]]></category>
            <category><![CDATA[IOC]]></category>
            <category><![CDATA[security-tools]]></category>
            <dc:creator><![CDATA[David Okonkwo]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 19:24:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco DevNet Spotlights Partner-Built Security Integrations]]></title>
            <description><![CDATA[January's Month of Partner Innovation showcases PagerDuty alerting, Meraki backup tools, and cloud migration capabilities built on Cisco APIs.]]></description>
            <link>https://www.probablypwned.com/article/cisco-devnet-partner-innovation-month-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-devnet-partner-innovation-month-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[DevNet]]></category>
            <category><![CDATA[Meraki]]></category>
            <category><![CDATA[PagerDuty]]></category>
            <category><![CDATA[partner ecosystem]]></category>
            <category><![CDATA[API security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Phishers Hide Behind Google Slides Publish Feature]]></title>
            <description><![CDATA[Attackers exploit Google Presentations' publish mode to host phishing pages that bypass Google's own security warnings, targeting Vivaldi Webmail users.]]></description>
            <link>https://www.probablypwned.com/article/google-slides-publish-phishing-vivaldi-webmail</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-slides-publish-phishing-vivaldi-webmail</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Google Slides]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Vivaldi]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SolarWinds Web Help Desk Gets Emergency Patches for Four Critical Flaws]]></title>
            <description><![CDATA[Deserialization bugs and authentication bypasses enable unauthenticated RCE. Attackers have targeted WHD vulnerabilities before.]]></description>
            <link>https://www.probablypwned.com/article/solarwinds-web-help-desk-critical-rce-auth-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/solarwinds-web-help-desk-critical-rce-auth-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[Web Help Desk]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[authentication-bypass]]></category>
            <category><![CDATA[deserialization]]></category>
            <category><![CDATA[CVSS-9.8]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 13:11:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran's Hacktivists Were State Actors All Along, CSIS Report Finds]]></title>
            <description><![CDATA[Analysis reveals CyberAv3ngers and other 'hacktivist' groups targeting US infrastructure are actually IRGC-controlled operations masquerading as ideological actors.]]></description>
            <link>https://www.probablypwned.com/article/iran-apt-cyberav3ngers-hacktivist-state-sponsored-csis</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-apt-cyberav3ngers-hacktivist-state-sponsored-csis</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[CyberAv3ngers]]></category>
            <category><![CDATA[IRGC]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[hacktivist]]></category>
            <category><![CDATA[critical-infrastructure]]></category>
            <category><![CDATA[OT]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 13:09:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ivanti EPMM Zero-Days Under Attack, CISA Sets Friday Deadline]]></title>
            <description><![CDATA[Two critical code injection flaws in Ivanti Endpoint Manager Mobile enable unauthenticated RCE. Federal agencies must remediate by February 1.]]></description>
            <link>https://www.probablypwned.com/article/ivanti-epmm-zero-day-cve-2026-1281-cve-2026-1340-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ivanti-epmm-zero-day-cve-2026-1281-cve-2026-1340-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CVE-2026-1281]]></category>
            <category><![CDATA[CVE-2026-1340]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[mobile-device-management]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 13:08:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1512941937669-90a1b58e7e9c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1512941937669-90a1b58e7e9c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenSSL Stack Overflow Enables Remote Code Execution]]></title>
            <description><![CDATA[CVE-2025-15467 allows attackers to crash or compromise systems by sending malicious CMS messages. All AI-discovered in OpenSSL's largest coordinated security release.]]></description>
            <link>https://www.probablypwned.com/article/openssl-cve-2025-15467-stack-overflow-rce-ai-discovered</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openssl-cve-2025-15467-stack-overflow-rce-ai-discovered</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenSSL]]></category>
            <category><![CDATA[CVE-2025-15467]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[stack buffer overflow]]></category>
            <category><![CDATA[AISLE]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 29 Jan 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Sandbox Escape Flaws Allow Full Server Compromise]]></title>
            <description><![CDATA[JFrog discloses CVE-2026-1470 and CVE-2026-0863 in workflow automation platform. Both vulnerabilities enable authenticated remote code execution.]]></description>
            <link>https://www.probablypwned.com/article/n8n-sandbox-escape-cve-2026-1470-cve-2026-0863-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-sandbox-escape-cve-2026-1470-cve-2026-0863-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-1470]]></category>
            <category><![CDATA[CVE-2026-0863]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 29 Jan 2026 13:04:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ClickFix Attacks Now Abuse Windows App-V to Deliver Malware]]></title>
            <description><![CDATA[New campaign combines fake CAPTCHA pages with signed Microsoft scripts to bypass security tools and install Amatera infostealer on enterprise systems.]]></description>
            <link>https://www.probablypwned.com/article/clickfix-fake-captcha-appv-scripts-amatera-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clickfix-fake-captcha-appv-scripts-amatera-stealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Amatera]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[fake CAPTCHA]]></category>
            <category><![CDATA[App-V]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 29 Jan 2026 13:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mustang Panda Upgrades COOLCLIENT With Browser Credential Theft]]></title>
            <description><![CDATA[Chinese APT adds clipboard monitoring, browser stealing, and enhanced plugins to its long-running backdoor. Government entities in Asia remain primary targets.]]></description>
            <link>https://www.probablypwned.com/article/mustang-panda-coolclient-backdoor-infostealer-browser-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mustang-panda-coolclient-backdoor-infostealer-browser-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Mustang Panda]]></category>
            <category><![CDATA[COOLCLIENT]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[HoneyMyte]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 29 Jan 2026 13:03:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware's Evolution: From File Encryption to Psychological Warfare]]></title>
            <description><![CDATA[Modern ransomware gangs have weaponized fear, legal liability, and deadline pressure. Here's how extortion tactics have fundamentally changed.]]></description>
            <link>https://www.probablypwned.com/article/ransomware-psychology-extortion-tactics-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ransomware-psychology-extortion-tactics-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[threat-intelligence]]></category>
            <category><![CDATA[psychology]]></category>
            <category><![CDATA[double-extortion]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 28 Jan 2026 13:05:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Plugin Flaw Gives Attackers Admin Access Without Login]]></title>
            <description><![CDATA[CVE-2026-23550 in Modular DS plugin scores CVSS 10.0. Active exploitation began January 13, with 40,000+ sites at risk.]]></description>
            <link>https://www.probablypwned.com/article/wordpress-modular-ds-cve-2026-23550-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wordpress-modular-ds-cve-2026-23550-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-23550]]></category>
            <category><![CDATA[privilege-escalation]]></category>
            <category><![CDATA[Modular DS]]></category>
            <category><![CDATA[CVSS-10]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 28 Jan 2026 13:04:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet FortiCloud SSO Zero-Day Exploited to Hijack Firewalls]]></title>
            <description><![CDATA[CVE-2026-24858 allows attackers with FortiCloud accounts to log into other organizations' FortiGate devices. Patches rolling out now.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-forticloud-sso-zero-day-cve-2026-24858</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-forticloud-sso-zero-day-cve-2026-24858</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2026-24858]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[authentication-bypass]]></category>
            <category><![CDATA[FortiCloud]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 28 Jan 2026 13:03:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Data Privacy Week 2026 Kicks Off With AI and Children's Privacy Focus]]></title>
            <description><![CDATA[The NCA's annual campaign runs January 26-30 with daily sessions on AI chatbots, dynamic pricing, and the right to be forgotten.]]></description>
            <link>https://www.probablypwned.com/article/data-privacy-week-2026-take-control-of-your-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/data-privacy-week-2026-take-control-of-your-data</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[data privacy]]></category>
            <category><![CDATA[NCA]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[privacy rights]]></category>
            <category><![CDATA[children's privacy]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Tue, 27 Jan 2026 13:06:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SmarterMail Auth Bypass Lets Attackers Reset Admin Passwords]]></title>
            <description><![CDATA[CVE-2026-23760 enables unauthenticated admin takeover in SmarterMail. Exploitation began two days after patch release.]]></description>
            <link>https://www.probablypwned.com/article/smartermail-cve-2026-23760-admin-password-reset-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smartermail-cve-2026-23760-admin-password-reset-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-23760]]></category>
            <category><![CDATA[SmarterMail]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 27 Jan 2026 13:05:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Office Zero-Day Under Active Attack Gets Emergency Patch]]></title>
            <description><![CDATA[CVE-2026-21509 bypasses OLE security protections across Office 2016-2024. CISA adds it to KEV catalog with February 16 deadline.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-office-zero-day-cve-2026-21509-ole-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-office-zero-day-cve-2026-21509-ole-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-21509]]></category>
            <category><![CDATA[Office]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 27 Jan 2026 13:02:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064548016-0b5c13ca2c85?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064548016-0b5c13ca2c85?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Probes Windows 11 Boot Failures After January Patch]]></title>
            <description><![CDATA[KB5074109 update causing UNMOUNTABLE_BOOT_VOLUME errors on some Windows 11 devices. Physical machines affected; VMs appear unimpacted.]]></description>
            <link>https://www.probablypwned.com/article/windows-11-boot-failures-january-2026-patch-kb5074109</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/windows-11-boot-failures-january-2026-patch-kb5074109</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows 11]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[KB5074109]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[boot failure]]></category>
            <category><![CDATA[BSOD]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 26 Jan 2026 13:09:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea's Konni APT Deploys AI-Built Malware Against Devs]]></title>
            <description><![CDATA[Check Point uncovers Konni campaign using AI-generated PowerShell backdoors to target blockchain developers across Asia-Pacific. Marks shift from diplomatic espionage.]]></description>
            <link>https://www.probablypwned.com/article/konni-apt-ai-generated-powershell-malware-blockchain-developers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/konni-apt-ai-generated-powershell-malware-blockchain-developers</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Konni]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[blockchain]]></category>
            <category><![CDATA[Opal Sleet]]></category>
            <category><![CDATA[PowerShell]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 26 Jan 2026 13:08:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Firefox 147 Fixes 16 Vulnerabilities Including Sandbox Escapes]]></title>
            <description><![CDATA[Mozilla patches six high-severity flaws in Firefox 147 and ESR releases. Multiple sandbox escape vulnerabilities could enable arbitrary code execution.]]></description>
            <link>https://www.probablypwned.com/article/firefox-147-security-update-16-vulnerabilities-sandbox-escapes</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/firefox-147-security-update-16-vulnerabilities-sandbox-escapes</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Firefox]]></category>
            <category><![CDATA[Mozilla]]></category>
            <category><![CDATA[CVE-2026-0891]]></category>
            <category><![CDATA[CVE-2026-0892]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 26 Jan 2026 13:07:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Curl Ends Bug Bounty Program After AI Slop Floods Queue]]></title>
            <description><![CDATA[The ubiquitous command-line tool will stop accepting HackerOne submissions January 31. After $86K paid across 78 vulnerabilities, AI-generated noise made the program unsustainable.]]></description>
            <link>https://www.probablypwned.com/article/curl-ends-bug-bounty-ai-generated-reports</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/curl-ends-bug-bounty-ai-generated-reports</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[curl]]></category>
            <category><![CDATA[bug bounty]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[HackerOne]]></category>
            <category><![CDATA[security research]]></category>
            <category><![CDATA[open source]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 25 Jan 2026 13:05:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1531746790731-6c087fecd65a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1531746790731-6c087fecd65a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VSCode Extensions With 1.5M Installs Exfiltrate Code to China]]></title>
            <description><![CDATA[Two AI coding assistants on Microsoft's marketplace steal source code and credentials in real-time. Extensions use hidden iframes and analytics SDKs to profile developers.]]></description>
            <link>https://www.probablypwned.com/article/malicious-vscode-extensions-china-1-5-million-installs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/malicious-vscode-extensions-china-1-5-million-installs</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VSCode]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[developer tools]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[data theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 25 Jan 2026 13:04:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Vishing Campaign Targets Okta SSO Accounts]]></title>
            <description><![CDATA[Extortion group confirms voice phishing attacks stealing SSO credentials from Crunchbase, Betterment, and more. Custom phishing kits enable real-time MFA bypass.]]></description>
            <link>https://www.probablypwned.com/article/shinyhunters-vishing-okta-sso-crunchbase-betterment</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shinyhunters-vishing-okta-sso-crunchbase-betterment</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[Okta]]></category>
            <category><![CDATA[SSO]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 25 Jan 2026 13:04:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds VMware vCenter, Zimbra Flaws to Exploited List]]></title>
            <description><![CDATA[Five vulnerabilities added to CISA's KEV catalog this week. VMware vCenter RCE bug patched 18 months ago now seeing active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-vmware-vcenter-zimbra-versa-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-vmware-vcenter-zimbra-versa-january-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[VMware]]></category>
            <category><![CDATA[Zimbra]]></category>
            <category><![CDATA[CVE-2024-37079]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:05:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AitM Phishing Campaign Hits Energy Sector via SharePoint]]></title>
            <description><![CDATA[Microsoft disrupts multi-stage attack combining adversary-in-the-middle phishing with BEC. Attackers abused SharePoint and inbox rules for persistence.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-aitm-phishing-bec-energy-sector</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-aitm-phishing-bec-energy-sector</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[AitM]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[BEC]]></category>
            <category><![CDATA[energy sector]]></category>
            <category><![CDATA[SharePoint]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:05:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Osiris Ransomware Uses Custom Driver to Kill Security Tools]]></title>
            <description><![CDATA[New ransomware family employs BYOVD technique with POORTRY driver to disable endpoint protection. Evidence links operators to Inc ransomware campaigns.]]></description>
            <link>https://www.probablypwned.com/article/osiris-ransomware-byovd-poortry-driver</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/osiris-ransomware-byovd-poortry-driver</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Osiris]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[BYOVD]]></category>
            <category><![CDATA[POORTRY]]></category>
            <category><![CDATA[Inc ransomware]]></category>
            <category><![CDATA[EDR bypass]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:04:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[11-Year-Old Telnet Bug Hands Attackers Root Access]]></title>
            <description><![CDATA[CVE-2026-24061 allows remote authentication bypass in GNU InetUtils telnetd. Exploitation activity detected within hours of disclosure.]]></description>
            <link>https://www.probablypwned.com/article/cve-2026-24061-gnu-inetutils-telnetd-root-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cve-2026-24061-gnu-inetutils-telnetd-root-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-24061]]></category>
            <category><![CDATA[telnet]]></category>
            <category><![CDATA[GNU InetUtils]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Sandworm Deploys DynoWiper in Attack on Poland's Power Grid]]></title>
            <description><![CDATA[ESET researchers attribute December cyberattack on Polish energy infrastructure to Russian GRU hackers. Previously unknown wiper malware recovered.]]></description>
            <link>https://www.probablypwned.com/article/sandworm-dynowiper-poland-power-grid-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sandworm-dynowiper-poland-power-grid-attack</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Sandworm]]></category>
            <category><![CDATA[APT44]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[wiper malware]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[Poland]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:03:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1473341304170-971dccb5ac1e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1473341304170-971dccb5ac1e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiGate Patch Fails: Attackers Still Exploiting SSO Bypass]]></title>
            <description><![CDATA[Arctic Wolf reports automated attacks creating rogue admin accounts on supposedly patched FortiGate devices. Fortinet acknowledges incomplete fix.]]></description>
            <link>https://www.probablypwned.com/article/fortigate-patch-bypass-cve-2025-59718-attacks-continue</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortigate-patch-bypass-cve-2025-59718-attacks-continue</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2025-59718]]></category>
            <category><![CDATA[FortiGate]]></category>
            <category><![CDATA[patch bypass]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 23 Jan 2026 13:06:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pwn2Own Automotive 2026 Ends With 76 Zero-Days, $1M+ Awarded]]></title>
            <description><![CDATA[Fuzzware.io claims Master of Pwn at Tokyo competition after researchers demonstrate record-breaking exploits against Tesla, EV chargers, and infotainment systems.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-automotive-2026-final-76-zero-days-master-of-pwn</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-automotive-2026-final-76-zero-days-master-of-pwn</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[automotive security]]></category>
            <category><![CDATA[EV chargers]]></category>
            <category><![CDATA[Tesla]]></category>
            <category><![CDATA[Master of Pwn]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 23 Jan 2026 13:05:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1553260168-4cb5dafc1108?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1553260168-4cb5dafc1108?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russia's Fancy Bear Running Low-Cost Credential Theft Across Three Continents]]></title>
            <description><![CDATA[Recorded Future tracks APT28 harvesting credentials from energy, defense, and government targets in the Balkans, Middle East, and Central Asia using free hosting infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/apt28-fancy-bear-credential-harvesting-balkans-central-asia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-fancy-bear-credential-harvesting-balkans-central-asia</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[Fancy Bear]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[GRU]]></category>
            <category><![CDATA[credential harvesting]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 22 Jan 2026 13:08:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LastPass Warns of Phishing Campaign Targeting Master Passwords]]></title>
            <description><![CDATA[Fake maintenance emails urge users to backup their vaults before a deadline, redirecting victims to credential-harvesting sites. The campaign launched over MLK weekend.]]></description>
            <link>https://www.probablypwned.com/article/lastpass-phishing-campaign-vault-backup-master-password</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lastpass-phishing-campaign-vault-backup-master-password</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[LastPass]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[password manager]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 22 Jan 2026 13:08:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pwn2Own Automotive 2026 Day Two: 66 Zero-Days, $955K in Prizes]]></title>
            <description><![CDATA[Researchers demonstrated 29 new zero-day exploits on Day Two at Pwn2Own Automotive in Tokyo, targeting EV chargers, infotainment systems, and Automotive Grade Linux.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-automotive-2026-day-two-66-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-automotive-2026-day-two-66-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[automotive security]]></category>
            <category><![CDATA[EV chargers]]></category>
            <category><![CDATA[Tesla]]></category>
            <category><![CDATA[IVI]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 22 Jan 2026 13:07:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1549317661-bd32c8ce0db2?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1549317661-bd32c8ce0db2?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Zoom Patches CVSS 9.9 Flaw That Let Meeting Participants Run Code]]></title>
            <description><![CDATA[CVE-2026-22844 allowed meeting participants to execute arbitrary code on Zoom's on-premises multimedia routers. No active exploitation reported yet.]]></description>
            <link>https://www.probablypwned.com/article/zoom-mmr-cve-2026-22844-critical-rce-meeting-participant</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zoom-mmr-cve-2026-22844-critical-rce-meeting-participant</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-22844]]></category>
            <category><![CDATA[Zoom]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 22 Jan 2026 13:06:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587825140708-dfaf72ae4b04?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587825140708-dfaf72ae4b04?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Ad Blocker Crashes Browsers to Deploy Enterprise Backdoor]]></title>
            <description><![CDATA[The NexShield Chrome extension impersonated uBlock Origin's developer and used ClickFix techniques to deliver ModeloRAT malware to corporate networks.]]></description>
            <link>https://www.probablypwned.com/article/nexshield-crashfix-chrome-extension-modelorat-enterprise</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nexshield-crashfix-chrome-extension-modelorat-enterprise</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[ModeloRAT]]></category>
            <category><![CDATA[CrashFix]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[KongTuke]]></category>
            <category><![CDATA[enterprise malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 21 Jan 2026 13:09:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress ACF Extended Bug Lets Anyone Become Admin]]></title>
            <description><![CDATA[CVE-2025-14533 in the ACF Extended plugin allows unauthenticated attackers to register as administrators on 100,000 WordPress sites.]]></description>
            <link>https://www.probablypwned.com/article/acf-extended-wordpress-cve-2025-14533-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/acf-extended-wordpress-cve-2025-14533-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-14533]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[ACF Extended]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[admin takeover]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 21 Jan 2026 13:08:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507238691740-187a5b1d37b8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507238691740-187a5b1d37b8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pwn2Own Automotive Day One: Tesla Hacked, $516K Awarded]]></title>
            <description><![CDATA[Researchers exploited 37 zero-day vulnerabilities in Tesla systems, EV chargers, and infotainment units during the first day of Pwn2Own Automotive 2026 in Tokyo.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-automotive-2026-day-one-tesla-37-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-automotive-2026-day-one-tesla-37-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[Tesla]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[automotive security]]></category>
            <category><![CDATA[EV chargers]]></category>
            <category><![CDATA[bug bounty]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 21 Jan 2026 13:07:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1593941707874-ef25b8b4a92b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1593941707874-ef25b8b4a92b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EU Proposes Cybersecurity Overhaul to Counter Supply Chain Risks]]></title>
            <description><![CDATA[The European Commission's revised Cybersecurity Act expands ENISA's powers and creates a framework to restrict high-risk technology suppliers.]]></description>
            <link>https://www.probablypwned.com/article/eu-cybersecurity-act-revision-enisa-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/eu-cybersecurity-act-revision-enisa-supply-chain</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[EU]]></category>
            <category><![CDATA[ENISA]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[cybersecurity policy]]></category>
            <category><![CDATA[Huawei]]></category>
            <category><![CDATA[regulation]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 21 Jan 2026 13:07:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1519389950473-47ba0277781c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1519389950473-47ba0277781c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Best Cybersecurity Tools on Amazon for Security Professionals]]></title>
            <description><![CDATA[Essential hardware security tools every pentester and security professional needs. From YubiKeys to WiFi adapters, these Amazon picks protect your digital life.]]></description>
            <link>https://www.probablypwned.com/article/best-cybersecurity-tools-amazon-2025</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/best-cybersecurity-tools-amazon-2025</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[hardware-security]]></category>
            <category><![CDATA[penetration-testing]]></category>
            <category><![CDATA[YubiKey]]></category>
            <category><![CDATA[security-tools]]></category>
            <category><![CDATA[Amazon]]></category>
            <dc:creator><![CDATA[David Okonkwo]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Warns Ransomware Groups Targeting SimpleHelp RMM]]></title>
            <description><![CDATA[DragonForce and other actors exploiting CVE-2024-57727 to compromise utility billing providers and their downstream customers.]]></description>
            <link>https://www.probablypwned.com/article/cisa-simplehelp-ransomware-utility-billing-dragonforce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-simplehelp-ransomware-utility-billing-dragonforce</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[SimpleHelp]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[DragonForce]]></category>
            <category><![CDATA[RMM]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 13:05:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PDFSider Backdoor Hits Fortune 100 Firm, Linked to Qilin]]></title>
            <description><![CDATA[Resecurity uncovers stealthy DLL-sideloading malware with APT-grade anti-VM tricks. Multiple ransomware groups now deploying it.]]></description>
            <link>https://www.probablypwned.com/article/pdfsider-malware-fortune-100-qilin-ransomware-dll-sideload</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pdfsider-malware-fortune-100-qilin-ransomware-dll-sideload</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PDFSider]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[finance]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 13:04:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ingram Micro Confirms Ransomware Breach Affecting 42,000]]></title>
            <description><![CDATA[SafePay ransomware group allegedly stole 3.5TB from the $48B IT distributor. Employee SSNs, passports, and performance reviews exposed.]]></description>
            <link>https://www.probablypwned.com/article/ingram-micro-ransomware-breach-42000-employees-safepay</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ingram-micro-ransomware-breach-42000-employees-safepay</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Ingram Micro]]></category>
            <category><![CDATA[SafePay]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 13:04:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1568952433726-3896e3881c65?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1568952433726-3896e3881c65?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Oracle Patches 336 Vulnerabilities in January 2026 CPU]]></title>
            <description><![CDATA[Multiple CVSS 10.0 flaws affect Commerce, Communications, and PeopleSoft. MySQL patches include a critical 9.8-severity bug.]]></description>
            <link>https://www.probablypwned.com/article/oracle-critical-patch-update-january-2026-336-vulnerabilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-critical-patch-update-january-2026-336-vulnerabilities</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[Critical Patch Update]]></category>
            <category><![CDATA[MySQL]]></category>
            <category><![CDATA[Java]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 13:03:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apache Struts XXE Flaw Exposes Enterprise Apps to Data Theft]]></title>
            <description><![CDATA[CVE-2025-68493 in the XWork component enables XML External Entity attacks that can leak files, perform SSRF, or crash systems. Patch to version 6.1.1.]]></description>
            <link>https://www.probablypwned.com/article/apache-struts-xxe-cve-2025-68493-sensitive-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apache-struts-xxe-cve-2025-68493-sensitive-data</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache Struts]]></category>
            <category><![CDATA[CVE-2025-68493]]></category>
            <category><![CDATA[XXE]]></category>
            <category><![CDATA[Java]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 19 Jan 2026 13:05:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical zlib Buffer Overflow Threatens Widespread Systems]]></title>
            <description><![CDATA[CVE-2026-22184 allows attackers to trigger memory corruption via an oversized archive name in zlib's untgz utility. No patch existed at initial disclosure.]]></description>
            <link>https://www.probablypwned.com/article/zlib-untgz-buffer-overflow-cve-2026-22184</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zlib-untgz-buffer-overflow-cve-2026-22184</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[zlib]]></category>
            <category><![CDATA[CVE-2026-22184]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <category><![CDATA[memory corruption]]></category>
            <category><![CDATA[open source]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 19 Jan 2026 13:05:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BreachForums Database Leaked, Exposing 324K Users]]></title>
            <description><![CDATA[A backup misconfiguration led to the exposure of nearly 324,000 user records from the notorious hacking forum, including usernames, hashed passwords, and IP addresses.]]></description>
            <link>https://www.probablypwned.com/article/breachforums-database-leak-324000-cybercriminal-users</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/breachforums-database-leak-324000-cybercriminal-users</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[BreachForums]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[cybercrime]]></category>
            <category><![CDATA[hacking forum]]></category>
            <category><![CDATA[irony]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 19 Jan 2026 13:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Releases 10 ICS Advisories for Siemens, Schneider, Others]]></title>
            <description><![CDATA[Industrial control system vulnerabilities disclosed in Siemens RUGGEDCOM, Industrial Edge devices, Schneider EcoStruxure, AVEVA, and Festo products.]]></description>
            <link>https://www.probablypwned.com/article/cisa-ics-advisories-siemens-schneider-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-ics-advisories-siemens-schneider-january-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[Siemens]]></category>
            <category><![CDATA[Schneider Electric]]></category>
            <category><![CDATA[AVEVA]]></category>
            <category><![CDATA[Festo]]></category>
            <category><![CDATA[OT security]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 14:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Shadow AI Drives 2x Surge in Enterprise Data Violations]]></title>
            <description><![CDATA[Netskope report finds organizations average 223 GenAI policy incidents monthly as employees use personal accounts to access AI tools outside corporate controls.]]></description>
            <link>https://www.probablypwned.com/article/netskope-shadow-ai-genai-data-violations-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/netskope-shadow-ai-genai-data-violations-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[GenAI]]></category>
            <category><![CDATA[shadow AI]]></category>
            <category><![CDATA[data leakage]]></category>
            <category><![CDATA[Netskope]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[policy violations]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 13:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Announces Ads Coming to ChatGPT Free Tier]]></title>
            <description><![CDATA[AI company will begin testing advertisements in ChatGPT for US users in coming weeks, projecting $1 billion in ad revenue by end of 2026.]]></description>
            <link>https://www.probablypwned.com/article/openai-chatgpt-ads-free-users-privacy-concerns</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-chatgpt-ads-free-users-privacy-concerns</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[advertising]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[privacy]]></category>
            <category><![CDATA[monetization]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 11:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI: BadBox 2.0 Malware Pre-Installed on 1M+ Android Devices]]></title>
            <description><![CDATA[Budget Android TV boxes and tablets ship with backdoors from the factory, turning home networks into criminal infrastructure for ad fraud and proxy services.]]></description>
            <link>https://www.probablypwned.com/article/fbi-badbox-2-android-malware-million-devices</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-badbox-2-android-malware-million-devices</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[BadBox]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 10:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran-Linked Hackers Target Middle East Officials via WhatsApp]]></title>
            <description><![CDATA[APT42 campaign compromises government ministers, activists, and journalists through fake login pages and real-time surveillance capabilities.]]></description>
            <link>https://www.probablypwned.com/article/apt42-iran-whatsapp-gmail-middle-east-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt42-iran-whatsapp-gmail-middle-east-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT42]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[Gmail]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[IRGC]]></category>
            <category><![CDATA[Middle East]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TamperedChef Infostealer Hides in Fake PDF Editors via Google Ads]]></title>
            <description><![CDATA[Sophos exposes malvertising campaign that stayed dormant for 56 days before activating credential theft across 50+ fraudulent domains.]]></description>
            <link>https://www.probablypwned.com/article/tamperedchef-malvertising-pdf-infostealer-google-ads</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tamperedchef-malvertising-pdf-infostealer-google-ads</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TamperedChef]]></category>
            <category><![CDATA[malvertising]]></category>
            <category><![CDATA[Google Ads]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[PDF]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 16:58:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Astaroth Banking Trojan Spreads via WhatsApp Worm in Brazil]]></title>
            <description><![CDATA[New Boto Cor-de-Rosa campaign uses Python-based worm module to auto-send malware through victims' WhatsApp contacts.]]></description>
            <link>https://www.probablypwned.com/article/astaroth-whatsapp-worm-brazil-boto-cor-de-rosa</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/astaroth-whatsapp-worm-brazil-boto-cor-de-rosa</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Astaroth]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[Brazil]]></category>
            <category><![CDATA[worm]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 16:57:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Black Cat Infects 278,000 Hosts in China via SEO Poisoning]]></title>
            <description><![CDATA[Cybercrime group uses fake software downloads and malicious Bing ads to deploy infostealer malware at scale across Chinese systems.]]></description>
            <link>https://www.probablypwned.com/article/black-cat-seo-poisoning-china-278000-hosts-infected</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/black-cat-seo-poisoning-china-278000-hosts-infected</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Black Cat]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <category><![CDATA[malvertising]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[China]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 16:57:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SHADOW#REACTOR Campaign Drops Remcos RAT via MSBuild]]></title>
            <description><![CDATA[Multi-stage malware campaign uses text-based stagers and living-off-the-land binaries to deliver Remcos RAT to enterprise targets.]]></description>
            <link>https://www.probablypwned.com/article/shadow-reactor-remcos-rat-msbuild-enterprise-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shadow-reactor-remcos-rat-msbuild-enterprise-attacks</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Remcos RAT]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[SHADOW#REACTOR]]></category>
            <category><![CDATA[MSBuild]]></category>
            <category><![CDATA[initial access broker]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 16:56:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Extensions Target Workday and NetSuite for Session Theft]]></title>
            <description><![CDATA[Five malicious extensions masquerading as HR tools steal authentication tokens, block security panels, and enable account takeover through cookie injection.]]></description>
            <link>https://www.probablypwned.com/article/chrome-extensions-workday-netsuite-session-hijacking</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-extensions-workday-netsuite-session-hijacking</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[Workday]]></category>
            <category><![CDATA[NetSuite]]></category>
            <category><![CDATA[session hijacking]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 15:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[StealC XSS Flaw Let Researchers Monitor Malware Operators]]></title>
            <description><![CDATA[CyberArk exploited a vulnerability in the StealC infostealer's control panel to identify threat actors, steal session cookies, and track an operator who compromised 5,000 victims.]]></description>
            <link>https://www.probablypwned.com/article/stealc-xss-vulnerability-researchers-hack-hackers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stealc-xss-vulnerability-researchers-hack-hackers</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[StealC]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <category><![CDATA[CyberArk]]></category>
            <category><![CDATA[malware research]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 14:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Reprompt Attack Turned Microsoft Copilot Into a Data Thief]]></title>
            <description><![CDATA[Varonis researchers disclosed a vulnerability chain that let attackers exfiltrate user data through Copilot with a single malicious link click. Microsoft has patched the issue.]]></description>
            <link>https://www.probablypwned.com/article/reprompt-attack-microsoft-copilot-single-click-exfiltration</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/reprompt-attack-microsoft-copilot-single-click-exfiltration</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Copilot]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[data exfiltration]]></category>
            <category><![CDATA[Varonis]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 13:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Victoria Education Breach Exposes Student Data at 1,700 Schools]]></title>
            <description><![CDATA[Australian government schools confirm hackers accessed student names, emails, and encrypted passwords. VCE students prioritized for credential resets before school year.]]></description>
            <link>https://www.probablypwned.com/article/victorian-education-breach-1700-schools-student-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/victorian-education-breach-1700-schools-student-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Australia]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[student data]]></category>
            <category><![CDATA[Victoria]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 11:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580582932707-520aed937b7b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580582932707-520aed937b7b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Black Basta Leader Oleg Nefedov Added to Interpol Wanted List]]></title>
            <description><![CDATA[German and Ukrainian authorities identify 35-year-old Russian national as Black Basta boss, raid homes of two affiliates in Ukraine.]]></description>
            <link>https://www.probablypwned.com/article/black-basta-leader-oleg-nefedov-interpol-red-notice</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/black-basta-leader-oleg-nefedov-interpol-red-notice</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Black Basta]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Interpol]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Europol]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 10:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1589994965851-a8f479c573a9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1589994965851-a8f479c573a9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China-Linked UAT-8837 Exploits Sitecore Zero-Day in US Attacks]]></title>
            <description><![CDATA[Cisco Talos exposes China-nexus APT targeting critical infrastructure with CVE-2025-53690 exploitation, credential harvesting, and potential supply chain compromise.]]></description>
            <link>https://www.probablypwned.com/article/uat-8837-china-apt-sitecore-zero-day-north-america</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-8837-china-apt-sitecore-zero-day-north-america</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[UAT-8837]]></category>
            <category><![CDATA[Sitecore]]></category>
            <category><![CDATA[CVE-2025-53690]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Patches Email Gateway Zero-Day Exploited by Chinese APT]]></title>
            <description><![CDATA[AsyncOS fixes released for CVE-2025-20393 after weeks of active exploitation. Compromised appliances require full rebuild to remove persistent backdoors.]]></description>
            <link>https://www.probablypwned.com/article/cisco-asyncos-cve-2025-20393-patch-released</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-asyncos-cve-2025-20393-patch-released</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2025-20393]]></category>
            <category><![CDATA[AsyncOS]]></category>
            <category><![CDATA[patch]]></category>
            <category><![CDATA[UAT-9686]]></category>
            <category><![CDATA[China APT]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 14:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gootloader Malware Uses 1,000 Stacked ZIPs to Dodge Detection]]></title>
            <description><![CDATA[The initial access malware now delivers payloads through deliberately malformed archives that crash security tools while executing normally on Windows.]]></description>
            <link>https://www.probablypwned.com/article/gootloader-malware-1000-zip-archives-evasion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gootloader-malware-1000-zip-archives-evasion</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Gootloader]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[evasion]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Vanilla Tempest]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 13:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WhisperPair Flaw Lets Hackers Hijack Sony, Google Headphones]]></title>
            <description><![CDATA[Critical Google Fast Pair vulnerability affects millions of wireless audio devices from major manufacturers. Attackers can eavesdrop on calls within Bluetooth range.]]></description>
            <link>https://www.probablypwned.com/article/whisperpair-bluetooth-vulnerability-google-fast-pair</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/whisperpair-bluetooth-vulnerability-google-fast-pair</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WhisperPair]]></category>
            <category><![CDATA[Bluetooth]]></category>
            <category><![CDATA[Google Fast Pair]]></category>
            <category><![CDATA[CVE-2025-36911]]></category>
            <category><![CDATA[eavesdropping]]></category>
            <category><![CDATA[Sony]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 12:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1505740420928-5e560c06d30e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1505740420928-5e560c06d30e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Dismantles RedVDS Phishing Platform Behind $40M Fraud]]></title>
            <description><![CDATA[Coordinated takedown seizes cybercrime service that enabled 191,000 account compromises. Operation marks Microsoft's 35th action against criminal infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-redvds-takedown-40-million-fraud</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-redvds-takedown-40-million-fraud</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[RedVDS]]></category>
            <category><![CDATA[takedown]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[BEC]]></category>
            <category><![CDATA[cybercrime]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 10:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Grubhub Hit by Second Breach, ShinyHunters Demanding Ransom]]></title>
            <description><![CDATA[Food delivery giant confirms hackers stole data and are now extorting the company. Attack traced to credentials stolen in August 2025 Salesloft breach.]]></description>
            <link>https://www.probablypwned.com/article/grubhub-data-breach-shinyhunters-extortion-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/grubhub-data-breach-shinyhunters-extortion-january-2026</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Grubhub]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 09:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cal.com Flaw Lets Attackers Bypass MFA With Fake TOTP Codes]]></title>
            <description><![CDATA[Critical authentication bug in popular scheduling platform reduces multi-factor auth to single-factor. Patch available in version 6.0.7.]]></description>
            <link>https://www.probablypwned.com/article/cal-com-totp-bypass-account-takeover-vulnerability</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cal-com-totp-bypass-account-takeover-vulnerability</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cal.com]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[authentication]]></category>
            <category><![CDATA[account takeover]]></category>
            <category><![CDATA[TOTP]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 15 Jan 2026 12:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Sandbox Escape Lets Users Run System Commands]]></title>
            <description><![CDATA[CVE-2025-68668 bypasses Python code restrictions in workflow automation platform. CVSS 9.9 flaw affects versions 1.0.0 through 1.x.]]></description>
            <link>https://www.probablypwned.com/article/n8n-python-sandbox-bypass-cve-2025-68668</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-python-sandbox-bypass-cve-2025-68668</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2025-68668]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[Python]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 15 Jan 2026 11:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russian Hackers Target Ukraine Military With Fake Charities]]></title>
            <description><![CDATA[Void Blizzard deploys PLUGGYAPE backdoor through Signal and WhatsApp, impersonating charitable organizations to compromise Ukrainian defense forces.]]></description>
            <link>https://www.probablypwned.com/article/void-blizzard-pluggyape-malware-ukraine-defense</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/void-blizzard-pluggyape-malware-ukraine-defense</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Void Blizzard]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[PLUGGYAPE]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 15 Jan 2026 09:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Palo Alto Patches GlobalProtect DoS Flaw With Public PoC]]></title>
            <description><![CDATA[CVE-2026-0227 allows unauthenticated attackers to crash firewalls via malformed packets. Proof-of-concept code is publicly available.]]></description>
            <link>https://www.probablypwned.com/article/palo-alto-pan-os-globalprotect-dos-cve-2026-0227</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/palo-alto-pan-os-globalprotect-dos-cve-2026-0227</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Palo Alto Networks]]></category>
            <category><![CDATA[PAN-OS]]></category>
            <category><![CDATA[CVE-2026-0227]]></category>
            <category><![CDATA[GlobalProtect]]></category>
            <category><![CDATA[DoS]]></category>
            <category><![CDATA[firewall]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 15 Jan 2026 08:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Everest Gang Claims 900GB Nissan Breach, Sets 5-Day Deadline]]></title>
            <description><![CDATA[Russia-linked ransomware group posts samples allegedly from Nissan's internal systems including dealership records and financial documents.]]></description>
            <link>https://www.probablypwned.com/article/everest-ransomware-nissan-900gb-data-breach-claim</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/everest-ransomware-nissan-900gb-data-breach-claim</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[Nissan]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[automotive]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 14:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1503376780353-7e6692767b70?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1503376780353-7e6692767b70?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Mapped 91,000+ AI Endpoints in Mass Recon Campaign]]></title>
            <description><![CDATA[GreyNoise honeypot data reveals coordinated reconnaissance of LLM infrastructure including OpenAI, Claude, and Ollama deployments over 11 days.]]></description>
            <link>https://www.probablypwned.com/article/greynoise-91000-attacks-llm-ai-infrastructure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/greynoise-91000-attacks-llm-ai-infrastructure</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[LLM]]></category>
            <category><![CDATA[Ollama]]></category>
            <category><![CDATA[reconnaissance]]></category>
            <category><![CDATA[GreyNoise]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 13:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VoidLink: New Malware Framework Built for Linux Cloud Attacks]]></title>
            <description><![CDATA[Check Point researchers expose a sophisticated cloud-native malware framework designed from the ground up to target AWS, Azure, GCP, and containerized environments.]]></description>
            <link>https://www.probablypwned.com/article/voidlink-malware-framework-linux-cloud-check-point</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/voidlink-malware-framework-linux-cloud-check-point</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VoidLink]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[AWS]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[containers]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 11:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiSIEM RCE Flaw Lets Attackers Gain Root Without Auth]]></title>
            <description><![CDATA[CVE-2025-64155 in Fortinet's SIEM product enables unauthenticated command injection via phMonitor service. CVSS 9.4, patches now available.]]></description>
            <link>https://www.probablypwned.com/article/fortisiem-critical-rce-cve-2025-64155-unauthenticated</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortisiem-critical-rce-cve-2025-64155-unauthenticated</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiSIEM]]></category>
            <category><![CDATA[CVE-2025-64155]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 10:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches 113 CVEs Including Actively Exploited Zero-Day]]></title>
            <description><![CDATA[January 2026 Patch Tuesday addresses CVE-2026-20805, an info disclosure bug already under attack. CISA gives feds until February 3 to patch.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-patch-tuesday-january-2026-zero-day-cve-2026-20805</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-patch-tuesday-january-2026-zero-day-cve-2026-20805</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-20805]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633419461186-7d40a38105ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633419461186-7d40a38105ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WEF Report: CEOs Now Fear AI-Powered Fraud More Than Ransomware]]></title>
            <description><![CDATA[Global Cybersecurity Outlook 2026 finds executives prioritizing cyber-enabled fraud as top risk. Report warns of 'three-front war' against crime, AI misuse, and supply chain threats.]]></description>
            <link>https://www.probablypwned.com/article/wef-cybersecurity-outlook-2026-fraud-overtakes-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wef-cybersecurity-outlook-2026-fraud-overtakes-ransomware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[World Economic Forum]]></category>
            <category><![CDATA[cybersecurity trends]]></category>
            <category><![CDATA[AI threats]]></category>
            <category><![CDATA[fraud]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 13 Jan 2026 16:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese APT Used VMware ESXi Zero-Days to Escape VMs]]></title>
            <description><![CDATA[Huntress researchers discover 'MAESTRO' toolkit exploiting three VMware vulnerabilities. Attackers chained SonicWall VPN access with hypervisor escape to deploy persistent backdoors.]]></description>
            <link>https://www.probablypwned.com/article/vmware-esxi-maestro-zero-day-china-apt-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vmware-esxi-maestro-zero-day-china-apt-exploitation</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[VMware]]></category>
            <category><![CDATA[ESXi]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[hypervisor escape]]></category>
            <category><![CDATA[SonicWall]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 13 Jan 2026 15:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SAP Patches CVSS 9.9 SQL Injection in January Update]]></title>
            <description><![CDATA[January 2026 Patch Day addresses 17 flaws including four HotNews vulnerabilities. CVE-2026-0501 allows authenticated attackers to compromise S/4HANA financial systems.]]></description>
            <link>https://www.probablypwned.com/article/sap-security-patch-day-january-2026-critical-sql-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sap-security-patch-day-january-2026-critical-sql-injection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SAP]]></category>
            <category><![CDATA[CVE-2026-0501]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[S/4HANA]]></category>
            <category><![CDATA[patch tuesday]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 13 Jan 2026 14:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Salt Typhoon Breaches Congressional Committee Staff Emails]]></title>
            <description><![CDATA[Chinese state hackers accessed email accounts of House staffers working on China, foreign affairs, and defense. The intrusion was discovered in December.]]></description>
            <link>https://www.probablypwned.com/article/salt-typhoon-congressional-committee-email-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/salt-typhoon-congressional-committee-email-breach</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Salt Typhoon]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Congress]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 12 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1501776192086-602832fae6e4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1501776192086-602832fae6e4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Australian Insurer Prosura Breach Exposes Driver's Licenses]]></title>
            <description><![CDATA[Attackers claim 98 million records from the car rental insurance provider. Stolen data includes license photos, policy documents, and personal details.]]></description>
            <link>https://www.probablypwned.com/article/prosura-australia-insurance-breach-98-million-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/prosura-australia-insurance-breach-98-million-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Prosura]]></category>
            <category><![CDATA[Australia]]></category>
            <category><![CDATA[insurance]]></category>
            <category><![CDATA[PII]]></category>
            <category><![CDATA[identity theft]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 12 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1450101499163-c8848c66ca85?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1450101499163-c8848c66ca85?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Warns Kimsuky Using QR Codes to Steal Credentials]]></title>
            <description><![CDATA[North Korean APT embeds malicious QR codes in spear-phishing emails to bypass corporate email security and compromise mobile devices.]]></description>
            <link>https://www.probablypwned.com/article/fbi-kimsuky-quishing-north-korea-qr-codes</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-kimsuky-quishing-north-korea-qr-codes</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Kimsuky]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[quishing]]></category>
            <category><![CDATA[QR codes]]></category>
            <category><![CDATA[spear-phishing]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 12 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Meta Denies Breach as 17.5M Instagram Records Fuel Password Reset Attacks]]></title>
            <description><![CDATA[Scraped data from 2024 API misconfiguration resurfaces on dark web. Attackers weaponize leaked emails to flood users with legitimate password reset requests.]]></description>
            <link>https://www.probablypwned.com/article/instagram-17-million-accounts-scraped-password-reset-wave</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/instagram-17-million-accounts-scraped-password-reset-wave</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Instagram]]></category>
            <category><![CDATA[Meta]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[API scraping]]></category>
            <category><![CDATA[password reset]]></category>
            <category><![CDATA[social media]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 16:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Patches ISE Flaw After Public PoC Exploit Emerges]]></title>
            <description><![CDATA[CVE-2026-20029 lets authenticated admins read restricted system files through XML parsing weakness. Trend Micro ZDI researcher found the bug; no workarounds available.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ise-xxe-cve-2026-20029-poc-exploit-released</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ise-xxe-cve-2026-20029-poc-exploit-released</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20029]]></category>
            <category><![CDATA[ISE]]></category>
            <category><![CDATA[XXE]]></category>
            <category><![CDATA[PoC exploit]]></category>
            <category><![CDATA[network access control]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 14:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Closes 10 Emergency Directives in Historic Shift]]></title>
            <description><![CDATA[The agency retired directives spanning SolarWinds to Microsoft Exchange in the largest bulk closure ever. KEV catalog now handles most vulnerability mandates.]]></description>
            <link>https://www.probablypwned.com/article/cisa-retires-10-emergency-directives-policy-shift</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-retires-10-emergency-directives-policy-shift</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[emergency directive]]></category>
            <category><![CDATA[BOD 22-01]]></category>
            <category><![CDATA[federal cybersecurity]]></category>
            <category><![CDATA[policy]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 12:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russia's APT28 Harvests Credentials Across Balkans and Central Asia]]></title>
            <description><![CDATA[Fancy Bear campaigns from February through September 2025 targeted energy, defense, and policy organizations using fake VPN and email login pages.]]></description>
            <link>https://www.probablypwned.com/article/apt28-fancy-bear-credential-theft-balkans-middle-east</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-fancy-bear-credential-theft-balkans-middle-east</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[Fancy Bear]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[GRU]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 10:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Angular XSS Flaw Bypasses Sanitization via SVG Script Tags]]></title>
            <description><![CDATA[CVE-2026-22610 lets attackers inject JavaScript through SVG script attributes that Angular's sanitizer fails to recognize. Patches available for versions 19-21.]]></description>
            <link>https://www.probablypwned.com/article/angular-xss-svg-script-cve-2026-22610</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/angular-xss-svg-script-cve-2026-22610</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Angular]]></category>
            <category><![CDATA[CVE-2026-22610]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[JavaScript]]></category>
            <category><![CDATA[SVG]]></category>
            <category><![CDATA[web security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 08:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Supply Chain Attacks on Developer Tools: A Growing Threat]]></title>
            <description><![CDATA[From VS Code extensions to automation platforms, attackers are targeting the tools developers trust. Here's what security teams need to know.]]></description>
            <link>https://www.probablypwned.com/article/supply-chain-attacks-developer-tools-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/supply-chain-attacks-developer-tools-guide</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[developer tools]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[Open VSX]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 18:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware Groups to Watch in 2025-2026]]></title>
            <description><![CDATA[Qilin has hit 1,000+ victims. Everest targets critical infrastructure. Here's what security teams need to know about today's most active ransomware operations.]]></description>
            <link>https://www.probablypwned.com/article/ransomware-groups-2025-2026-profiles-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ransomware-groups-2025-2026-profiles-guide</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[RaaS]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 17:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea's Cyber Army: A Lazarus Group Profile]]></title>
            <description><![CDATA[DPRK hackers stole $2B in cryptocurrency in 2025 alone. Understanding Lazarus Group's operations helps defend against state-sponsored financial theft.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-lazarus-cyber-operations-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-lazarus-cyber-operations-guide</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Lazarus Group]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[DPRK]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 16:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[17.5 Million Instagram Accounts Leaked on BreachForums]]></title>
            <description><![CDATA[A threat actor shared Instagram user data including emails and phone numbers for free. Users report receiving suspicious password reset emails within hours of the leak.]]></description>
            <link>https://www.probablypwned.com/article/instagram-17-million-accounts-leaked-breachforums</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/instagram-17-million-accounts-leaked-breachforums</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Instagram]]></category>
            <category><![CDATA[Meta]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[BreachForums]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[social media]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 15:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Healthcare Cybersecurity: Why Hospitals Are Under Siege]]></title>
            <description><![CDATA[Ransomware attacks on healthcare surged 30% in 2025. Here's why medical organizations remain prime targets and what defenders can do about it.]]></description>
            <link>https://www.probablypwned.com/article/healthcare-cybersecurity-ransomware-threats-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/healthcare-cybersecurity-ransomware-threats-guide</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[medical devices]]></category>
            <category><![CDATA[HIPAA]]></category>
            <category><![CDATA[patient safety]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 14:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fog Ransomware Targets US Schools Through Stolen VPNs]]></title>
            <description><![CDATA[A ransomware operation has compromised multiple US educational institutions using stolen VPN credentials. The education sector represents 80% of known victims.]]></description>
            <link>https://www.probablypwned.com/article/fog-ransomware-targets-us-education-via-vpn-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fog-ransomware-targets-us-education-via-vpn-credentials</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Fog]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Arctic Wolf]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 13:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrazyHunter Ransomware Hits Taiwan Healthcare Sector]]></title>
            <description><![CDATA[A new ransomware group has compromised at least six healthcare organizations in Taiwan using BYOVD attacks to disable security software before encryption.]]></description>
            <link>https://www.probablypwned.com/article/crazyhunter-ransomware-taiwan-healthcare-byovd-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crazyhunter-ransomware-taiwan-healthcare-byovd-attacks</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[CrazyHunter]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[Taiwan]]></category>
            <category><![CDATA[BYOVD]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 12:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Coolify Command Injection Flaws Grant Root Access]]></title>
            <description><![CDATA[Five critical vulnerabilities in the self-hosting platform allow authenticated users to execute arbitrary commands as root. Over 52,000 instances are exposed globally.]]></description>
            <link>https://www.probablypwned.com/article/coolify-critical-command-injection-52000-instances-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/coolify-critical-command-injection-52000-instances-exposed</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Coolify]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[CVE-2025-66209]]></category>
            <category><![CDATA[self-hosting]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 11:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Snort 3 Flaws Enable DoS and Data Leaks]]></title>
            <description><![CDATA[CVE-2026-20026 and CVE-2026-20027 allow remote attackers to crash Snort or extract sensitive data. No workarounds exist—patches are the only fix.]]></description>
            <link>https://www.probablypwned.com/article/cisco-snort-3-dce-rpc-vulnerabilities-dos-data-leak</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-snort-3-dce-rpc-vulnerabilities-dos-data-leak</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[Snort]]></category>
            <category><![CDATA[CVE-2026-20026]]></category>
            <category><![CDATA[CVE-2026-20027]]></category>
            <category><![CDATA[DCE-RPC]]></category>
            <category><![CDATA[IDS]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 10:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Browser Extension Threats: What Security Teams Must Know]]></title>
            <description><![CDATA[Malicious extensions have compromised over 15 million users in the past year. Here's how attackers exploit the extension ecosystem and what organizations can do.]]></description>
            <link>https://www.probablypwned.com/article/browser-extension-threats-enterprise-security-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/browser-extension-threats-enterprise-security-guide</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[browser extensions]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 09:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Auth Bypass in Network Appliances: A Pattern Emerges]]></title>
            <description><![CDATA[From Fortinet to SonicWall, authentication bypass vulnerabilities share common traits. Understanding these patterns helps security teams prioritize patching.]]></description>
            <link>https://www.probablypwned.com/article/authentication-bypass-network-appliances-pattern-analysis</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/authentication-bypass-network-appliances-pattern-analysis</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[vulnerability patterns]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <dc:creator><![CDATA[Emily Park]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 08:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hacker Selling 139GB of US Utility Engineering Data]]></title>
            <description><![CDATA[Pickett USA breach exposes LiDAR scans, transmission line surveys, and substation layouts for Tampa Electric, Duke Energy Florida, and American Electric Power. Asking price: 6.5 BTC.]]></description>
            <link>https://www.probablypwned.com/article/pickett-usa-breach-utility-lidar-data-for-sale</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pickett-usa-breach-utility-lidar-data-for-sale</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[utilities]]></category>
            <category><![CDATA[LiDAR]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[energy sector]]></category>
            <category><![CDATA[Pickett USA]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 09 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1567264837824-c993e26bf663?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1567264837824-c993e26bf663?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Teams Enables Security Defaults on January 12]]></title>
            <description><![CDATA[Tenants using default settings will get automatic protection against weaponizable file types and malicious URLs. Administrators who want to opt out must act before the rollout.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-teams-security-defaults-january-12</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-teams-security-defaults-january-12</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Microsoft Teams]]></category>
            <category><![CDATA[security]]></category>
            <category><![CDATA[messaging]]></category>
            <category><![CDATA[file protection]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[enterprise]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Fri, 09 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[jsPDF Flaw Lets Attackers Embed Local Files in PDFs]]></title>
            <description><![CDATA[CVE-2025-68428 enables path traversal in the popular JavaScript PDF library, allowing attackers to read arbitrary files from Node.js servers and exfiltrate them via generated documents.]]></description>
            <link>https://www.probablypwned.com/article/jspdf-cve-2025-68428-arbitrary-file-read-nodejs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/jspdf-cve-2025-68428-arbitrary-file-read-nodejs</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[jsPDF]]></category>
            <category><![CDATA[CVE-2025-68428]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[Node.js]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 09 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Extensions Stealing ChatGPT Chats Hit 900K Users]]></title>
            <description><![CDATA[Two rogue browser extensions masquerading as AI tools exfiltrated complete conversation histories from ChatGPT and DeepSeek to attacker-controlled servers every 30 minutes.]]></description>
            <link>https://www.probablypwned.com/article/chrome-extensions-900k-users-chatgpt-deepseek-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-extensions-900k-users-chatgpt-deepseek-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[DeepSeek]]></category>
            <category><![CDATA[data theft]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[AI]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 09 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Talos Exposes UAT-7290: China APT Targeting Telecoms]]></title>
            <description><![CDATA[Newly disclosed threat actor compromises telecom providers in South Asia and Southeastern Europe, establishing relay infrastructure for other Chinese APT groups.]]></description>
            <link>https://www.probablypwned.com/article/uat-7290-china-apt-telecom-south-asia-talos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-7290-china-apt-telecom-south-asia-talos</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[UAT-7290]]></category>
            <category><![CDATA[telecommunications]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 08 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n 'Ni8mare' Flaw Allows Unauthenticated Server Takeover]]></title>
            <description><![CDATA[CVE-2026-21858 scores CVSS 10.0 and requires no credentials to exploit. Attackers can read files, forge admin sessions, and execute commands.]]></description>
            <link>https://www.probablypwned.com/article/n8n-ni8mare-cve-2026-21858-unauthenticated-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-ni8mare-cve-2026-21858-unauthenticated-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-21858]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[workflow automation]]></category>
            <category><![CDATA[Ni8mare]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 08 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds 16-Year-Old PowerPoint Flaw to Exploited List]]></title>
            <description><![CDATA[January 7 KEV update includes CVE-2009-0556 from 2009 alongside recently patched HPE OneView vulnerability. Both are seeing active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-powerpoint-hpe-oneview-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-powerpoint-hpe-oneview-january-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[CVE-2009-0556]]></category>
            <category><![CDATA[CVE-2025-37164]]></category>
            <category><![CDATA[PowerPoint]]></category>
            <category><![CDATA[HPE OneView]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 08 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1535191042502-e6a9a3d407e7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1535191042502-e6a9a3d407e7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UK Commits £210M to Mandatory Public Sector Cybersecurity]]></title>
            <description><![CDATA[New Government Cyber Action Plan creates centralized security unit, dedicated cyber profession, and mandatory requirements for all departments. Legacy systems get top priority.]]></description>
            <link>https://www.probablypwned.com/article/uk-government-cyber-action-plan-210-million</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uk-government-cyber-action-plan-210-million</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UK government]]></category>
            <category><![CDATA[policy]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <category><![CDATA[public sector]]></category>
            <category><![CDATA[NCSC]]></category>
            <category><![CDATA[regulation]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Resecurity Catches Hackers Red-Handed with Deliberate Honeypot Trap]]></title>
            <description><![CDATA[Cybersecurity firm Resecurity reveals that hackers claiming to have breached their systems only accessed a deliberately deployed honeypot containing fake data designed to monitor threat actor activity.]]></description>
            <link>https://www.probablypwned.com/article/resecurity-honeypot-catches-hackers-scattered-lapsus-slh</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/resecurity-honeypot-catches-hackers-scattered-lapsus-slh</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Resecurity]]></category>
            <category><![CDATA[honeypot]]></category>
            <category><![CDATA[Scattered-Lapsus]]></category>
            <category><![CDATA[threat-intelligence]]></category>
            <category><![CDATA[deception]]></category>
            <dc:creator><![CDATA[Marcus Webb]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Hits 5 Targets in 24 Hours Including Healthcare]]></title>
            <description><![CDATA[The Russian-linked gang led all ransomware groups on January 6 with attacks spanning wine distributors, art logistics, and medical practices across three countries.]]></description>
            <link>https://www.probablypwned.com/article/qilin-ransomware-17-attacks-healthcare-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/qilin-ransomware-17-attacks-healthcare-january-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[ransomware-as-a-service]]></category>
            <category><![CDATA[threat actors]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft: Tycoon2FA Phishing Exploits Email Misconfigurations]]></title>
            <description><![CDATA[Threat actors spoof organization domains by abusing complex mail routing and weak DMARC policies. Microsoft blocked 13 million malicious emails in October alone.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-tycoon2fa-domain-spoofing-13-million-emails</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-tycoon2fa-domain-spoofing-13-million-emails</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Tycoon2FA]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[email security]]></category>
            <category><![CDATA[DMARC]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lazarus Weaponizes Fake Job Interviews With ClickFix Malware]]></title>
            <description><![CDATA[North Korean APT-Q-1 now combines fraudulent cryptocurrency job postings with ClickFix social engineering to deploy GolangGhost backdoor and BeaverTail stealer.]]></description>
            <link>https://www.probablypwned.com/article/lazarus-apt-clickfix-fake-job-interviews-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lazarus-apt-clickfix-fake-job-interviews-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Lazarus]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome WebView Flaw Lets Attackers Bypass Security Controls]]></title>
            <description><![CDATA[Google patches CVE-2026-0628 in first 2026 update. The high-severity bug affects billions of users across Chrome and Android applications.]]></description>
            <link>https://www.probablypwned.com/article/google-chrome-webview-cve-2026-0628-security-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-chrome-webview-cve-2026-0628-security-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-0628]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[WebView]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[patch]]></category>
            <category><![CDATA[Android]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1619252584172-a83a949b6efd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1619252584172-a83a949b6efd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical D-Link Router Flaw Under Active Attack, No Patch Coming]]></title>
            <description><![CDATA[CVE-2026-0625 allows unauthenticated remote code execution on legacy DSL routers. Affected models reached end-of-life in 2020 and won't receive fixes.]]></description>
            <link>https://www.probablypwned.com/article/d-link-dsl-router-cve-2026-0625-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/d-link-dsl-router-cve-2026-0625-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-0625]]></category>
            <category><![CDATA[D-Link]]></category>
            <category><![CDATA[router]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[active exploitation]]></category>
            <category><![CDATA[EOL]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dartmouth Data Breach Exposes 40,000+ in Clop Ransomware Attack]]></title>
            <description><![CDATA[Russian ransomware group Clop claims responsibility for breach at Dartmouth College, posting stolen data on dark web and affecting more than 40,000 individuals including students, staff, and alumni.]]></description>
            <link>https://www.probablypwned.com/article/dartmouth-clop-ransomware-breach-40000-affected</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dartmouth-clop-ransomware-breach-40000-affected</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Dartmouth]]></category>
            <category><![CDATA[Clop]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[MOVEit]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dartmouth Breach Exposes 44,000 in Clop Oracle Campaign]]></title>
            <description><![CDATA[Russian ransomware gang exploited CVE-2025-61882 to steal SSNs and financial data from the college. The same vulnerability hit Harvard, UPenn, and 100+ organizations.]]></description>
            <link>https://www.probablypwned.com/article/dartmouth-clop-ransomware-breach-44000-oracle-ebs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dartmouth-clop-ransomware-breach-44000-oracle-ebs</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Clop]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Dartmouth]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[higher education]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Patches High-Severity WebView Policy Bypass]]></title>
            <description><![CDATA[CVE-2026-0628 allowed malicious extensions to inject scripts into privileged pages through insufficient policy enforcement. Update to Chrome 143.0.7499.192.]]></description>
            <link>https://www.probablypwned.com/article/chrome-webview-cve-2026-0628-policy-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-webview-cve-2026-0628-policy-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-0628]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[WebView]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[patch]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[New 'Brutus' Brute-Force Tool Targets Fortinet on Dark Web]]></title>
            <description><![CDATA[A threat actor called RedTeam is selling a $1,500 credential-stuffing tool with built-in scanning, proxy rotation, and multi-protocol support aimed at enterprise VPN infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/brutus-brute-force-tool-fortinet-dark-web</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/brutus-brute-force-tool-fortinet-dark-web</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[brute force]]></category>
            <category><![CDATA[dark web]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[credential stuffing]]></category>
            <category><![CDATA[tools]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Blue Shield California Exposes Member Health Data in Portal Error]]></title>
            <description><![CDATA[System enhancement gone wrong allowed members to view other members' names, diagnoses, and medications. The insurer is offering affected individuals credit monitoring.]]></description>
            <link>https://www.probablypwned.com/article/blue-shield-california-record-merge-data-exposure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/blue-shield-california-record-merge-data-exposure</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Blue Shield]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[HIPAA]]></category>
            <category><![CDATA[California]]></category>
            <category><![CDATA[privacy]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ASML Breach Claim: 154 Databases and Encryption Keys Leaked]]></title>
            <description><![CDATA[Threat actor '1011' posted alleged data from the semiconductor equipment giant to a Russian cybercrime forum. Security researchers are verifying the files.]]></description>
            <link>https://www.probablypwned.com/article/asml-semiconductor-breach-154-databases-encryption-keys</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/asml-semiconductor-breach-154-databases-encryption-keys</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ASML]]></category>
            <category><![CDATA[semiconductor]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[encryption keys]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[700Credit Breach Exposes Millions of Social Security Numbers from Auto Dealership Transactions]]></title>
            <description><![CDATA[Consumer credit provider 700Credit suffers massive data breach affecting auto loan applicants nationwide, with millions of Social Security numbers potentially compromised through dealership credit checks.]]></description>
            <link>https://www.probablypwned.com/article/700credit-breach-millions-ssn-auto-dealerships</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/700credit-breach-millions-ssn-auto-dealerships</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[700Credit]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[auto-dealership]]></category>
            <category><![CDATA[credit-bureau]]></category>
            <category><![CDATA[identity-theft]]></category>
            <category><![CDATA[data-breach]]></category>
            <dc:creator><![CDATA[Marcus Webb]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1449824913935-59a10b8d2000?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1449824913935-59a10b8d2000?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Silk Typhoon: Chinese APT Escalates Attacks on US Government and IT Supply Chain]]></title>
            <description><![CDATA[Microsoft and CrowdStrike warn of intensified Silk Typhoon operations targeting US government agencies and IT supply chains, with 150% increase in China-linked intrusions.]]></description>
            <link>https://www.probablypwned.com/article/silk-typhoon-china-apt-us-government-treasury-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/silk-typhoon-china-apt-us-government-treasury-attack</guid>
            <category><![CDATA[Nation State]]></category>
            <category><![CDATA[Silk-Typhoon]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Treasury]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ledger Data Breach: Payment Processor Compromise Exposes Crypto Wallet Users]]></title>
            <description><![CDATA[Cryptocurrency hardware wallet maker Ledger confirms customer data exposed after third-party payment processor Global-e suffers cloud system breach.]]></description>
            <link>https://www.probablypwned.com/article/ledger-data-breach-global-e-payment-processor</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ledger-data-breach-global-e-payment-processor</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Ledger]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[Global-e]]></category>
            <category><![CDATA[supply-chain]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1622630998477-20aa696ecb05?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1622630998477-20aa696ecb05?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GlassWorm Malware Targets macOS Developers Through Poisoned VS Code Extensions]]></title>
            <description><![CDATA[First macOS-focused wave of GlassWorm malware discovered on Open VSX marketplace, stealing cryptocurrency wallets, Keychain passwords, and developer credentials through trojanized extensions.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-malware-macos-vscode-extensions-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-malware-macos-vscode-extensions-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[VSCode]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Brightspeed Investigating Breach After Crimson Collective Claims 1M+ Customer Records]]></title>
            <description><![CDATA[US fiber broadband provider Brightspeed confirms investigation into cyberattack claims by emerging threat group Crimson Collective, which alleges exfiltration of over one million customer records.]]></description>
            <link>https://www.probablypwned.com/article/brightspeed-crimson-collective-million-customers-data-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/brightspeed-crimson-collective-million-customers-data-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Brightspeed]]></category>
            <category><![CDATA[Crimson-Collective]]></category>
            <category><![CDATA[ISP-breach]]></category>
            <category><![CDATA[telecommunications]]></category>
            <category><![CDATA[data-breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apple Warns 1.8 Billion iPhone Users of WebKit Zero-Days Linked to Pegasus Spyware]]></title>
            <description><![CDATA[Apple issues emergency patches for two WebKit zero-day vulnerabilities being actively exploited in sophisticated attacks linked to NSO Group's Pegasus spyware.]]></description>
            <link>https://www.probablypwned.com/article/apple-ios-zero-day-webkit-pegasus-spyware-warning</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apple-ios-zero-day-webkit-pegasus-spyware-warning</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[WebKit]]></category>
            <category><![CDATA[Pegasus]]></category>
            <category><![CDATA[NSO-Group]]></category>
            <category><![CDATA[spyware]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510557880182-3d4d3cba35a5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510557880182-3d4d3cba35a5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Space Force Awards $212M Contract for Base Network Overhaul]]></title>
            <description><![CDATA[CACI wins task order to modernize classified and unclassified networks at all 14 U.S. Space Force bases, implementing zero trust architecture and cloud capabilities.]]></description>
            <link>https://www.probablypwned.com/article/space-force-caci-212-million-network-modernization-zero-trust</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/space-force-caci-212-million-network-modernization-zero-trust</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Space Force]]></category>
            <category><![CDATA[zero trust]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[defense]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Federal Contractor Sedgwick Hit by TridentLocker Ransomware]]></title>
            <description><![CDATA[New Year's Eve attack on Sedgwick Government Solutions compromises file transfer system serving DHS, CISA, and ICE. TridentLocker claims 3.4GB of stolen data.]]></description>
            <link>https://www.probablypwned.com/article/sedgwick-government-solutions-tridentlocker-ransomware-dhs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sedgwick-government-solutions-tridentlocker-ransomware-dhs</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[TridentLocker]]></category>
            <category><![CDATA[federal contractor]]></category>
            <category><![CDATA[DHS]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Stolen Credentials Fuel Self-Sustaining Malware Distribution]]></title>
            <description><![CDATA[Hudson Rock research reveals 220 legitimate business websites hijacked for ClickFix malware attacks after admin credentials were stolen by infostealers.]]></description>
            <link>https://www.probablypwned.com/article/infostealer-clickfix-stolen-credentials-malware-distribution</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infostealer-clickfix-stolen-credentials-malware-distribution</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[malware distribution]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Christmas Attack Campaign Targets ColdFusion with 2.5M Requests]]></title>
            <description><![CDATA[GreyNoise researchers uncover coordinated campaign exploiting 767 CVEs across 47 technology stacks. Hong Kong-based infrastructure generated 98% of attack traffic on Christmas Day.]]></description>
            <link>https://www.probablypwned.com/article/coldfusion-christmas-attack-2-5-million-requests-hong-kong</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/coldfusion-christmas-attack-2-5-million-requests-hong-kong</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ColdFusion]]></category>
            <category><![CDATA[exploitation]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[initial access broker]]></category>
            <category><![CDATA[JNDI injection]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Canadian College Suspends Classes After Holiday Cyber Attack]]></title>
            <description><![CDATA[Aurora College in Canada's Northwest Territories cancels all classes January 5-9 after cyber attack over Christmas break takes down servers, email, and e-learning systems.]]></description>
            <link>https://www.probablypwned.com/article/aurora-college-cyber-attack-canada-classes-suspended</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aurora-college-cyber-attack-canada-classes-suspended</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[cyber attack]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[Canada]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RondoDox Botnet Targets 90K Servers via React2Shell]]></title>
            <description><![CDATA[Nine-month-old botnet campaign pivots to exploit CVE-2025-55182 in Next.js, deploying cryptominers and Mirai variants across exposed instances.]]></description>
            <link>https://www.probablypwned.com/article/rondodox-botnet-react2shell-90000-servers-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/rondodox-botnet-react2shell-90000-servers-exposed</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[RondoDox]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[CVE-2025-55182]]></category>
            <category><![CDATA[Next.js]]></category>
            <category><![CDATA[cryptominer]]></category>
            <category><![CDATA[Mirai]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 04 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Finland Arrests Ship Crew Over Baltic Cable Sabotage]]></title>
            <description><![CDATA[Two crew members detained after cargo vessel's anchor allegedly severed Finland-Estonia telecommunications cable in suspected hybrid warfare operation.]]></description>
            <link>https://www.probablypwned.com/article/finland-arrests-crew-baltic-submarine-cable-sabotage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/finland-arrests-crew-baltic-submarine-cable-sabotage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[hybrid warfare]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[submarine cable]]></category>
            <category><![CDATA[sabotage]]></category>
            <category><![CDATA[Finland]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 04 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1530973428-5bf2db2e4d71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1530973428-5bf2db2e4d71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EmEditor Website Compromised to Deliver Infostealer]]></title>
            <description><![CDATA[Popular text editor's download page was hijacked for four days in December, serving trojanized installers that steal browser credentials and crypto wallets.]]></description>
            <link>https://www.probablypwned.com/article/emeditor-supply-chain-attack-infostealer-walsham</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/emeditor-supply-chain-attack-infostealer-walsham</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[EmEditor]]></category>
            <category><![CDATA[browser extension]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 04 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Warns of Critical WHILL Wheelchair Bluetooth Flaw]]></title>
            <description><![CDATA[CVE-2025-14346 allows attackers within Bluetooth range to fully control electric wheelchairs without authentication, earning a CVSS 9.8 severity score.]]></description>
            <link>https://www.probablypwned.com/article/cisa-whill-wheelchair-bluetooth-takeover-cve-2025-14346</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-whill-wheelchair-bluetooth-takeover-cve-2025-14346</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[CVE-2025-14346]]></category>
            <category><![CDATA[medical devices]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[Bluetooth]]></category>
            <category><![CDATA[accessibility]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 04 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1559526324-c1f275fbfa32?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1559526324-c1f275fbfa32?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[New Zealand Health Portal Breach Exposes 126,000 Patients]]></title>
            <description><![CDATA[ManageMyHealth confirms Kazu ransomware gang compromised Health Documents module, threatening to leak 108GB of medical records unless $60,000 ransom is paid.]]></description>
            <link>https://www.probablypwned.com/article/managemyhealth-new-zealand-kazu-ransomware-126000-patients</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/managemyhealth-new-zealand-kazu-ransomware-126000-patients</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[New Zealand]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[patient data]]></category>
            <category><![CDATA[Kazu]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 03 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Illinois Exposed 672,000 Medicaid Recipients for Three Years]]></title>
            <description><![CDATA[Configuration error left addresses, case numbers, and demographic data publicly accessible on mapping website from January 2022 until September 2025.]]></description>
            <link>https://www.probablypwned.com/article/illinois-dhs-medicaid-data-exposure-672000-recipients</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/illinois-dhs-medicaid-data-exposure-672000-recipients</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[Medicaid]]></category>
            <category><![CDATA[configuration error]]></category>
            <category><![CDATA[Illinois]]></category>
            <category><![CDATA[healthcare]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 03 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Cloud Feature Weaponized in 9,000-Email Phishing Wave]]></title>
            <description><![CDATA[Attackers abuse Google Cloud Application Integration to send phishing emails that bypass SPF, DKIM, and DMARC, targeting 3,200 organizations globally.]]></description>
            <link>https://www.probablypwned.com/article/google-cloud-application-integration-phishing-3200-orgs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-cloud-application-integration-phishing-3200-orgs</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Google Cloud]]></category>
            <category><![CDATA[email security]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[DMARC bypass]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 03 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Everest Ransomware Dumps Full 1TB of ASUS Stolen Data]]></title>
            <description><![CDATA[After ASUS missed ransom deadline, Everest releases complete data trove including ROG source code, Qualcomm SDKs, and ArcSoft files on cybercrime forums.]]></description>
            <link>https://www.probablypwned.com/article/everest-ransomware-asus-1tb-full-data-dump-leaked</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/everest-ransomware-asus-1tb-full-data-dump-leaked</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[ASUS]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[data leak]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[source code]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 03 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical RCE Flaw in Signal K Threatens Marine Vessels]]></title>
            <description><![CDATA[CVE-2025-66398 lets unauthenticated attackers achieve code execution on boat navigation servers. CVSS 9.6 vulnerability affects all versions before 2.19.0.]]></description>
            <link>https://www.probablypwned.com/article/signal-k-server-cve-2025-66398-boat-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/signal-k-server-cve-2025-66398-boat-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Signal K]]></category>
            <category><![CDATA[CVE-2025-66398]]></category>
            <category><![CDATA[maritime security]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lithuanian Arrested After KMSAuto Malware Steals $1.2M]]></title>
            <description><![CDATA[A five-year investigation ends with extradition to South Korea. The 29-year-old allegedly infected 2.8 million Windows systems through trojanized software activation tools.]]></description>
            <link>https://www.probablypwned.com/article/lithuanian-kmsauto-clipper-malware-arrest-crypto-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lithuanian-kmsauto-clipper-malware-arrest-crypto-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[KMSAuto]]></category>
            <category><![CDATA[clipper malware]]></category>
            <category><![CDATA[cryptocurrency theft]]></category>
            <category><![CDATA[arrest]]></category>
            <category><![CDATA[South Korea]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1453733190371-0a9bedd82893?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1453733190371-0a9bedd82893?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GNU Wget2 Flaw Lets Attackers Overwrite System Files]]></title>
            <description><![CDATA[CVE-2025-69194 is a path traversal bug in Metalink handling that could let remote attackers write arbitrary files. CVSS 8.8.]]></description>
            <link>https://www.probablypwned.com/article/gnu-wget2-cve-2025-69194-path-traversal</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gnu-wget2-cve-2025-69194-path-traversal</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[GNU Wget2]]></category>
            <category><![CDATA[CVE-2025-69194]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[file overwrite]]></category>
            <category><![CDATA[Metalink]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GlassWorm Malware Pivots to macOS, Targets Crypto Wallets]]></title>
            <description><![CDATA[The self-propagating VS Code extension worm now replaces Ledger Live and Trezor Suite with trojanized versions. Russian-speaking operators behind campaign.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-macos-open-vsx-cryptocurrency-wallets</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-macos-open-vsx-cryptocurrency-wallets</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Open VSX]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Covenant Health Breach Exposes 478,000 Patient Records]]></title>
            <description><![CDATA[Investigation reveals Qilin ransomware attack in May 2025 was far larger than initially reported. The gang has already leaked 850GB of stolen data.]]></description>
            <link>https://www.probablypwned.com/article/covenant-health-breach-478000-qilin-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/covenant-health-breach-478000-qilin-ransomware</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Covenant Health]]></category>
            <category><![CDATA[healthcare breach]]></category>
            <category><![CDATA[Qilin ransomware]]></category>
            <category><![CDATA[PHI]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160399-112ba8d25d1d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160399-112ba8d25d1d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CVSS 10.0 Zero-Day Hits 70,000 XSpeeder Devices]]></title>
            <description><![CDATA[CVE-2025-54322 enables unauthenticated root RCE on SD-WAN appliances and edge routers. Vendor has ignored seven months of disclosure attempts. No patch available.]]></description>
            <link>https://www.probablypwned.com/article/xspeeder-sxzos-cvss-10-zero-day-70000-devices</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/xspeeder-sxzos-cvss-10-zero-day-70000-devices</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[XSpeeder]]></category>
            <category><![CDATA[CVE-2025-54322]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[The 10 Worst Vulnerabilities of 2025: Ranked by Real-World Impact]]></title>
            <description><![CDATA[Beyond CVSS scores, these vulnerabilities caused the most damage in 2025—from nation-state exploitation to mass ransomware campaigns and breaches affecting millions.]]></description>
            <link>https://www.probablypwned.com/article/top-10-worst-vulnerabilities-2025-by-impact</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/top-10-worst-vulnerabilities-2025-by-impact</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[vulnerabilities]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[SAP]]></category>
            <category><![CDATA[critical-infrastructure]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[IBM API Connect Auth Bypass Rated CVSS 9.8]]></title>
            <description><![CDATA[CVE-2025-13915 allows remote attackers to bypass authentication without credentials. Affects versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0 used by major banks and airlines.]]></description>
            <link>https://www.probablypwned.com/article/ibm-api-connect-cve-2025-13915-cvss-9-8-auth-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ibm-api-connect-cve-2025-13915-cvss-9-8-auth-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[IBM]]></category>
            <category><![CDATA[API Connect]]></category>
            <category><![CDATA[CVE-2025-13915]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[CVSS 9.8]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[European Space Agency Confirms Data Breach]]></title>
            <description><![CDATA[Threat actor '888' claims 200GB of source code, API keys, and credentials from ESA's Bitbucket and JIRA servers. Agency says only unclassified scientific systems were affected.]]></description>
            <link>https://www.probablypwned.com/article/european-space-agency-breach-200gb-data-888</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/european-space-agency-breach-200gb-data-888</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ESA]]></category>
            <category><![CDATA[European Space Agency]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[888]]></category>
            <category><![CDATA[source code]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DarkSpectre Malware Infected 8.8 Million Browser Users]]></title>
            <description><![CDATA[Chinese threat actor behind coordinated extension campaigns spanning seven years. Zoom Stealer component harvested corporate meeting credentials from 28 platforms.]]></description>
            <link>https://www.probablypwned.com/article/darkspectre-browser-extension-8-million-users-china</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/darkspectre-browser-extension-8-million-users-china</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[DarkSpectre]]></category>
            <category><![CDATA[browser extensions]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[corporate espionage]]></category>
            <category><![CDATA[Zoom Stealer]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SmarterMail CVE-2025-52691 Scores Perfect 10.0 CVSS for Unauthenticated RCE]]></title>
            <description><![CDATA[Singapore's CSA warns of a critical SmarterMail vulnerability allowing remote code execution through file upload without authentication. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/smartermail-cve-2025-52691-cvss-10-critical-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smartermail-cve-2025-52691-cvss-10-critical-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-52691]]></category>
            <category><![CDATA[SmarterMail]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[email server]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 31 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Silver Fox APT Impersonates Indian Tax Officials in Espionage Campaign]]></title>
            <description><![CDATA[CloudSEK identifies Chinese threat group Silver Fox targeting Indian organizations with phishing emails disguised as income tax department communications.]]></description>
            <link>https://www.probablypwned.com/article/silver-fox-apt-china-india-tax-impersonation-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/silver-fox-apt-china-india-tax-impersonation-campaign</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Silver Fox]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[India]]></category>
            <category><![CDATA[tax season]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 31 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gentlemen Ransomware Cripples Romania's Largest Coal Power Producer]]></title>
            <description><![CDATA[Oltenia Energy Complex shut down IT systems on December 26 after a ransomware attack encrypted critical documents and disrupted ERP, email, and web operations.]]></description>
            <link>https://www.probablypwned.com/article/romania-oltenia-energy-gentlemen-ransomware-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/romania-oltenia-energy-gentlemen-ransomware-attack</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Romania]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[energy sector]]></category>
            <category><![CDATA[Gentlemen ransomware]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 31 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chipotle Discloses Employee Data Breach Through Workday Payroll Accounts]]></title>
            <description><![CDATA[Attackers accessed Chipotle employee Workday accounts between October 9-26, potentially exposing personal information stored in payroll systems.]]></description>
            <link>https://www.probablypwned.com/article/chipotle-employee-workday-payroll-data-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chipotle-employee-workday-payroll-data-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Chipotle]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Workday]]></category>
            <category><![CDATA[payroll]]></category>
            <category><![CDATA[employee data]]></category>
            <category><![CDATA[credential stuffing]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 31 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ServiceNow Acquires Armis for $7.75 Billion in Largest Security Deal of 2025]]></title>
            <description><![CDATA[AI workflow giant expands into connected device security. Deal expected to close in late 2026 pending regulatory review.]]></description>
            <link>https://www.probablypwned.com/article/servicenow-acquires-armis-7-75-billion-ai-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/servicenow-acquires-armis-7-75-billion-ai-security</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[ServiceNow]]></category>
            <category><![CDATA[Armis]]></category>
            <category><![CDATA[acquisition]]></category>
            <category><![CDATA[IoT security]]></category>
            <category><![CDATA[cybersecurity M&A]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Tue, 30 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1434030216411-0b793f4b4173?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1434030216411-0b793f4b4173?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mustang Panda Deploys Kernel-Mode Rootkit to Conceal TONESHELL Backdoor]]></title>
            <description><![CDATA[Chinese APT uses stolen certificate to sign malicious driver that disables security tools. First documented case of TONESHELL delivered via kernel-mode loader.]]></description>
            <link>https://www.probablypwned.com/article/mustang-panda-kernel-rootkit-toneshell-signed-driver</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mustang-panda-kernel-rootkit-toneshell-signed-driver</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Mustang Panda]]></category>
            <category><![CDATA[TONESHELL]]></category>
            <category><![CDATA[rootkit]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[kernel driver]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 30 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Korean Air Confirms 30,000 Employee Records Stolen in Supplier Breach]]></title>
            <description><![CDATA[Hackers exploited Oracle EBS vulnerability at catering subsidiary to steal employee data including bank account numbers. Second major Korean airline breach this week.]]></description>
            <link>https://www.probablypwned.com/article/korean-air-30000-employees-oracle-ebs-supplier-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/korean-air-30000-employees-oracle-ebs-supplier-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Korean Air]]></category>
            <category><![CDATA[Oracle EBS]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[employee data]]></category>
            <category><![CDATA[South Korea]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 30 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds MongoBleed to KEV as Exploitation Spreads to 87,000 Instances]]></title>
            <description><![CDATA[Federal agencies have until January 19 to patch CVE-2025-14847. Security researchers release open-source detection tool as attackers harvest credentials from exposed servers.]]></description>
            <link>https://www.probablypwned.com/article/cisa-mongobleed-kev-87000-vulnerable-instances</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-mongobleed-kev-87000-vulnerable-instances</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[MongoDB]]></category>
            <category><![CDATA[CVE-2025-14847]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[MongoBleed]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 30 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Trust Wallet Chrome Extension Compromised, $7 Million Drained from Users]]></title>
            <description><![CDATA[Attackers pushed malicious update v2.68 to Chrome Web Store using leaked API key. Hundreds affected as seed phrases harvested via embedded analytics library.]]></description>
            <link>https://www.probablypwned.com/article/trust-wallet-chrome-extension-breach-7-million-stolen</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trust-wallet-chrome-extension-breach-7-million-stolen</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Trust Wallet]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Chrome extension]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Binance]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 29 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1621761191319-c6fb62004040?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1621761191319-c6fb62004040?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MacSync Stealer Bypasses macOS Gatekeeper Using Apple's Own Notarization]]></title>
            <description><![CDATA[New variant distributed as signed and notarized Swift app evades built-in security. Jamf Threat Labs traces evolution from ClickFix techniques to silent installer approach.]]></description>
            <link>https://www.probablypwned.com/article/macsync-stealer-bypasses-gatekeeper-notarization</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/macsync-stealer-bypasses-gatekeeper-notarization</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[MacSync]]></category>
            <category><![CDATA[Gatekeeper]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[notarization]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Mon, 29 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hacker Leaks 2.3 Million WIRED Records, Threatens 40 Million More from Condé Nast]]></title>
            <description><![CDATA[Database dump posted Christmas Day includes subscriber emails, names, and addresses. Attacker 'Lovely' claims access to broader Condé Nast data spanning multiple publications.]]></description>
            <link>https://www.probablypwned.com/article/conde-nast-wired-breach-40-million-records-threatened</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/conde-nast-wired-breach-40-million-records-threatened</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Condé Nast]]></category>
            <category><![CDATA[WIRED]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[media]]></category>
            <category><![CDATA[Have I Been Pwned]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 29 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Says Prompt Injection in AI Browsers May Never Be Solved]]></title>
            <description><![CDATA[Company admits ChatGPT Atlas remains vulnerable to attacks that hijack AI agents through malicious web content. New defenses deployed, but fundamental risk persists.]]></description>
            <link>https://www.probablypwned.com/article/openai-chatgpt-atlas-prompt-injection-unsolvable</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-chatgpt-atlas-prompt-injection-unsolvable</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[ChatGPT Atlas]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[agentic AI]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 28 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1676299081847-824916de030a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1676299081847-824916de030a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious npm Package 'lotusbail' Hijacked WhatsApp Accounts for Six Months]]></title>
            <description><![CDATA[Supply chain attack disguised as working WhatsApp API library stole credentials, messages, and linked attacker devices to victim accounts. 56,000+ downloads since May.]]></description>
            <link>https://www.probablypwned.com/article/npm-lotusbail-whatsapp-supply-chain-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/npm-lotusbail-whatsapp-supply-chain-attack</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[lotusbail]]></category>
            <category><![CDATA[JavaScript]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 28 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555952494-efd681c7e3f9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555952494-efd681c7e3f9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Everest Ransomware Claims 1TB Chrysler Data Theft on Christmas Day]]></title>
            <description><![CDATA[Ransomware group says it exfiltrated over a terabyte of Chrysler customer data including Salesforce records and recall case narratives. Threatening to publish in days.]]></description>
            <link>https://www.probablypwned.com/article/everest-ransomware-chrysler-christmas-data-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/everest-ransomware-chrysler-christmas-data-theft</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[Chrysler]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[automotive]]></category>
            <category><![CDATA[Stellantis]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 28 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1489824904134-891ab64532f1?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1489824904134-891ab64532f1?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Coupang CEO Finally Apologizes Over 33.7 Million Customer Data Breach]]></title>
            <description><![CDATA[South Korea's largest e-commerce breach exposed personal data for two-thirds of the population. Former employee identified as perpetrator. National Assembly hearings scheduled.]]></description>
            <link>https://www.probablypwned.com/article/coupang-ceo-apologizes-33-million-customer-data-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/coupang-ceo-apologizes-33-million-customer-data-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Coupang]]></category>
            <category><![CDATA[South Korea]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[e-commerce]]></category>
            <category><![CDATA[insider threat]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sun, 28 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1556742049-0cfed4f6a45d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1556742049-0cfed4f6a45d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UK Regulator Hits LastPass with £1.2 Million Fine Over 2022 Breach]]></title>
            <description><![CDATA[ICO penalty cites inadequate security measures that enabled hackers to steal data of 1.6 million UK users. Cryptocurrency theft linked to breach exceeds $438 million.]]></description>
            <link>https://www.probablypwned.com/article/uk-ico-fines-lastpass-1-2-million-2022-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uk-ico-fines-lastpass-1-2-million-2022-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[LastPass]]></category>
            <category><![CDATA[ICO]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[GDPR]]></category>
            <category><![CDATA[regulatory fine]]></category>
            <category><![CDATA[password manager]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 27 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1496368077930-c1e31b4e5b44?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1496368077930-c1e31b4e5b44?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MongoDB Urges Immediate Patching for Memory-Read Vulnerability]]></title>
            <description><![CDATA[CVE-2025-14847 allows unauthenticated attackers to read server memory in low-complexity attacks. Multiple MongoDB versions affected.]]></description>
            <link>https://www.probablypwned.com/article/mongodb-cve-2025-14847-memory-read-vulnerability</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mongodb-cve-2025-14847-memory-read-vulnerability</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[MongoDB]]></category>
            <category><![CDATA[CVE-2025-14847]]></category>
            <category><![CDATA[memory disclosure]]></category>
            <category><![CDATA[database security]]></category>
            <category><![CDATA[patching]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 27 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LockBit5 Claims 53 Victims in Single Day as Holiday Attacks Surge]]></title>
            <description><![CDATA[Ransomware tracking data shows 63 total claims from 6 groups on December 26. LockBit's revival dominates holiday attack wave targeting reduced security staff.]]></description>
            <link>https://www.probablypwned.com/article/lockbit5-holiday-ransomware-surge-december-2025</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lockbit5-holiday-ransomware-surge-december-2025</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[LockBit]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[holiday attacks]]></category>
            <category><![CDATA[Akira]]></category>
            <category><![CDATA[SafePay]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 27 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LangChain Serialization Flaw Lets Attackers Steal AI Agent Secrets]]></title>
            <description><![CDATA[CVE-2025-68664 scores CVSS 9.3 and enables secret extraction and prompt injection in LangChain Core. Patch immediately if you're running AI agents.]]></description>
            <link>https://www.probablypwned.com/article/langchain-cve-2025-68664-ai-agent-secret-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langchain-cve-2025-68664-ai-agent-secret-theft</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[LangChain]]></category>
            <category><![CDATA[CVE-2025-68664]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[serialization]]></category>
            <category><![CDATA[prompt injection]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 27 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WinRAR Flaw CVE-2025-6218 Exploited by Russian, Chinese, and Pakistani APTs]]></title>
            <description><![CDATA[CISA adds WinRAR path traversal vulnerability to KEV catalog as Gamaredon, Bitter, and GOFFEE deploy it for espionage and wiper attacks across multiple continents.]]></description>
            <link>https://www.probablypwned.com/article/winrar-cve-2025-6218-apt-groups-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/winrar-cve-2025-6218-apt-groups-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WinRAR]]></category>
            <category><![CDATA[CVE-2025-6218]]></category>
            <category><![CDATA[Gamaredon]]></category>
            <category><![CDATA[Bitter]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[path-traversal]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 26 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Nissan Discloses 21,000 Customers Exposed in Red Hat GitLab Breach]]></title>
            <description><![CDATA[Crimson Collective hackers breached Red Hat's self-managed GitLab in September, stealing 570GB from 28,000 repositories including Nissan customer data.]]></description>
            <link>https://www.probablypwned.com/article/nissan-red-hat-gitlab-breach-21000-customers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nissan-red-hat-gitlab-breach-21000-customers</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Nissan]]></category>
            <category><![CDATA[Red Hat]]></category>
            <category><![CDATA[GitLab]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[Crimson Collective]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 26 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apple Patches WebKit Zero-Days Linked to Spyware Attacks on Targeted Individuals]]></title>
            <description><![CDATA[CVE-2025-14174 and CVE-2025-43529 were exploited in sophisticated attacks before Apple's December 12 emergency patches across iOS, macOS, and Safari.]]></description>
            <link>https://www.probablypwned.com/article/apple-webkit-zero-day-cve-2025-14174-spyware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apple-webkit-zero-day-cve-2025-14174-spyware</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[WebKit]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2025-14174]]></category>
            <category><![CDATA[spyware]]></category>
            <category><![CDATA[iOS]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 26 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1591337676887-a217a6970a8a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1591337676887-a217a6970a8a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Goldman Sachs Warns Investors of Law Firm Data Breach at Fried Frank]]></title>
            <description><![CDATA[Fried Frank Harris Shriver & Jacobson data breach exposes Goldman Sachs alternative fund investor information, prompting class action lawsuit.]]></description>
            <link>https://www.probablypwned.com/article/goldman-sachs-fried-frank-law-firm-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/goldman-sachs-fried-frank-law-firm-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Goldman Sachs]]></category>
            <category><![CDATA[Fried Frank]]></category>
            <category><![CDATA[law firm]]></category>
            <category><![CDATA[third-party risk]]></category>
            <category><![CDATA[class action]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 25 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pro-Russian Hackers Cripple French Postal Service During Christmas Rush]]></title>
            <description><![CDATA[Noname057(16) claims DDoS attack on La Poste that disrupted package tracking and banking services for millions during peak holiday delivery season.]]></description>
            <link>https://www.probablypwned.com/article/french-postal-service-ddos-noname057-christmas</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/french-postal-service-ddos-noname057-christmas</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Noname057]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[France]]></category>
            <category><![CDATA[La Poste]]></category>
            <category><![CDATA[hacktivism]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 25 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557597774-9d273605dfa9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557597774-9d273605dfa9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet Warns 5-Year-Old FortiOS 2FA Bypass Is Under Active Attack]]></title>
            <description><![CDATA[CVE-2020-12812 allows attackers to bypass two-factor authentication on FortiGate devices by simply changing username case. Fortinet issued fresh advisory on December 25.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-cve-2020-12812-2fa-bypass-resurfaces</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-cve-2020-12812-2fa-bypass-resurfaces</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2020-12812]]></category>
            <category><![CDATA[2FA bypass]]></category>
            <category><![CDATA[FortiOS]]></category>
            <category><![CDATA[LDAP]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 25 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Aflac Confirms 22.6 Million Affected in June Data Breach]]></title>
            <description><![CDATA[Insurance giant Aflac discloses hackers stole SSNs, health records, and personal data from 22.6 million people in a June 2025 breach attributed to Scattered Spider.]]></description>
            <link>https://www.probablypwned.com/article/aflac-data-breach-22-million-scattered-spider</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aflac-data-breach-22-million-scattered-spider</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Aflac]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[insurance]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Thu, 25 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160399-112ba8d25d1d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160399-112ba8d25d1d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Clop Ransomware Gang Steals 3.5 Million Records from University of Phoenix]]></title>
            <description><![CDATA[Oracle E-Business Suite zero-day exploitation adds another victim to Clop's CVE-2025-61882 campaign. SSNs and bank account numbers among exposed data.]]></description>
            <link>https://www.probablypwned.com/article/university-phoenix-breach-3-5-million-clop-oracle</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/university-phoenix-breach-3-5-million-clop-oracle</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Clop]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[University of Phoenix]]></category>
            <category><![CDATA[CVE-2025-61882]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Marquis Fintech Breach Exposes 400,000 Bank Customers via Unpatched SonicWall]]></title>
            <description><![CDATA[Akira ransomware gang exploited known SonicWall vulnerability to hit fintech vendor serving 700+ banks and credit unions. SSNs and card numbers stolen.]]></description>
            <link>https://www.probablypwned.com/article/marquis-fintech-breach-400000-bank-customers-sonicwall</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/marquis-fintech-breach-400000-bank-customers-sonicwall</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Marquis]]></category>
            <category><![CDATA[Akira]]></category>
            <category><![CDATA[SonicWall]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[banking]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1554224155-6726b3ff858f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1554224155-6726b3ff858f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[INTERPOL Operation Sentinel: 574 Arrested in Africa-Wide Cybercrime Crackdown]]></title>
            <description><![CDATA[Month-long operation across 19 African nations recovers $3 million, takes down 6,000 malicious links, and decrypts six ransomware variants.]]></description>
            <link>https://www.probablypwned.com/article/interpol-operation-sentinel-574-arrests-africa-cybercrime</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/interpol-operation-sentinel-574-arrests-africa-cybercrime</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[INTERPOL]]></category>
            <category><![CDATA[Operation Sentinel]]></category>
            <category><![CDATA[Africa]]></category>
            <category><![CDATA[BEC]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[law enforcement]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1453733190371-0a9bedd82893?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1453733190371-0a9bedd82893?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical n8n Flaw Lets Attackers Execute Code on 100,000+ Instances]]></title>
            <description><![CDATA[CVE-2025-68613 in the workflow automation platform scores CVSS 9.9 with public PoC code now available. Patch to version 1.122.0 immediately.]]></description>
            <link>https://www.probablypwned.com/article/critical-n8n-rce-vulnerability-cve-2025-68613</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/critical-n8n-rce-vulnerability-cve-2025-68613</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2025-68613]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[workflow automation]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA's Pre-Ransomware Warning Program Loses Its Only Operator]]></title>
            <description><![CDATA[David Stern, the sole employee running CISA's ransomware early warning initiative, resigned December 19 after being ordered to relocate. The program had sent 2,100+ alerts in 2024.]]></description>
            <link>https://www.probablypwned.com/article/cisa-loses-ransomware-warning-program-lead-david-stern</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-loses-ransomware-warning-program-lead-david-stern</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[PRNI]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1434030216411-0b793f4b4173?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1434030216411-0b793f4b4173?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WatchGuard Firebox Zero-Day CVE-2025-14733 Actively Exploited, 125K Devices Exposed]]></title>
            <description><![CDATA[Critical out-of-bounds write vulnerability in WatchGuard Firebox firewalls under active exploitation with over 125,000 devices exposed online.]]></description>
            <link>https://www.probablypwned.com/article/watchguard-firebox-cve-2025-14733-actively-exploited</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/watchguard-firebox-cve-2025-14733-actively-exploited</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WatchGuard]]></category>
            <category><![CDATA[CVE-2025-14733]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[firewall]]></category>
            <category><![CDATA[active-exploitation]]></category>
            <category><![CDATA[VPN]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ukrainian National Pleads Guilty in Nefilim Ransomware Conspiracy]]></title>
            <description><![CDATA[Artem Stryzhak admits role in double-extortion ransomware attacks targeting large US and European companies from 2018 to 2021.]]></description>
            <link>https://www.probablypwned.com/article/ukrainian-nefilim-ransomware-affiliate-guilty-plea</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ukrainian-nefilim-ransomware-affiliate-guilty-plea</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Nefilim]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[guilty plea]]></category>
            <category><![CDATA[double extortion]]></category>
            <category><![CDATA[Ukraine]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1589578527966-fdac0f44566c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1589578527966-fdac0f44566c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Spotify's 300TB Music Library Scraped by Pirate Activist Group]]></title>
            <description><![CDATA[Anna's Archive claims to have scraped 86 million audio files from Spotify. The platform confirms DRM circumvention but says user data is not affected.]]></description>
            <link>https://www.probablypwned.com/article/spotify-300tb-music-library-scraped-annas-archive</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/spotify-300tb-music-library-scraped-annas-archive</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Spotify]]></category>
            <category><![CDATA[Anna's Archive]]></category>
            <category><![CDATA[data-scraping]]></category>
            <category><![CDATA[music-piracy]]></category>
            <category><![CDATA[DRM]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376593-902f74cf0d41?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376593-902f74cf0d41?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SonicWall Patches Exploited SMA1000 Zero-Day Used in Chained RCE Attack]]></title>
            <description><![CDATA[CVE-2025-40602 privilege escalation flaw combined with earlier vulnerability enables unauthenticated remote code execution on SonicWall appliances.]]></description>
            <link>https://www.probablypwned.com/article/sonicwall-sma1000-cve-2025-40602-chained-rce-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sonicwall-sma1000-cve-2025-40602-chained-rce-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SonicWall]]></category>
            <category><![CDATA[CVE-2025-40602]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[chained exploit]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iranian Infy APT Resurfaces After Five Years with Telegram-Based C2]]></title>
            <description><![CDATA[SafeBreach uncovers new Prince of Persia campaign using updated Foudre and Tonnerre malware, now leveraging Telegram for command and control.]]></description>
            <link>https://www.probablypwned.com/article/iranian-infy-apt-resurfaces-foudre-tonnerre-telegram</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iranian-infy-apt-resurfaces-foudre-tonnerre-telegram</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Infy]]></category>
            <category><![CDATA[Prince of Persia]]></category>
            <category><![CDATA[Foudre]]></category>
            <category><![CDATA[Tonnerre]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Romania's Water Management Agency Hit by Ransomware Attack Affecting 1,000 Systems]]></title>
            <description><![CDATA[Attackers weaponized Windows BitLocker to encrypt systems across Romanian Waters, impacting 10 of 11 river basin management organizations.]]></description>
            <link>https://www.probablypwned.com/article/romania-water-agency-ransomware-bitlocker-1000-systems</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/romania-water-agency-ransomware-bitlocker-1000-systems</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[Romania]]></category>
            <category><![CDATA[BitLocker]]></category>
            <category><![CDATA[water utility]]></category>
            <category><![CDATA[SCADA]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 22 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Former Incident Responders Plead Guilty to Running ALPHV Ransomware Attacks]]></title>
            <description><![CDATA[A Sygnia IR manager and DigitalMint negotiator admitted to deploying BlackCat ransomware while employed to help victims respond to such attacks.]]></description>
            <link>https://www.probablypwned.com/article/incident-responders-plead-guilty-alphv-blackcat-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/incident-responders-plead-guilty-alphv-blackcat-ransomware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[insider threat]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[ALPHV]]></category>
            <category><![CDATA[BlackCat]]></category>
            <category><![CDATA[incident response]]></category>
            <category><![CDATA[cybercrime]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 22 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DOJ Charges 54 in $40 Million ATM Jackpotting Scheme Linked to Venezuelan Gang]]></title>
            <description><![CDATA[Federal indictments target Tren de Aragua members who used Ploutus malware to steal over $40 million from U.S. ATMs since 2021.]]></description>
            <link>https://www.probablypwned.com/article/doj-charges-54-atm-jackpotting-ploutus-malware-tren-de-aragua</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/doj-charges-54-atm-jackpotting-ploutus-malware-tren-de-aragua</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ATM jackpotting]]></category>
            <category><![CDATA[Ploutus]]></category>
            <category><![CDATA[Tren de Aragua]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[financial crime]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Mon, 22 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Releases New BRICKSTORM Backdoor IOCs Tied to PRC State Actors]]></title>
            <description><![CDATA[Joint advisory from CISA, NSA, and Canadian Cyber Centre details new Rust-based variants of Chinese government malware targeting IT and government sectors.]]></description>
            <link>https://www.probablypwned.com/article/cisa-brickstorm-backdoor-rust-prc-state-sponsored</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-brickstorm-backdoor-rust-prc-state-sponsored</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[BRICKSTORM]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[Rust]]></category>
            <category><![CDATA[state-sponsored]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 22 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[The 10 Biggest Cyber Stories of 2025: A Year of Record-Breaking Attacks]]></title>
            <description><![CDATA[From the largest cryptocurrency heist in history to nation-state espionage campaigns targeting critical infrastructure, 2025 redefined the cyber threat landscape.]]></description>
            <link>https://www.probablypwned.com/article/top-10-cyber-stories-2025-year-in-review</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/top-10-cyber-stories-2025-year-in-review</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[year-in-review]]></category>
            <category><![CDATA[Lazarus Group]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[Salt Typhoon]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 21 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SantaStealer Malware-as-a-Service Launches Just in Time for the Holidays]]></title>
            <description><![CDATA[Russian-developed infostealer now production-ready after December 16 release, targets browser credentials, crypto wallets, and messaging apps for $175/month.]]></description>
            <link>https://www.probablypwned.com/article/santastealer-malware-as-service-telegram-launch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/santastealer-malware-as-service-telegram-launch</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[SantaStealer]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[credential-theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[React2Shell Vulnerability Now Weaponized in Ransomware Campaigns]]></title>
            <description><![CDATA[CVE-2025-55182 exploitation escalates as Weaxor ransomware operators use critical React Server Components flaw for initial access across 60+ organizations.]]></description>
            <link>https://www.probablypwned.com/article/react2shell-cve-2025-55182-ransomware-initial-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/react2shell-cve-2025-55182-ransomware-initial-access</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-55182]]></category>
            <category><![CDATA[React]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Next.js]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Weaxor]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633356122544-f134324a6cee?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633356122544-f134324a6cee?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LongNosedGoblin: New China-Aligned APT Abuses Group Policy for Espionage]]></title>
            <description><![CDATA[ESET researchers discover sophisticated threat actor targeting Southeast Asian and Japanese governments using Windows Group Policy for lateral movement.]]></description>
            <link>https://www.probablypwned.com/article/longnosedgoblin-china-apt-group-policy-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/longnosedgoblin-china-apt-group-policy-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[LongNosedGoblin]]></category>
            <category><![CDATA[Group Policy]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Southeast Asia]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Kimwolf Botnet Hijacks 1.8 Million Android TV Boxes for DDoS Attacks]]></title>
            <description><![CDATA[Massive Android botnet targets set-top boxes and tablets, issued 1.7 billion attack commands in 3 days, briefly surpassing Google in DNS rankings.]]></description>
            <link>https://www.probablypwned.com/article/kimwolf-android-botnet-1-8-million-devices-ddos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kimwolf-android-botnet-1-8-million-devices-ddos</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Kimwolf]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[AISURU]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Denmark Blames Russia for Destructive Cyberattack That Burst Water Pipes]]></title>
            <description><![CDATA[Danish intelligence attributes Z-Pentest hacktivist attack on Køge water utility to Russian state, summons ambassador over 'hybrid war' operations.]]></description>
            <link>https://www.probablypwned.com/article/denmark-blames-russia-destructive-water-utility-cyberattack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/denmark-blames-russia-destructive-water-utility-cyberattack</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[critical-infrastructure]]></category>
            <category><![CDATA[water-utility]]></category>
            <category><![CDATA[Z-Pentest]]></category>
            <category><![CDATA[Denmark]]></category>
            <category><![CDATA[hybrid-warfare]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1567264837824-c993e26bf663?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1567264837824-c993e26bf663?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Stole $2.02 Billion in Cryptocurrency During 2025]]></title>
            <description><![CDATA[DPRK-affiliated threat actors dominated crypto theft in 2025, accounting for 76% of exchange compromises with cumulative theft now exceeding $6.75 billion.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-cryptocurrency-theft-2025-two-billion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-cryptocurrency-theft-2025-two-billion</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[Lazarus Group]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Bybit]]></category>
            <category><![CDATA[theft]]></category>
            <category><![CDATA[DPRK]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 18 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[HPE Patches Maximum-Severity OneView RCE Vulnerability]]></title>
            <description><![CDATA[CVE-2025-37164 allows unauthenticated remote code execution against HPE OneView infrastructure management platforms running versions prior to 11.00.]]></description>
            <link>https://www.probablypwned.com/article/hpe-oneview-critical-rce-flaw-cve-2025-37164</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hpe-oneview-critical-rce-flaw-cve-2025-37164</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[HPE]]></category>
            <category><![CDATA[OneView]]></category>
            <category><![CDATA[CVE-2025-37164]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[infrastructure management]]></category>
            <category><![CDATA[patch]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 18 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco AsyncOS Zero-Day Exploited by China-Linked APT, No Patch Available]]></title>
            <description><![CDATA[Critical CVE-2025-20393 in Cisco Secure Email Gateway actively exploited by UAT-9686 threat actors deploying AquaShell backdoor since November.]]></description>
            <link>https://www.probablypwned.com/article/cisco-asyncos-zero-day-exploited-china-apt-cve-2025-20393</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-asyncos-zero-day-exploited-china-apt-cve-2025-20393</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2025-20393]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[email security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 18 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Warns of Asus Live Update Supply Chain Backdoor Under Active Attack]]></title>
            <description><![CDATA[CVE-2025-59374 exploits compromised ASUS software distribution to deploy backdoors on consumer and enterprise systems worldwide.]]></description>
            <link>https://www.probablypwned.com/article/cisa-asus-live-update-supply-chain-backdoor-cve-2025-59374</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-asus-live-update-supply-chain-backdoor-cve-2025-59374</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ASUS]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[CVE-2025-59374]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[backdoor]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 18 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China-Linked Ink Dragon APT Targets European Governments with ShadowPad]]></title>
            <description><![CDATA[Sophisticated threat group escalates operations against European government entities using relay networks that route attacks through multiple victim organizations.]]></description>
            <link>https://www.probablypwned.com/article/ink-dragon-china-apt-european-governments-shadowpad</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ink-dragon-china-apt-european-governments-shadowpad</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Ink Dragon]]></category>
            <category><![CDATA[ShadowPad]]></category>
            <category><![CDATA[FINALDRAFT]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Europe]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 17 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GhostPoster Malware Hides in Firefox Extension Logos, Infects 50,000 Users]]></title>
            <description><![CDATA[Security researchers uncover sophisticated steganography attack concealing malicious JavaScript within PNG logo files of 17 Firefox browser extensions.]]></description>
            <link>https://www.probablypwned.com/article/ghostposter-firefox-extensions-malware-steganography</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghostposter-firefox-extensions-malware-steganography</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Firefox]]></category>
            <category><![CDATA[browser extensions]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[ad fraud]]></category>
            <category><![CDATA[affiliate hijacking]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 17 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cellik Android Malware-as-a-Service Trojanizes Any Google Play App]]></title>
            <description><![CDATA[New $150/month malware platform allows attackers to create weaponized versions of legitimate Android apps while maintaining full functionality.]]></description>
            <link>https://www.probablypwned.com/article/cellik-android-malware-service-trojanizes-play-store-apps</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cellik-android-malware-service-trojanizes-play-store-apps</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[MaaS]]></category>
            <category><![CDATA[mobile security]]></category>
            <category><![CDATA[Cellik]]></category>
            <category><![CDATA[trojan]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 17 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Amazon Disrupts Multi-Year Russian GRU Campaign Targeting Energy Sector]]></title>
            <description><![CDATA[Amazon's threat intelligence team exposes and disrupts Sandworm operations targeting Western critical infrastructure through misconfigured edge devices.]]></description>
            <link>https://www.probablypwned.com/article/amazon-disrupts-russian-gru-sandworm-energy-sector-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/amazon-disrupts-russian-gru-sandworm-energy-sector-attacks</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT44]]></category>
            <category><![CDATA[Sandworm]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[GRU]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[energy sector]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 17 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Extension with 8 Million Users Caught Stealing AI Chats]]></title>
            <description><![CDATA[Urban VPN and related browser extensions secretly harvest conversations from ChatGPT, Claude, Copilot, and other AI platforms, selling data to advertisers.]]></description>
            <link>https://www.probablypwned.com/article/urban-vpn-chrome-extension-stealing-ai-chatbot-conversations</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/urban-vpn-chrome-extension-stealing-ai-chatbot-conversations</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Chrome-extension]]></category>
            <category><![CDATA[privacy]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[data-harvesting]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[Claude]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SoundCloud Confirms Breach Affecting 28 Million Users]]></title>
            <description><![CDATA[ShinyHunters cyber extortion group targets SoundCloud, compromising 20% of users and launching DDoS attacks. Company confirms email addresses exposed.]]></description>
            <link>https://www.probablypwned.com/article/soundcloud-breach-shinyhunters-extortion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/soundcloud-breach-shinyhunters-extortion</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[SoundCloud]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[DDoS]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical Fortinet FortiGate Auth Bypass Under Active Exploitation]]></title>
            <description><![CDATA[Two critical CVSS 9.8 vulnerabilities in FortiGate devices are being actively exploited just days after patch release. Attackers targeting SSO authentication.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-fortigate-authentication-bypass-actively-exploited</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-fortigate-authentication-bypass-actively-exploited</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2025-59718]]></category>
            <category><![CDATA[CVE-2025-59719]]></category>
            <category><![CDATA[authentication-bypass]]></category>
            <category><![CDATA[active-exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Warns Pro-Russia Hacktivists Attacking US Water and Energy]]></title>
            <description><![CDATA[Joint advisory from CISA, FBI, NSA warns of pro-Russia hacktivist groups successfully compromising SCADA systems at US water, energy, and food facilities.]]></description>
            <link>https://www.probablypwned.com/article/cisa-pro-russia-hacktivists-critical-infrastructure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-pro-russia-hacktivists-critical-infrastructure</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[critical-infrastructure]]></category>
            <category><![CDATA[OT-security]]></category>
            <category><![CDATA[SCADA]]></category>
            <category><![CDATA[hacktivism]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Maximum Severity Apache Tika Flaw Threatens Document Pipelines]]></title>
            <description><![CDATA[CVE-2025-66516 is a CVSS 10.0 XXE injection vulnerability in Apache Tika affecting Solr, Elasticsearch, and countless document processing systems.]]></description>
            <link>https://www.probablypwned.com/article/apache-tika-critical-xxe-vulnerability-cve-2025-66516</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apache-tika-critical-xxe-vulnerability-cve-2025-66516</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache-Tika]]></category>
            <category><![CDATA[CVE-2025-66516]]></category>
            <category><![CDATA[XXE]]></category>
            <category><![CDATA[critical]]></category>
            <category><![CDATA[document-processing]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
    </channel>
</rss>