<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0" xmlns:media="http://search.yahoo.com/mrss/">
    <channel>
        <title><![CDATA[ProbablyPwned - Cybersecurity News]]></title>
        <description><![CDATA[Your source for cybersecurity news, vulnerability analysis, and threat intelligence.]]></description>
        <link>https://www.probablypwned.com</link>
        <image>
            <url>https://www.probablypwned.com/logo.png</url>
            <title>ProbablyPwned - Cybersecurity News</title>
            <link>https://www.probablypwned.com</link>
        </image>
        <generator>RSS for Node</generator>
        <lastBuildDate>Mon, 13 Jul 2026 19:55:02 GMT</lastBuildDate>
        <atom:link href="https://www.probablypwned.com/rss.xml" rel="self" type="application/rss+xml"/>
        <pubDate>Mon, 13 Jul 2026 19:55:02 GMT</pubDate>
        <copyright><![CDATA[© 2026 ProbablyPwned]]></copyright>
        <language><![CDATA[en]]></language>
        <item>
            <title><![CDATA[Joomla iCagenda, Balbooa Forms Flaws Exploited as Zero-Days]]></title>
            <description><![CDATA[CISA adds CVE-2026-48939 and CVE-2026-56291 to KEV after attackers weaponized iCagenda and Balbooa Forms file upload bugs before patches existed. Federal deadline is July 13.]]></description>
            <link>https://www.probablypwned.com/article/joomla-icagenda-balbooa-forms-cve-2026-48939-cve-2026-56291-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/joomla-icagenda-balbooa-forms-cve-2026-48939-cve-2026-56291-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Joomla]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[CVE-2026-48939]]></category>
            <category><![CDATA[CVE-2026-56291]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 13 Jul 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[24 Billion Stolen Credentials Found in Exposed Elasticsearch Cluster]]></title>
            <description><![CDATA[Cybernews researchers discovered 8.3TB of stolen credentials—usernames, passwords, session tokens—in an unprotected database. Data came from 36 sources including infostealer logs and Telegram channels.]]></description>
            <link>https://www.probablypwned.com/article/24-billion-credentials-elasticsearch-infostealer-logs-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/24-billion-credentials-elasticsearch-infostealer-logs-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[credentials]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Elasticsearch]]></category>
            <category><![CDATA[data leak]]></category>
            <category><![CDATA[Telegram]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Mon, 13 Jul 2026 12:09:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China-Linked Hackers Hit University Mail Servers via Roundcube]]></title>
            <description><![CDATA[Proofpoint tracks UNK_MassTraction exploiting Roundcube flaws to target US and Canadian university physics departments. VShell post-exploitation tool deployed for persistent access.]]></description>
            <link>https://www.probablypwned.com/article/china-roundcube-university-espionage-unk-masstraction-astrophysics</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/china-roundcube-university-espionage-unk-masstraction-astrophysics</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Roundcube]]></category>
            <category><![CDATA[universities]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 13 Jul 2026 12:09:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-aa79dcee981c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-aa79dcee981c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenSSH 10.4 Patches 8 Flaws, Adds Post-Quantum Signatures]]></title>
            <description><![CDATA[OpenSSH 10.4 fixes eight security vulnerabilities including sftp/scp file redirection bugs and client-side use-after-free. Experimental ML-DSA post-quantum signatures debut.]]></description>
            <link>https://www.probablypwned.com/article/openssh-10-4-security-fixes-post-quantum-ml-dsa-ed25519</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openssh-10-4-security-fixes-post-quantum-ml-dsa-ed25519</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenSSH]]></category>
            <category><![CDATA[post-quantum]]></category>
            <category><![CDATA[sftp]]></category>
            <category><![CDATA[scp]]></category>
            <category><![CDATA[cryptography]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 13 Jul 2026 12:08:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[281 Android VPN Apps Leak Traffic, Send Data Unencrypted]]></title>
            <description><![CDATA[University researchers found critical security flaws in 281 popular Google Play VPN apps with 2.4 billion installs. 29 apps leak DNS queries, 61 transmit data in cleartext.]]></description>
            <link>https://www.probablypwned.com/article/android-vpn-apps-281-security-study-traffic-leaks-unencrypted-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/android-vpn-apps-281-security-study-traffic-leaks-unencrypted-data</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[Google Play]]></category>
            <category><![CDATA[privacy]]></category>
            <category><![CDATA[traffic leaks]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 13 Jul 2026 12:07:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Injective Labs npm Packages Backdoored to Steal Crypto Wallets]]></title>
            <description><![CDATA[Hackers compromised Injective Labs' GitHub repo to push malicious npm packages that steal cryptocurrency wallet keys. 18 packages affected, detected within an hour.]]></description>
            <link>https://www.probablypwned.com/article/injective-labs-npm-supply-chain-crypto-wallet-theft-18-packages</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/injective-labs-npm-supply-chain-crypto-wallet-theft-18-packages</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Injective Labs]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Mon, 13 Jul 2026 12:07:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1470225620780-dba8ba36b745?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1470225620780-dba8ba36b745?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RedHook Android RAT Weaponizes Wireless ADB for Shell Access]]></title>
            <description><![CDATA[Group-IB reveals RedHook banking trojan now exploits Android's Wireless Debugging to gain shell privileges without rooting. Active in Southeast Asia with 53 remote commands.]]></description>
            <link>https://www.probablypwned.com/article/redhook-android-rat-wireless-adb-shell-access-group-ib</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/redhook-android-rat-wireless-adb-shell-access-group-ib</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[RedHook]]></category>
            <category><![CDATA[ADB]]></category>
            <category><![CDATA[Mobile Malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 12 Jul 2026 15:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Exposed Server Reveals WP-SHELLSTORM Backdoored 25,000 WordPress Sites]]></title>
            <description><![CDATA[A misconfigured hacker server exposed 22 days of logs revealing a webshell access-brokerage operation that compromised over 25,000 WordPress sites using 27 weaponized CVEs.]]></description>
            <link>https://www.probablypwned.com/article/wp-shellstorm-wordpress-webshell-operation-25000-sites-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wp-shellstorm-wordpress-webshell-operation-25000-sites-exposed</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[webshell]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <category><![CDATA[CVE-2026-3844]]></category>
            <category><![CDATA[SOCRadar]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 12 Jul 2026 12:12:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Zimbra Patches Critical XSS That Runs Code When Opening Emails]]></title>
            <description><![CDATA[Zimbra urges immediate patching for a stored XSS flaw in Classic Web Client that executes malicious code when users open crafted emails. Google TAG reported the vulnerability.]]></description>
            <link>https://www.probablypwned.com/article/zimbra-critical-xss-email-code-execution-google-tag</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zimbra-critical-xss-email-code-execution-google-tag</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Zimbra]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[email security]]></category>
            <category><![CDATA[Google TAG]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 12 Jul 2026 12:09:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1596524430615-b46475ddff6e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1596524430615-b46475ddff6e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ghostcommit Attack Hides Prompts in Images to Steal Secrets from AI Agents]]></title>
            <description><![CDATA[Researchers demonstrate how malicious instructions hidden in PNG images can hijack AI coding assistants to exfiltrate credentials. Claude Code resisted the attack while Cursor and others complied.]]></description>
            <link>https://www.probablypwned.com/article/ghostcommit-ai-prompt-injection-png-images-secret-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghostcommit-ai-prompt-injection-png-images-secret-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[Cursor]]></category>
            <category><![CDATA[Claude]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 12 Jul 2026 12:07:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Progress Orders ShareFile Storage Zone Shutdown Over Security Threat]]></title>
            <description><![CDATA[Progress Software tells ShareFile customers to immediately shut down Storage Zone Controllers due to a credible security threat. The company disabled affected accounts while investigating.]]></description>
            <link>https://www.probablypwned.com/article/progress-sharefile-emergency-shutdown-storage-zone-controller</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/progress-sharefile-emergency-shutdown-storage-zone-controller</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Progress]]></category>
            <category><![CDATA[ShareFile]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[emergency]]></category>
            <category><![CDATA[file sharing]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 12 Jul 2026 12:05:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[jscrambler npm Compromise Drops Rust Stealer Targeting AI Tools]]></title>
            <description><![CDATA[Attackers hijacked the jscrambler npm package to deploy a cross-platform Rust infostealer that harvests credentials from AI coding assistants, cloud platforms, and crypto wallets.]]></description>
            <link>https://www.probablypwned.com/article/jscrambler-npm-supply-chain-rust-infostealer-ai-tools</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/jscrambler-npm-supply-chain-rust-infostealer-ai-tools</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[jscrambler]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 12 Jul 2026 12:03:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[13-Year-Old U-Boot Flaws Enable Pre-OS Attacks on Embedded Devices]]></title>
            <description><![CDATA[Binarly uncovers six vulnerabilities in U-Boot's FIT signature verification present since 2013, affecting millions of BMCs, routers, and IoT devices. Patches exist but downstream adoption lags.]]></description>
            <link>https://www.probablypwned.com/article/u-boot-fit-signature-flaws-binarly-pre-os-code-execution</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/u-boot-fit-signature-flaws-binarly-pre-os-code-execution</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[U-Boot]]></category>
            <category><![CDATA[firmware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[embedded security]]></category>
            <category><![CDATA[Binarly]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 11 Jul 2026 15:22:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lurking Lizard Turns Victims Into Proxy Nodes via Fake 7-Zip, WireVPN]]></title>
            <description><![CDATA[China-based threat actor Lurking Lizard operates 230+ lookalike domains serving trojanized 7-Zip installers and the WireVPN app to recruit victims into a residential proxy botnet without consent.]]></description>
            <link>https://www.probablypwned.com/article/lurking-lizard-fake-7zip-wirevpn-residential-proxy-botnet-china</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lurking-lizard-fake-7zip-wirevpn-residential-proxy-botnet-china</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Lurking Lizard]]></category>
            <category><![CDATA[residential proxy]]></category>
            <category><![CDATA[WireVPN]]></category>
            <category><![CDATA[proxyware]]></category>
            <category><![CDATA[China]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 11 Jul 2026 12:10:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AssuranceAmerica Breach Exposes 6.9M Driver's License Numbers]]></title>
            <description><![CDATA[Insurance provider AssuranceAmerica disclosed a data breach affecting 6.9 million customers—the largest known exposure of driver's license numbers in 2026. Attackers compromised employee credentials.]]></description>
            <link>https://www.probablypwned.com/article/assuranceamerica-data-breach-6-9-million-drivers-license-numbers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/assuranceamerica-data-breach-6-9-million-drivers-license-numbers</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[AssuranceAmerica]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[driver's license]]></category>
            <category><![CDATA[identity theft]]></category>
            <category><![CDATA[insurance]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 11 Jul 2026 12:08:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[INTERPOL Operation First Light Nets 5,800 Arrests, $293M Seized]]></title>
            <description><![CDATA[INTERPOL's Operation First Light 2026 led to 5,811 arrests across 97 countries, seizing $293 million from social engineering fraud networks including BEC, romance scams, and crypto laundering operations.]]></description>
            <link>https://www.probablypwned.com/article/interpol-operation-first-light-2026-5800-arrests-293-million-seized</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/interpol-operation-first-light-2026-5800-arrests-293-million-seized</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[INTERPOL]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[fraud]]></category>
            <category><![CDATA[business email compromise]]></category>
            <category><![CDATA[money laundering]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 11 Jul 2026 12:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Palo Alto Patches CVSS 9.2 Buffer Overflow, Warns of Auth Bypass Exploitation]]></title>
            <description><![CDATA[Palo Alto Networks addresses 13 PAN-OS vulnerabilities including CVE-2026-0288 (CVSS 9.2) buffer overflow and CVE-2026-0257 auth bypass under active exploitation by unknown threat actors.]]></description>
            <link>https://www.probablypwned.com/article/palo-alto-pan-os-cve-2026-0288-buffer-overflow-cve-2026-0257-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/palo-alto-pan-os-cve-2026-0288-buffer-overflow-cve-2026-0257-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Palo Alto Networks]]></category>
            <category><![CDATA[PAN-OS]]></category>
            <category><![CDATA[CVE-2026-0288]]></category>
            <category><![CDATA[CVE-2026-0257]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 11 Jul 2026 12:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Huntress Employee Allegedly Tipped Off Ransomware Actor About FBI]]></title>
            <description><![CDATA[Former analyst claims a Huntress threat hunter shared FBI communications with ransomware operator Devman, including agent names. CEO admits 'poor judgment' but denies illegality.]]></description>
            <link>https://www.probablypwned.com/article/huntress-insider-threat-fbi-devman-ransomware-whistleblower</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/huntress-insider-threat-fbi-devman-ransomware-whistleblower</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[insider-threat]]></category>
            <category><![CDATA[huntress]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[fbi]]></category>
            <category><![CDATA[whistleblower]]></category>
            <category><![CDATA[devman]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 10 Jul 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware Negotiator Who Fed Intel to BlackCat Gets 70 Months]]></title>
            <description><![CDATA[Angelo Martino leaked client insurance limits and negotiation strategies to the ransomware gang he was hired to negotiate against. Federal court sentences the double agent to nearly six years.]]></description>
            <link>https://www.probablypwned.com/article/angelo-martino-ransomware-negotiator-blackcat-sentenced-70-months</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/angelo-martino-ransomware-negotiator-blackcat-sentenced-70-months</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[blackcat]]></category>
            <category><![CDATA[alphv]]></category>
            <category><![CDATA[law-enforcement]]></category>
            <category><![CDATA[insider-threat]]></category>
            <category><![CDATA[digitalmint]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 10 Jul 2026 12:06:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1503376780353-7e6692767b70?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1503376780353-7e6692767b70?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Weaponize 50+ Dormant GitHub Accounts to Map Corporate Repos]]></title>
            <description><![CDATA[Datadog Security Labs exposes coordinated campaigns using aged 'ghost' accounts to enumerate organizations via GitHub API. Some attackers escalated from reconnaissance to cloning private repositories.]]></description>
            <link>https://www.probablypwned.com/article/github-dormant-accounts-reconnaissance-datadog-private-repo-cloning</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/github-dormant-accounts-reconnaissance-datadog-private-repo-cloning</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[github]]></category>
            <category><![CDATA[reconnaissance]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[datadog]]></category>
            <category><![CDATA[api-abuse]]></category>
            <category><![CDATA[credential-theft]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 10 Jul 2026 12:05:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GhostApproval: Symlink Flaw Lets Malicious Repos Escape AI Coding Sandboxes]]></title>
            <description><![CDATA[Wiz researchers discover six major AI coding assistants vulnerable to symlink attacks. Malicious repos can trick Claude Code, Cursor, and Amazon Q into writing files outside designated workspaces.]]></description>
            <link>https://www.probablypwned.com/article/ghostapproval-ai-coding-assistants-symlink-escape-wiz-cve-2026-12958</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghostapproval-ai-coding-assistants-symlink-escape-wiz-cve-2026-12958</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ai-security]]></category>
            <category><![CDATA[claude-code]]></category>
            <category><![CDATA[cursor]]></category>
            <category><![CDATA[amazon-q]]></category>
            <category><![CDATA[symlink]]></category>
            <category><![CDATA[cve-2026-12958]]></category>
            <category><![CDATA[developer-tools]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 10 Jul 2026 12:04:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EtherRAT Spreads via Fake IT Support Calls on Microsoft Teams]]></title>
            <description><![CDATA[Unit 42 uncovers Node.js-based RAT using Ethereum smart contracts for C2. Attackers impersonate IT staff on Teams calls to install remote access tools before deploying EtherRAT.]]></description>
            <link>https://www.probablypwned.com/article/etherrat-microsoft-teams-fake-it-support-ethereum-c2-unit42</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/etherrat-microsoft-teams-fake-it-support-ethereum-c2-unit42</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[etherrat]]></category>
            <category><![CDATA[microsoft-teams]]></category>
            <category><![CDATA[social-engineering]]></category>
            <category><![CDATA[ethereum]]></category>
            <category><![CDATA[unit42]]></category>
            <category><![CDATA[vishing]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 10 Jul 2026 12:04:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1519389950473-47ba0277781c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1519389950473-47ba0277781c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GodDamn Ransomware Weaponizes Microsoft-Signed PoisonX Driver]]></title>
            <description><![CDATA[Symantec exposes GodDamn ransomware's BYOVD attack using Microsoft-signed PoisonX kernel driver to blind EDR tools. Here's how Hyadina's latest variant works and what defenders should watch for.]]></description>
            <link>https://www.probablypwned.com/article/goddamn-ransomware-poisonx-byovd-hyadina-microsoft-signed-driver</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/goddamn-ransomware-poisonx-byovd-hyadina-microsoft-signed-driver</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[byovd]]></category>
            <category><![CDATA[poisonx]]></category>
            <category><![CDATA[hyadina]]></category>
            <category><![CDATA[kernel-driver]]></category>
            <category><![CDATA[edr-bypass]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 10 Jul 2026 12:03:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Helix Vishing Group Emerges From BlackFile Ashes, Targets SharePoint]]></title>
            <description><![CDATA[New data extortion group Helix uses vishing and device code phishing to steal SharePoint data from Medtronic, Nissan, and others. ReliaQuest links infrastructure to defunct BlackFile.]]></description>
            <link>https://www.probablypwned.com/article/helix-vishing-sharepoint-data-extortion-blackfile-shinyhunters</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/helix-vishing-sharepoint-data-extortion-blackfile-shinyhunters</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[SharePoint]]></category>
            <category><![CDATA[device-code-phishing]]></category>
            <category><![CDATA[data-extortion]]></category>
            <category><![CDATA[Helix]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 09 Jul 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[16-Year Linux KVM Bug Enables VM-to-Host Escape on Intel and AMD]]></title>
            <description><![CDATA[Januscape vulnerability CVE-2026-53359 allows guest VM root users to corrupt host kernel memory and escape to host. First KVM exploit affecting both Intel and AMD architectures simultaneously.]]></description>
            <link>https://www.probablypwned.com/article/linux-kvm-januscape-cve-2026-53359-vm-escape-16-year-flaw</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/linux-kvm-januscape-cve-2026-53359-vm-escape-16-year-flaw</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[KVM]]></category>
            <category><![CDATA[CVE-2026-53359]]></category>
            <category><![CDATA[VM escape]]></category>
            <category><![CDATA[virtualization]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 09 Jul 2026 12:10:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gitea Auth Bypass CVE-2026-20896 Exploited 13 Days After Patch]]></title>
            <description><![CDATA[Critical Gitea Docker vulnerability allows full admin access via single X-WEBAUTH-USER header injection. 6,200 exposed instances at risk as attackers begin active scanning.]]></description>
            <link>https://www.probablypwned.com/article/gitea-cve-2026-20896-auth-bypass-header-injection-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gitea-cve-2026-20896-auth-bypass-header-injection-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Gitea]]></category>
            <category><![CDATA[CVE-2026-20896]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 09 Jul 2026 12:09:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Paysafe and Skrill SDKs on npm and PyPI Steal CI/CD Secrets]]></title>
            <description><![CDATA[17 malicious packages masquerading as payment processor SDKs exfiltrate API keys, AWS credentials, and GitHub tokens from developer environments. Packages flagged within 6 minutes of upload.]]></description>
            <link>https://www.probablypwned.com/article/npm-pypi-fake-payment-sdk-paysafe-skrill-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/npm-pypi-fake-payment-sdk-paysafe-skrill-credential-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Paysafe]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 09 Jul 2026 12:08:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Everest Ransomware Uses Wake-on-LAN to Revive Dormant Hosts]]></title>
            <description><![CDATA[Technical analysis reveals Everest ransomware wakes sleeping machines via ARP cache parsing before encryption. ConfuserEx obfuscation and deceptive crypto declarations complicate response.]]></description>
            <link>https://www.probablypwned.com/article/everest-ransomware-wake-on-lan-confuserex-encryption-analysis</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/everest-ransomware-wake-on-lan-confuserex-encryption-analysis</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Wake-on-LAN]]></category>
            <category><![CDATA[ConfuserEx]]></category>
            <category><![CDATA[.NET malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 09 Jul 2026 12:06:53 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654291663-b91ad427698f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654291663-b91ad427698f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China's UAT-7810 Deploys Three New Backdoors Targeting SOHO Routers]]></title>
            <description><![CDATA[China-linked APT UAT-7810 expands LapDogs campaign with LongLeash, DogLeash, and JarLeash backdoors. Over 1,000 Ruckus and Asus routers compromised for espionage relay network.]]></description>
            <link>https://www.probablypwned.com/article/uat-7810-lapdogs-china-apt-new-backdoors-soho-routers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-7810-lapdogs-china-apt-new-backdoors-soho-routers</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[UAT-7810]]></category>
            <category><![CDATA[LapDogs]]></category>
            <category><![CDATA[SOHO routers]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 09 Jul 2026 12:05:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pink Vishing Campaign Hijacks Entra Passkeys to Steal M365 Accounts]]></title>
            <description><![CDATA[Threat actor O-UNC-066 runs voice phishing campaign tricking Microsoft 365 users into enrolling attacker-controlled Entra passkeys. Real-time MFA bypass enables full account takeover.]]></description>
            <link>https://www.probablypwned.com/article/pink-vishing-entra-passkey-microsoft-365-account-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pink-vishing-entra-passkey-microsoft-365-account-takeover</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[Entra passkey]]></category>
            <category><![CDATA[O-UNC-066]]></category>
            <category><![CDATA[Pink]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 09 Jul 2026 12:04:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds 4 CVEs to KEV: Joomla, ColdFusion Under Active Attack]]></title>
            <description><![CDATA[CISA adds four actively exploited vulnerabilities to KEV catalog including two max-severity Joomla plugin flaws and Adobe ColdFusion CVE-2026-48282. Federal deadline is July 10.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-joomla-coldfusion-langflow-4-cves-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-joomla-coldfusion-langflow-4-cves-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[Joomla]]></category>
            <category><![CDATA[Adobe ColdFusion]]></category>
            <category><![CDATA[CVE-2026-48282]]></category>
            <category><![CDATA[CVE-2026-56290]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 09 Jul 2026 12:03:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Device Code Phishing Surges 1,380% — MFA Won't Save You]]></title>
            <description><![CDATA[Device code phishing attacks jumped 1,380% in early 2026. EvilTokens and 17 other PhaaS kits now offer turnkey identity theft that bypasses MFA and passkeys.]]></description>
            <link>https://www.probablypwned.com/article/device-code-phishing-1380-percent-surge-eviltokens-mfa-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/device-code-phishing-1380-percent-surge-eviltokens-mfa-bypass</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[device code phishing]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[EvilTokens]]></category>
            <category><![CDATA[phishing-as-a-service]]></category>
            <category><![CDATA[identity theft]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 08 Jul 2026 12:07:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Accenture Confirms Breach: 35GB Source Code, Keys Stolen]]></title>
            <description><![CDATA[Threat actor '888' offers 35GB of Accenture data for sale including source code, RSA keys, SSH keys, and Azure tokens. Third major breach for the IT giant.]]></description>
            <link>https://www.probablypwned.com/article/accenture-data-breach-35gb-source-code-azure-tokens-888</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/accenture-data-breach-35gb-source-code-azure-tokens-888</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Accenture]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[source code]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[threat actor 888]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 08 Jul 2026 12:06:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ChocoPoC RAT Targets Researchers via Fake Exploit Repos]]></title>
            <description><![CDATA[Malicious Python PoC repositories on GitHub deliver ChocoPoC RAT to security researchers. The trojan steals credentials and provides remote access via Mapbox dead drops.]]></description>
            <link>https://www.probablypwned.com/article/chocopoc-rat-fake-exploit-repos-security-researchers-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chocopoc-rat-fake-exploit-repos-security-researchers-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ChocoPoC]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[security researchers]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[RAT]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 08 Jul 2026 12:06:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BeyondTrust Patches Four Auth Bypass Flaws in Remote Support]]></title>
            <description><![CDATA[CVE-2026-40138 and CVE-2026-40139 (CVSS 9.2) enable pre-auth bypass in BeyondTrust Remote Support and PRA. Flaws found using Claude AI during internal audit.]]></description>
            <link>https://www.probablypwned.com/article/beyondtrust-cve-2026-40138-auth-bypass-remote-support-pra</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/beyondtrust-cve-2026-40138-auth-bypass-remote-support-pra</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[BeyondTrust]]></category>
            <category><![CDATA[CVE-2026-40138]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[remote support]]></category>
            <category><![CDATA[privileged access]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 08 Jul 2026 12:05:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ubiquiti Patches 7 Critical UniFi OS Flaws — Max Severity]]></title>
            <description><![CDATA[Ubiquiti warns of CVE-2026-50746 (CVSS 10.0) and six other critical vulnerabilities affecting UniFi OS devices. 100,000 instances exposed online require immediate patching.]]></description>
            <link>https://www.probablypwned.com/article/ubiquiti-unifi-os-cve-2026-50746-max-severity-command-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ubiquiti-unifi-os-cve-2026-50746-max-severity-command-injection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ubiquiti]]></category>
            <category><![CDATA[UniFi]]></category>
            <category><![CDATA[CVE-2026-50746]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 08 Jul 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1667372393119-3d4c48d07fc9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1667372393119-3d4c48d07fc9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Tenda Router Backdoor Grants Admin Access — No Patch Available]]></title>
            <description><![CDATA[CERT/CC warns of CVE-2026-11405, an undocumented authentication backdoor in Tenda router firmware. The vendor remains unreachable with no fix in sight.]]></description>
            <link>https://www.probablypwned.com/article/tenda-router-cve-2026-11405-backdoor-admin-access-no-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tenda-router-cve-2026-11405-backdoor-admin-access-no-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Tenda]]></category>
            <category><![CDATA[CVE-2026-11405]]></category>
            <category><![CDATA[router backdoor]]></category>
            <category><![CDATA[CERT/CC]]></category>
            <category><![CDATA[network security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 07 Jul 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Langflow Flaw Lets Anyone Execute Code on AI Workflow Servers]]></title>
            <description><![CDATA[CVE-2026-10134 enables unauthenticated RCE in Langflow OSS through public flows. Attackers can run arbitrary Python on servers via the build endpoint.]]></description>
            <link>https://www.probablypwned.com/article/langflow-cve-2026-10134-unauthenticated-rce-public-flows-python</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langflow-cve-2026-10134-unauthenticated-rce-public-flows-python</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-10134]]></category>
            <category><![CDATA[Langflow]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[LLM frameworks]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 07 Jul 2026 12:05:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[JetBrains Patches Critical Flaws Enabling IDE and Hub Takeover]]></title>
            <description><![CDATA[JetBrains fixes CVSS 9.8 account takeover bug in Hub and multiple RCE vulnerabilities across IntelliJ, GoLand, and other IDEs. Update immediately.]]></description>
            <link>https://www.probablypwned.com/article/jetbrains-hub-intellij-goland-critical-cves-account-takeover-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/jetbrains-hub-intellij-goland-critical-cves-account-takeover-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[JetBrains]]></category>
            <category><![CDATA[IntelliJ]]></category>
            <category><![CDATA[CVE-2026-56141]]></category>
            <category><![CDATA[CVE-2026-49366]]></category>
            <category><![CDATA[IDE security]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 07 Jul 2026 12:04:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ToddyCat Deploys Umbrij to Steal Gmail Access via OAuth Hijacking]]></title>
            <description><![CDATA[Kaspersky uncovers Umbrij, a .NET tool used by APT group ToddyCat to steal Gmail OAuth tokens through browser remote debugging—no credentials needed.]]></description>
            <link>https://www.probablypwned.com/article/toddycat-umbrij-malware-gmail-oauth-shadow-token-debug</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/toddycat-umbrij-malware-gmail-oauth-shadow-token-debug</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ToddyCat]]></category>
            <category><![CDATA[Umbrij]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[Gmail]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 07 Jul 2026 12:04:01 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1470225620780-dba8ba36b745?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1470225620780-dba8ba36b745?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TrojPix Exfiltrates Data From Air-Gapped PCs via Video Cable Radio]]></title>
            <description><![CDATA[Researchers demonstrate TrojPix, an attack that turns invisible pixel changes into radio signals leaking data at 8.1 Mbps from air-gapped systems up to 208 meters away.]]></description>
            <link>https://www.probablypwned.com/article/trojpix-air-gapped-system-data-exfiltration-pixel-radio-208m</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trojpix-air-gapped-system-data-exfiltration-pixel-radio-208m</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[air-gapped systems]]></category>
            <category><![CDATA[covert channels]]></category>
            <category><![CDATA[TrojPix]]></category>
            <category><![CDATA[electromagnetic attack]]></category>
            <category><![CDATA[USENIX Security]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 07 Jul 2026 12:03:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-aa79dcee981c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-aa79dcee981c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Catalyst Center Flaw Exposes Sensitive Files to Remote Attackers]]></title>
            <description><![CDATA[CVE-2026-20191 in Cisco Catalyst Center allows unauthenticated attackers to read arbitrary files through path traversal. Affects version 3.1+ across hardware appliances and cloud deployments.]]></description>
            <link>https://www.probablypwned.com/article/cisco-catalyst-center-cve-2026-20191-path-traversal-file-read</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-catalyst-center-cve-2026-20191-path-traversal-file-read</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20191]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[Catalyst Center]]></category>
            <category><![CDATA[network infrastructure]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 06 Jul 2026 12:09:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Armored Likho APT Hits Power Grids With AI-Generated Malware]]></title>
            <description><![CDATA[New threat group Armored Likho targets government agencies and power sectors in Russia, Brazil, and Kazakhstan using BusySnake Stealer—malware with AI-generated loader code and reverse SSH tunneling capabilities.]]></description>
            <link>https://www.probablypwned.com/article/armored-likho-busysnake-stealer-ai-malware-power-grid-government</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/armored-likho-busysnake-stealer-ai-malware-power-grid-government</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Armored Likho]]></category>
            <category><![CDATA[BusySnake Stealer]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 06 Jul 2026 12:08:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Opera Ships Paste Protect—First Browser Defense Against ClickFix]]></title>
            <description><![CDATA[Opera becomes the first browser to ship native protection against ClickFix attacks with Paste Protect, blocking malicious clipboard content before users can execute it in terminals or command prompts.]]></description>
            <link>https://www.probablypwned.com/article/opera-paste-protect-clickfix-clipboard-attack-defense</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/opera-paste-protect-clickfix-clipboard-attack-defense</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Opera]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[clipboard attack]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 06 Jul 2026 12:06:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Oracle E-Business CVE-2026-46817 Under Active Attack—CVSS 9.8]]></title>
            <description><![CDATA[Critical authentication bypass in Oracle Payments (CVE-2026-46817) is being actively exploited. Over 900 vulnerable instances exposed online, with attackers achieving system takeover via unauthenticated HTTP requests.]]></description>
            <link>https://www.probablypwned.com/article/oracle-e-business-cve-2026-46817-payments-auth-bypass-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-e-business-cve-2026-46817-payments-auth-bypass-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[CVE-2026-46817]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[Oracle E-Business Suite]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 06 Jul 2026 12:05:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1556745757-8d76bdb6984b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1556745757-8d76bdb6984b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome 151 Patches 382 Flaws Including 15 Critical RCE Bugs]]></title>
            <description><![CDATA[Google releases Chrome 151 fixing 382 vulnerabilities including 15 critical use-after-free and type confusion bugs enabling remote code execution across Windows, macOS, and Linux.]]></description>
            <link>https://www.probablypwned.com/article/chrome-151-security-update-382-vulnerabilities-15-critical-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-151-security-update-382-vulnerabilities-15-critical-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Google Chrome]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[use-after-free]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 06 Jul 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Flipper Zero Hands Firmware Future to Community Contributors]]></title>
            <description><![CDATA[Flipper Devices shifts to community-driven firmware development with new contribution rules, mandatory testing, and GitHub-based voting while focusing on Flipper One and new products.]]></description>
            <link>https://www.probablypwned.com/article/flipper-zero-firmware-community-development-shift-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/flipper-zero-firmware-community-development-shift-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Flipper Zero]]></category>
            <category><![CDATA[open source]]></category>
            <category><![CDATA[firmware]]></category>
            <category><![CDATA[hardware security]]></category>
            <category><![CDATA[community development]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Sun, 05 Jul 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Millennium RAT Rewritten in C++, Infects 62,000 Devices in 160 Countries]]></title>
            <description><![CDATA[Group-IB tracks Y2K Operators distributing upgraded Millennium RAT through game cheats and cracked software. Telegram serves as C2 channel.]]></description>
            <link>https://www.probablypwned.com/article/millennium-rat-cpp-rewrite-telegram-c2-62000-devices-maas</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/millennium-rat-cpp-rewrite-telegram-c2-62000-devices-maas</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Millennium RAT]]></category>
            <category><![CDATA[MaaS]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[Y2K Operators]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[remote access trojan]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sun, 05 Jul 2026 12:08:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654291663-b91ad427698f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654291663-b91ad427698f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Turn Stolen AI Compute Into Autonomous Hacking Tools]]></title>
            <description><![CDATA[LLMjacking evolves as threat actors hijack exposed Ollama servers to power multi-stage VAPT frameworks that scan, exploit, and compromise targets automatically.]]></description>
            <link>https://www.probablypwned.com/article/llmjacking-vapt-framework-ollama-offensive-ai-compute-hijacking</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/llmjacking-vapt-framework-ollama-offensive-ai-compute-hijacking</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[LLMjacking]]></category>
            <category><![CDATA[Ollama]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[VAPT]]></category>
            <category><![CDATA[offensive AI]]></category>
            <category><![CDATA[compute hijacking]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 05 Jul 2026 12:07:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vect and TeamPCP Alliance Creates 'Industrialized Ransomware' Pipeline]]></title>
            <description><![CDATA[Sophos and FBI warn of new partnership combining supply chain credential theft with ransomware deployment. 500,000 credentials already stolen.]]></description>
            <link>https://www.probablypwned.com/article/vect-teampcp-partnership-industrialized-ransomware-sophos-fbi-warning</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vect-teampcp-partnership-industrialized-ransomware-sophos-fbi-warning</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Vect]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[Sophos]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 05 Jul 2026 12:06:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Citrix NetScaler Hit by CitrixBleed-Style Flaw—Exploited Within Hours]]></title>
            <description><![CDATA[CVE-2026-8451 and five other NetScaler vulnerabilities disclosed this week, with attackers already targeting SAML-configured appliances. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/citrix-netscaler-cve-2026-8451-citrixbleed-style-saml-memory-overread</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/citrix-netscaler-cve-2026-8451-citrixbleed-style-saml-memory-overread</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Citrix]]></category>
            <category><![CDATA[NetScaler]]></category>
            <category><![CDATA[CVE-2026-8451]]></category>
            <category><![CDATA[SAML]]></category>
            <category><![CDATA[memory overread]]></category>
            <category><![CDATA[CISA]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 05 Jul 2026 12:05:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI Agents Now Run Full Ransomware Operations With Minimal Human Help]]></title>
            <description><![CDATA[JADEPUFFER campaign shows AI agents autonomously exploiting vulnerabilities, moving laterally, and encrypting databases. Ransomware attacks up 42% as LLMs compress attack timelines to seconds.]]></description>
            <link>https://www.probablypwned.com/article/ai-ransomware-automation-jadepuffer-llm-orchestrated-attacks-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-ransomware-automation-jadepuffer-llm-orchestrated-attacks-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI ransomware]]></category>
            <category><![CDATA[JADEPUFFER]]></category>
            <category><![CDATA[LLM attacks]]></category>
            <category><![CDATA[Ransomware 3.0]]></category>
            <category><![CDATA[autonomous malware]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 04 Jul 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Medtronic Breach Exposes 3.8 Million Patients' Health Data]]></title>
            <description><![CDATA[Pacemaker maker Medtronic notifies 3.8 million patients after April breach exposed SSNs and health information. ShinyHunters claims responsibility for the attack.]]></description>
            <link>https://www.probablypwned.com/article/medtronic-data-breach-3-8-million-patients-shinyhunters</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/medtronic-data-breach-3-8-million-patients-shinyhunters</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Medtronic]]></category>
            <category><![CDATA[healthcare breach]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[PHI]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 04 Jul 2026 12:08:39 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TimbreStealer Hijacks Edge and Chrome Updaters via DLL Sideload]]></title>
            <description><![CDATA[New infostealer campaign abuses EdgeUpdate and GoogleUpdater binaries through DLL sideloading to target Mexican businesses. Invoice-themed lures deliver credential theft malware.]]></description>
            <link>https://www.probablypwned.com/article/timbrestealer-dll-sideloading-edgeupdate-googleupdater-mexico</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/timbrestealer-dll-sideloading-edgeupdate-googleupdater-mexico</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TimbreStealer]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Mexico]]></category>
            <category><![CDATA[EdgeUpdate]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 04 Jul 2026 12:07:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1519389950473-47ba0277781c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1519389950473-47ba0277781c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiBleed Credential Theft Tied to Lynx and INC Ransomware]]></title>
            <description><![CDATA[SOCRadar links FortiBleed to INC and Lynx ransomware operations. 430,000 FortiGate firewalls targeted, 110 million credentials stolen, 12+ ransomware deployments confirmed.]]></description>
            <link>https://www.probablypwned.com/article/fortibleed-credential-theft-lynx-inc-ransomware-operation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortibleed-credential-theft-lynx-inc-ransomware-operation</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FortiBleed]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[Lynx ransomware]]></category>
            <category><![CDATA[INC ransomware]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 04 Jul 2026 12:06:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Avalon Malware Framework Bundles Credentials, Ransomware, Wiper]]></title>
            <description><![CDATA[New modular malware framework Avalon combines credential theft, lateral movement, and CrownX ransomware in one package. AI-assisted development suspected.]]></description>
            <link>https://www.probablypwned.com/article/avalon-malware-framework-crownx-ransomware-multi-stage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/avalon-malware-framework-crownx-ransomware-multi-stage</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Avalon]]></category>
            <category><![CDATA[CrownX]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[modular malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 04 Jul 2026 12:06:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BlueHammer: Defender Flaw Now Weaponized by Ransomware Gangs]]></title>
            <description><![CDATA[CISA confirms ransomware groups are exploiting CVE-2026-33825, a Microsoft Defender privilege escalation flaw leaked in April. Patch urgently if you haven't already.]]></description>
            <link>https://www.probablypwned.com/article/bluehammer-cve-2026-33825-microsoft-defender-ransomware-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bluehammer-cve-2026-33825-microsoft-defender-ransomware-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-33825]]></category>
            <category><![CDATA[Microsoft Defender]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 04 Jul 2026 12:05:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510557880182-3d4d3cba35a5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510557880182-3d4d3cba35a5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DHS Confirms HSIN Breach During World Cup Security Operations]]></title>
            <description><![CDATA[Hackers breached the Homeland Security Information Network between May and June, compromising sensitive but unclassified data while the US hosts FIFA World Cup games.]]></description>
            <link>https://www.probablypwned.com/article/dhs-hsin-breach-world-cup-security-network-compromised</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dhs-hsin-breach-world-cup-security-network-compromised</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DHS]]></category>
            <category><![CDATA[HSIN]]></category>
            <category><![CDATA[government breach]]></category>
            <category><![CDATA[World Cup]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 04 Jul 2026 12:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1503376780353-7e6692767b70?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1503376780353-7e6692767b70?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Bad Epoll: Linux Kernel Flaw Grants Root on Servers and Android]]></title>
            <description><![CDATA[CVE-2026-46242 exploits a use-after-free race in Linux epoll, giving unprivileged users root access with 99% reliability. Servers and Android devices at risk.]]></description>
            <link>https://www.probablypwned.com/article/bad-epoll-cve-2026-46242-linux-kernel-root-android</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bad-epoll-cve-2026-46242-linux-kernel-root-android</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-46242]]></category>
            <category><![CDATA[Linux kernel]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[use-after-free]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 04 Jul 2026 12:03:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Kemp LoadMaster Pre-Auth RCE Exploited Days After PoC Release]]></title>
            <description><![CDATA[CVE-2026-8037 lets unauthenticated attackers execute root-level commands on Progress Kemp LoadMaster appliances. Exploitation attempts started June 29, same day as PoC publication.]]></description>
            <link>https://www.probablypwned.com/article/kemp-loadmaster-cve-2026-8037-pre-auth-rce-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kemp-loadmaster-cve-2026-8037-pre-auth-rce-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-8037]]></category>
            <category><![CDATA[Kemp LoadMaster]]></category>
            <category><![CDATA[Progress]]></category>
            <category><![CDATA[pre-auth RCE]]></category>
            <category><![CDATA[load balancer]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 03 Jul 2026 12:07:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504384308090-c894fdcc538d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504384308090-c894fdcc538d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cursor AI Flaws Let Prompt Injection Escape Sandbox for RCE]]></title>
            <description><![CDATA[Two CVSS 9.8 vulnerabilities in the popular AI code editor allow zero-click attacks where malicious instructions in external data sources execute arbitrary commands on developer machines.]]></description>
            <link>https://www.probablypwned.com/article/cursor-duneslide-cve-2026-50548-50549-prompt-injection-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cursor-duneslide-cve-2026-50548-50549-prompt-injection-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cursor]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[CVE-2026-50548]]></category>
            <category><![CDATA[CVE-2026-50549]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 03 Jul 2026 12:06:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ResiLoader Kills 140+ Security Tools Before Deploying StealC]]></title>
            <description><![CDATA[Malwarebytes documents a new loader that abuses a legitimate driver to terminate EDR processes, then uses process hollowing to inject the StealC infostealer through fake Google and Cloudflare verification pages.]]></description>
            <link>https://www.probablypwned.com/article/resiloader-fake-verification-pages-stealc-edr-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/resiloader-fake-verification-pages-stealc-edr-bypass</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ResiLoader]]></category>
            <category><![CDATA[StealC]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[EDR bypass]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 03 Jul 2026 12:05:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Seizes NetNut Proxy Network Built on 2M Hijacked Smart TVs]]></title>
            <description><![CDATA[Google and the FBI dismantled NetNut, a residential proxy network that compromised 2 million smart TVs and streaming boxes. 316 threat groups used it in a single week to mask attack origins.]]></description>
            <link>https://www.probablypwned.com/article/netnut-popa-botnet-fbi-google-2-million-smart-tvs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/netnut-popa-botnet-fbi-google-2-million-smart-tvs</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[residential proxy]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[IoT security]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 03 Jul 2026 12:05:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SharePoint RCE Under Active Exploitation, CISA Deadline July 4]]></title>
            <description><![CDATA[CVE-2026-45659 lets authenticated attackers with basic Site Member permissions execute arbitrary code on SharePoint servers. CISA added it to KEV after confirming active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/sharepoint-cve-2026-45659-deserialization-rce-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sharepoint-cve-2026-45659-deserialization-rce-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SharePoint]]></category>
            <category><![CDATA[CVE-2026-45659]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[deserialization]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 03 Jul 2026 12:04:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1584438784894-089d6a62b8fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1584438784894-089d6a62b8fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PamStealer Validates Your Mac Password Before Stealing It]]></title>
            <description><![CDATA[Jamf Threat Labs uncovers a macOS infostealer that impersonates the Maccy clipboard manager, validates credentials through PAM, then harvests browser data, crypto wallets, and iCloud Keychain.]]></description>
            <link>https://www.probablypwned.com/article/pamstealer-macos-infostealer-rust-pam-credential-validation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pamstealer-macos-infostealer-rust-pam-credential-validation</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[PamStealer]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Rust malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 03 Jul 2026 12:03:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1470225620780-dba8ba36b745?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1470225620780-dba8ba36b745?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DeepSeek Built Browser Ransomware That Needs No Installation]]></title>
            <description><![CDATA[Check Point Research reveals InfernoGrabber, an AI-generated ransomware that encrypts files through Chrome's File System Access API without installing malware or exploiting any vulnerability.]]></description>
            <link>https://www.probablypwned.com/article/deepseek-browser-ransomware-infernograbber-chromium-file-system-api</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/deepseek-browser-ransomware-infernograbber-chromium-file-system-api</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[DeepSeek]]></category>
            <category><![CDATA[AI-generated malware]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[Chromium]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 03 Jul 2026 12:03:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Scattered Spider Suspect Extradited After $8M Jewelry Hack]]></title>
            <description><![CDATA[19-year-old Peter Stokes extradited from Finland to face U.S. charges for alleged role in Scattered Spider operations including an $8 million jewelry retailer breach.]]></description>
            <link>https://www.probablypwned.com/article/scattered-spider-peter-stokes-extradition-jewelry-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/scattered-spider-peter-stokes-extradition-jewelry-breach</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[cybercrime]]></category>
            <category><![CDATA[extradition]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[hacking]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 02 Jul 2026 12:07:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-aa79dcee981c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-aa79dcee981c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Adobe Patches 7 Max-Severity ColdFusion, Campaign Flaws]]></title>
            <description><![CDATA[Seven CVSS 10.0 vulnerabilities in Adobe ColdFusion and Campaign Classic enable unauthenticated RCE. Adobe shifts to twice-monthly security bulletins citing AI-accelerated discovery.]]></description>
            <link>https://www.probablypwned.com/article/adobe-coldfusion-campaign-7-cvss-10-rce-vulnerabilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/adobe-coldfusion-campaign-7-cvss-10-rce-vulnerabilities</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Adobe]]></category>
            <category><![CDATA[ColdFusion]]></category>
            <category><![CDATA[CVE-2026-48276]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 02 Jul 2026 12:06:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[81M Login Attempts: Massive Azure CLI Password Spray Campaign]]></title>
            <description><![CDATA[Attackers exploited deprecated OAuth ROPC flow to bypass MFA, compromising 78 accounts across 64 organizations. Attack originated from Hong Kong and China infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/azure-cli-password-spray-81-million-ropc-mfa-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/azure-cli-password-spray-81-million-ropc-mfa-bypass</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[password spray]]></category>
            <category><![CDATA[OAuth ROPC]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 02 Jul 2026 12:05:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Phantom Squatting: Attackers Weaponize AI-Invented URLs]]></title>
            <description><![CDATA[Unit 42 finds attackers registering domains that LLMs hallucinate, then hosting phishing kits to intercept AI-directed traffic. Montana Empire kit caught 23 days after prediction.]]></description>
            <link>https://www.probablypwned.com/article/phantom-squatting-ai-hallucinated-domains-unit42-phishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/phantom-squatting-ai-hallucinated-domains-unit42-phishing</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[phantom squatting]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Unit 42]]></category>
            <category><![CDATA[domain abuse]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 02 Jul 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Blackfield Ransomware Demands $2M From Electronics Giant Nidec]]></title>
            <description><![CDATA[The Blackfield ransomware gang claims a breach at Nidec Corporation, demanding $2 million to prevent data leakage. This marks Nidec's second ransomware incident in two years.]]></description>
            <link>https://www.probablypwned.com/article/blackfield-ransomware-nidec-2-million-ransom-japan-electronics</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/blackfield-ransomware-nidec-2-million-ransom-japan-electronics</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[blackfield]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[nidec]]></category>
            <category><![CDATA[japan]]></category>
            <category><![CDATA[manufacturing]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 01 Jul 2026 12:09:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Aflac Japan Breach Exposes 4.38 Million Customer Records]]></title>
            <description><![CDATA[Attackers compromised Aflac Japan's customer portal between June 15-25, exposing names, addresses, and phone numbers for 4.38 million policyholders. No health data affected.]]></description>
            <link>https://www.probablypwned.com/article/aflac-japan-data-breach-4-38-million-customers-portal-hack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aflac-japan-data-breach-4-38-million-customers-portal-hack</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[aflac]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[japan]]></category>
            <category><![CDATA[insurance]]></category>
            <category><![CDATA[pii]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 01 Jul 2026 12:08:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ClickFix Campaigns Deliver Three New Ransomware-Linked Loaders]]></title>
            <description><![CDATA[BabaDeda, Lorem Ipsum, and Potemkin loaders emerge from ClickFix social engineering attacks, deploying infostealers and linking to Rhysida ransomware operations.]]></description>
            <link>https://www.probablypwned.com/article/clickfix-babadeda-lorem-ipsum-potemkin-loaders-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clickfix-babadeda-lorem-ipsum-potemkin-loaders-ransomware</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[clickfix]]></category>
            <category><![CDATA[babadeda]]></category>
            <category><![CDATA[lorem-ipsum]]></category>
            <category><![CDATA[potemkin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[loaders]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 01 Jul 2026 12:06:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Curl Patches 18 Flaws Including 25-Year-Old mTLS Bypass]]></title>
            <description><![CDATA[Curl 8.21.0 addresses a record 18 CVEs, including CVE-2026-8932—an mTLS authentication bypass introduced in March 2001. AI tools discovered several of the vulnerabilities.]]></description>
            <link>https://www.probablypwned.com/article/curl-18-cves-25-year-old-mtls-bypass-cve-2026-8932</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/curl-18-cves-25-year-old-mtls-bypass-cve-2026-8932</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[curl]]></category>
            <category><![CDATA[cve-2026-8932]]></category>
            <category><![CDATA[mtls]]></category>
            <category><![CDATA[libcurl]]></category>
            <category><![CDATA[open-source]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 01 Jul 2026 12:05:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Zero-Day Exploited Since May—CVSS 10.0]]></title>
            <description><![CDATA[CVE-2026-20182 allows unauthenticated attackers to inject rogue peers into Cisco SD-WAN fabrics. Active exploitation since May; no workaround available—patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20182-cvss-10-zero-day-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20182-cvss-10-zero-day-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[cisco]]></category>
            <category><![CDATA[cve-2026-20182]]></category>
            <category><![CDATA[sd-wan]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[cisa-kev]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 01 Jul 2026 12:04:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome WebGL Flaw Enables Sandbox Escape on Android]]></title>
            <description><![CDATA[CVE-2026-13028, a critical use-after-free in Chrome's WebGL component, scores CVSS 9.6 and allows remote code execution with sandbox escape on Android. Update immediately.]]></description>
            <link>https://www.probablypwned.com/article/chrome-cve-2026-13028-webgl-sandbox-escape-cvss-9-6</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-cve-2026-13028-webgl-sandbox-escape-cvss-9-6</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[chrome]]></category>
            <category><![CDATA[cve-2026-13028]]></category>
            <category><![CDATA[webgl]]></category>
            <category><![CDATA[sandbox-escape]]></category>
            <category><![CDATA[google]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 01 Jul 2026 12:03:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[KDDI Breach Exposes 14.2 Million Email Credentials Across Japan]]></title>
            <description><![CDATA[A vulnerability in third-party software let attackers access KDDI's shared email platform, potentially exposing login credentials for 6 Japanese ISPs.]]></description>
            <link>https://www.probablypwned.com/article/kddi-data-breach-14-million-email-accounts-six-isps-japan</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kddi-data-breach-14-million-email-accounts-six-isps-japan</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[KDDI]]></category>
            <category><![CDATA[Japan]]></category>
            <category><![CDATA[email breach]]></category>
            <category><![CDATA[ISP]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 30 Jun 2026 12:06:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hijacked npm and Go Packages Use VS Code Tasks and Blockchain C2]]></title>
            <description><![CDATA[18 compromised packages hide execution in VS Code folder-open tasks, fetch encrypted payloads from blockchain transactions, and deploy Python infostealers.]]></description>
            <link>https://www.probablypwned.com/article/npm-go-packages-vscode-task-blockchain-dead-drop-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/npm-go-packages-vscode-task-blockchain-dead-drop-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[Go]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[blockchain]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 30 Jun 2026 12:05:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SimpleHelp CVSS 10 Auth Bypass Hits CISA KEV After Malware Surge]]></title>
            <description><![CDATA[CVE-2026-48558 lets attackers bypass OIDC auth and register as technicians. CISA added it to KEV June 29 after TaskWeaver and Djinn Stealer deployments.]]></description>
            <link>https://www.probablypwned.com/article/simplehelp-cve-2026-48558-cvss-10-cisa-kev-taskweaver-djinn-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/simplehelp-cve-2026-48558-cvss-10-cisa-kev-taskweaver-djinn-stealer</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SimpleHelp]]></category>
            <category><![CDATA[CVE-2026-48558]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[OIDC]]></category>
            <category><![CDATA[TaskWeaver]]></category>
            <category><![CDATA[Djinn Stealer]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 30 Jun 2026 12:04:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1584438784894-089d6a62b8fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1584438784894-089d6a62b8fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[libssh2 Pre-Auth RCE (CVE-2026-55200) PoC Now Public]]></title>
            <description><![CDATA[A critical memory corruption flaw in libssh2 lets malicious SSH servers execute code on connecting clients—no credentials needed. PoC dropped June 29.]]></description>
            <link>https://www.probablypwned.com/article/libssh2-cve-2026-55200-pre-auth-memory-corruption-poc-released</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/libssh2-cve-2026-55200-pre-auth-memory-corruption-poc-released</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[libssh2]]></category>
            <category><![CDATA[CVE-2026-55200]]></category>
            <category><![CDATA[SSH]]></category>
            <category><![CDATA[memory corruption]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 30 Jun 2026 12:03:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Scattered Spider Teens Convicted in £29M Transport for London Attack]]></title>
            <description><![CDATA[Two UK teenagers plead guilty to the September 2024 TfL breach that exposed 10 million commuters and forced 28,000 employees to reset passwords in person.]]></description>
            <link>https://www.probablypwned.com/article/scattered-spider-tfl-conviction-38-million-transport-london</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/scattered-spider-tfl-conviction-38-million-transport-london</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[Transport for London]]></category>
            <category><![CDATA[Cybercrime]]></category>
            <category><![CDATA[UK]]></category>
            <category><![CDATA[Ransomware]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 29 Jun 2026 12:09:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[34% of LG and Samsung TV Apps Hide Residential Proxy SDKs]]></title>
            <description><![CDATA[Spur Intelligence finds over 2,000 smart TV apps embedding Bright Data proxy code—turning your living room TV into an exit node for web scraping traffic.]]></description>
            <link>https://www.probablypwned.com/article/smart-tv-proxyware-lg-samsung-bright-data-residential-proxy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smart-tv-proxyware-lg-samsung-bright-data-residential-proxy</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Smart TV]]></category>
            <category><![CDATA[Proxyware]]></category>
            <category><![CDATA[Bright Data]]></category>
            <category><![CDATA[LG]]></category>
            <category><![CDATA[Samsung]]></category>
            <category><![CDATA[Residential Proxy]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Mon, 29 Jun 2026 12:08:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hoppscotch CVSS 10 Flaw Allows Unauthenticated Server Takeover]]></title>
            <description><![CDATA[CVE-2026-50160 in self-hosted Hoppscotch lets attackers overwrite JWT secrets with one HTTP request—no credentials needed. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/hoppscotch-cve-2026-50160-cvss-10-mass-assignment-server-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hoppscotch-cve-2026-50160-cvss-10-mass-assignment-server-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Hoppscotch]]></category>
            <category><![CDATA[CVE-2026-50160]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[Mass Assignment]]></category>
            <category><![CDATA[API Security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 29 Jun 2026 12:07:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504384308090-c894fdcc538d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504384308090-c894fdcc538d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Gates GPT-5.6 Sol Release Over Cyber Weapon Concerns]]></title>
            <description><![CDATA[OpenAI's GPT-5.6 Sol launches under US government restrictions—the first AI model requiring federal approval for access due to offensive cybersecurity capabilities.]]></description>
            <link>https://www.probablypwned.com/article/openai-gpt-5-6-sol-government-gated-cybersecurity-capabilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-gpt-5-6-sol-government-gated-cybersecurity-capabilities</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[GPT-5.6]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[Cybersecurity AI]]></category>
            <category><![CDATA[Government Regulation]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Mon, 29 Jun 2026 12:06:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Amazon Q Developer Flaw Let Attackers Steal AWS Credentials via Repos]]></title>
            <description><![CDATA[CVE-2026-12957 and CVE-2026-12958 enabled code execution and AWS credential theft when developers opened malicious repositories. Patch auto-applied for most users.]]></description>
            <link>https://www.probablypwned.com/article/amazon-q-developer-mcp-rce-credential-theft-cve-2026-12957</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/amazon-q-developer-mcp-rce-credential-theft-cve-2026-12957</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AWS]]></category>
            <category><![CDATA[Amazon-Q]]></category>
            <category><![CDATA[CVE-2026-12957]]></category>
            <category><![CDATA[AI-security]]></category>
            <category><![CDATA[supply-chain]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 28 Jun 2026 12:06:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1667372393119-3d4c48d07fc9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1667372393119-3d4c48d07fc9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI: Russian Spies Now Steal Signal Backup Keys for Persistent Access]]></title>
            <description><![CDATA[Russian intelligence groups UNC5792 and UNC4221 have evolved their Signal phishing campaign to harvest backup recovery keys, enabling access even after victims change phones.]]></description>
            <link>https://www.probablypwned.com/article/fbi-signal-backup-key-phishing-unc5792-russian-intelligence</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-signal-backup-key-phishing-unc5792-russian-intelligence</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Signal]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[UNC5792]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sun, 28 Jun 2026 12:06:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PTC Windchill RCE Under Active Attack—CISA Deadline Today]]></title>
            <description><![CDATA[CVE-2026-12569 (CVSS 9.3) in PTC Windchill PLM software is being exploited to deploy web shells. First PTC product ever added to CISA KEV catalog.]]></description>
            <link>https://www.probablypwned.com/article/ptc-windchill-cve-2026-12569-cisa-kev-webshell-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ptc-windchill-cve-2026-12569-cisa-kev-webshell-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-12569]]></category>
            <category><![CDATA[PTC]]></category>
            <category><![CDATA[CISA-KEV]]></category>
            <category><![CDATA[web-shell]]></category>
            <category><![CDATA[PLM]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 28 Jun 2026 12:05:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pedit COW: Traffic Control Bug Lets Anyone Root Linux Boxes]]></title>
            <description><![CDATA[CVE-2026-46331 in Linux's tc subsystem lets local users poison cached binaries and gain root. Public exploit available within a day of CVE assignment.]]></description>
            <link>https://www.probablypwned.com/article/pedit-cow-linux-kernel-cve-2026-46331-traffic-control-root</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pedit-cow-linux-kernel-cve-2026-46331-traffic-control-root</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[linux]]></category>
            <category><![CDATA[CVE-2026-46331]]></category>
            <category><![CDATA[privilege-escalation]]></category>
            <category><![CDATA[kernel]]></category>
            <category><![CDATA[traffic-control]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 28 Jun 2026 12:04:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DirtyClone: Linux Kernel Bug Grants Root via Cloned Packets]]></title>
            <description><![CDATA[CVE-2026-43503 lets attackers corrupt cached binaries through network packet cloning, achieving root without leaving disk traces. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/dirtyclone-linux-kernel-lpe-cve-2026-43503-page-cache-root</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dirtyclone-linux-kernel-lpe-cve-2026-43503-page-cache-root</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[linux]]></category>
            <category><![CDATA[CVE-2026-43503]]></category>
            <category><![CDATA[privilege-escalation]]></category>
            <category><![CDATA[kernel]]></category>
            <category><![CDATA[DirtyClone]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sun, 28 Jun 2026 12:04:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654291663-b91ad427698f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654291663-b91ad427698f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Clean GitHub Repo Tricks AI Coding Agents Into Running Malware]]></title>
            <description><![CDATA[Mozilla's 0DIN researchers demonstrate how innocent-looking repositories can chain three benign components to hijack AI coding assistants and establish reverse shells on developer machines.]]></description>
            <link>https://www.probablypwned.com/article/mozilla-0din-ai-coding-agent-clean-repo-reverse-shell</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mozilla-0din-ai-coding-agent-clean-repo-reverse-shell</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[Claude Code]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[reverse shell]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 27 Jun 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Bluekit PhaaS Uses Browser-in-the-Middle to Bypass MFA]]></title>
            <description><![CDATA[Netcraft identifies 70 new Bluekit hostnames as the phishing-as-a-service platform adopts real-time session hijacking that defeats all forms of traditional MFA.]]></description>
            <link>https://www.probablypwned.com/article/bluekit-phaas-browser-in-the-middle-mfa-bypass-microsoft-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bluekit-phaas-browser-in-the-middle-mfa-bypass-microsoft-credentials</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Bluekit]]></category>
            <category><![CDATA[phishing-as-a-service]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[browser-in-the-middle]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 27 Jun 2026 12:05:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-aa79dcee981c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-aa79dcee981c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Ad Blocker with 10M Users Has Dormant Backdoor]]></title>
            <description><![CDATA[Island researchers discover Adblock for YouTube extension contains remote-controlled script injection capability that could steal passwords with a single server-side change.]]></description>
            <link>https://www.probablypwned.com/article/adblock-youtube-chrome-extension-dormant-script-injection-10-million</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/adblock-youtube-chrome-extension-dormant-script-injection-10-million</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[browser extension]]></category>
            <category><![CDATA[script injection]]></category>
            <category><![CDATA[Adblock for YouTube]]></category>
            <category><![CDATA[Island]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 27 Jun 2026 12:04:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Photo ZIP Phishing Hits Hotels with Node.js Implant]]></title>
            <description><![CDATA[Microsoft Threat Intelligence tracks active campaign deploying TonRAT malware against hospitality sector in Europe and Asia via fake guest complaint emails.]]></description>
            <link>https://www.probablypwned.com/article/photo-zip-hospitality-phishing-tonrat-nodejs-implant-microsoft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/photo-zip-hospitality-phishing-tonrat-nodejs-implant-microsoft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TonRAT]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[hospitality]]></category>
            <category><![CDATA[Node.js]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 27 Jun 2026 12:03:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1556745757-8d76bdb6984b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1556745757-8d76bdb6984b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Polymarket Loses $3M After Third-Party Vendor Compromise]]></title>
            <description><![CDATA[Attackers injected malicious JavaScript via a compromised vendor to drain $3 million in pUSD from Polymarket users. The prediction market giant pledges full refunds.]]></description>
            <link>https://www.probablypwned.com/article/polymarket-supply-chain-3m-frontend-vendor-compromise</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/polymarket-supply-chain-3m-frontend-vendor-compromise</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[polymarket]]></category>
            <category><![CDATA[supply-chain-attack]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[defi]]></category>
            <category><![CDATA[frontend-exploit]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 26 Jun 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortra PAM Flaw Lets Attackers Run Commands Without Auth]]></title>
            <description><![CDATA[CVE-2026-9862 (CVSS 9.8) in Fortra Core Privileged Access Manager (BoKS) enables unauthenticated command injection via the autoregistration service. Restrict port 6507 access immediately.]]></description>
            <link>https://www.probablypwned.com/article/fortra-boks-cve-2026-9862-command-injection-pam-critical</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortra-boks-cve-2026-9862-command-injection-pam-critical</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-9862]]></category>
            <category><![CDATA[Fortra]]></category>
            <category><![CDATA[PAM]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[privileged access]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 26 Jun 2026 12:06:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cal Water: Iranian Hackers Hit Billing, But OT Systems Stayed Safe]]></title>
            <description><![CDATA[Mandiant's investigation finds Handala breached Cal Water's billing system but never reached operational technology. The Iran-linked group claimed they chose not to disrupt water access.]]></description>
            <link>https://www.probablypwned.com/article/cal-water-handala-iranian-cyberattack-ot-systems-unaffected</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cal-water-handala-iranian-cyberattack-ot-systems-unaffected</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Handala]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[water utility]]></category>
            <category><![CDATA[OT security]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 26 Jun 2026 12:05:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Shop App Abused to Deliver Fake Receipts in Callback Phishing]]></title>
            <description><![CDATA[Scammers insert fake Norton, McAfee, and PayPal invoices into Shopify's Shop order-tracking app, then social engineer victims into installing remote access tools. Here's how it works.]]></description>
            <link>https://www.probablypwned.com/article/shopify-shop-app-callback-phishing-fake-receipts-remote-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shopify-shop-app-callback-phishing-fake-receipts-remote-access</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Shopify]]></category>
            <category><![CDATA[callback scam]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[remote access]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 26 Jun 2026 12:05:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Splunk Enterprise RCE Flaw Under Active Attack — PoC Public]]></title>
            <description><![CDATA[CVE-2026-20253 in Splunk Enterprise lets unauthenticated attackers execute code via an unprotected PostgreSQL sidecar. Over 1,400 instances exposed. Patch or disable the service now.]]></description>
            <link>https://www.probablypwned.com/article/splunk-enterprise-cve-2026-20253-postgresql-rce-actively-exploited</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/splunk-enterprise-cve-2026-20253-postgresql-rce-actively-exploited</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-20253]]></category>
            <category><![CDATA[Splunk]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[PostgreSQL]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 26 Jun 2026 12:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lantronix EDS5000 Flaw Exploited in Attacks — Patch Due Today]]></title>
            <description><![CDATA[CISA confirms active exploitation of CVE-2025-67038 (CVSS 9.8) in Lantronix EDS5000 serial-to-IP devices. The command injection flaw grants root access. Federal deadline is June 26.]]></description>
            <link>https://www.probablypwned.com/article/lantronix-eds5000-cve-2025-67038-command-injection-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lantronix-eds5000-cve-2025-67038-command-injection-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-67038]]></category>
            <category><![CDATA[Lantronix]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[OT security]]></category>
            <category><![CDATA[ICS]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 26 Jun 2026 12:03:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Quietly Extends Free Windows 10 ESU to October 2027]]></title>
            <description><![CDATA[Microsoft extended its free Windows 10 Extended Security Updates program by a year, giving consumers security coverage through October 2027. Here's what changed and who qualifies.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-windows-10-esu-extension-october-2027-free-consumers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-windows-10-esu-extension-october-2027-free-consumers</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Windows 10]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[ESU]]></category>
            <category><![CDATA[security updates]]></category>
            <category><![CDATA[end of life]]></category>
            <dc:creator><![CDATA[ProbablyPwned Team]]></dc:creator>
            <pubDate>Thu, 25 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korean Malware Uses Prompt Injection to Evade AI Analysis]]></title>
            <description><![CDATA[SentinelOne discovers Gaslight, a Rust-based macOS backdoor embedding 38 fake system messages designed to crash or confuse AI-powered malware analysis tools.]]></description>
            <link>https://www.probablypwned.com/article/gaslight-macos-backdoor-north-korea-ai-prompt-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gaslight-macos-backdoor-north-korea-ai-prompt-injection</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[gaslight]]></category>
            <category><![CDATA[north-korea]]></category>
            <category><![CDATA[macos]]></category>
            <category><![CDATA[prompt-injection]]></category>
            <category><![CDATA[ai-evasion]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 25 Jun 2026 12:06:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1470225620780-dba8ba36b745?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1470225620780-dba8ba36b745?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Edgecution Malware Escapes Browser Sandbox via Native Messaging]]></title>
            <description><![CDATA[A malicious Edge extension abuses Chrome's Native Messaging protocol to deploy a Python backdoor with full system access, linked to Payouts King ransomware operations.]]></description>
            <link>https://www.probablypwned.com/article/edgecution-browser-extension-native-messaging-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/edgecution-browser-extension-native-messaging-ransomware</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[edgecution]]></category>
            <category><![CDATA[browser-extension]]></category>
            <category><![CDATA[native-messaging]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[payouts-king]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 25 Jun 2026 12:06:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mistic Backdoor Feeds Qilin, Akira, and Black Basta Operations]]></title>
            <description><![CDATA[Symantec links the stealthy Mistic backdoor to KongTuke, an initial access broker supplying corporate network access to major ransomware gangs.]]></description>
            <link>https://www.probablypwned.com/article/mistic-backdoor-kongtuke-initial-access-broker-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mistic-backdoor-kongtuke-initial-access-broker-ransomware</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[mistic]]></category>
            <category><![CDATA[kongtuke]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[initial-access-broker]]></category>
            <category><![CDATA[backdoor]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 25 Jun 2026 12:05:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cordyceps Flaw Exposes 300+ GitHub Repos to Supply Chain Hijack]]></title>
            <description><![CDATA[A new class of CI/CD vulnerability affects repositories at Microsoft, Google, Apache, and Cloudflare. A free GitHub account is all attackers need to forge approvals and steal credentials.]]></description>
            <link>https://www.probablypwned.com/article/cordyceps-cicd-github-actions-supply-chain-microsoft-google</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cordyceps-cicd-github-actions-supply-chain-microsoft-google</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[cordyceps]]></category>
            <category><![CDATA[github-actions]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[cicd]]></category>
            <category><![CDATA[microsoft]]></category>
            <category><![CDATA[google]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 25 Jun 2026 12:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504384308090-c894fdcc538d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504384308090-c894fdcc538d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Unified CM SSRF Flaw Now Dropping Webshells in the Wild]]></title>
            <description><![CDATA[Attackers exploit CVE-2026-20230 in Cisco Unified Communications Manager to deploy webshells via Tor-routed automated attacks. Patching alone won't remove existing compromises.]]></description>
            <link>https://www.probablypwned.com/article/cisco-unified-cm-cve-2026-20230-ssrf-webshell-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-unified-cm-cve-2026-20230-ssrf-webshell-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[cisco]]></category>
            <category><![CDATA[cve-2026-20230]]></category>
            <category><![CDATA[ssrf]]></category>
            <category><![CDATA[webshell]]></category>
            <category><![CDATA[unified-communications]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 25 Jun 2026 12:04:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Operation Endgame Dismantles StealC and Amadey Infrastructure]]></title>
            <description><![CDATA[Microsoft and Europol seize 66 domains and 296 servers supporting StealC and Amadey malware, recovering 25.6 million stolen credentials in coordinated takedown.]]></description>
            <link>https://www.probablypwned.com/article/operation-endgame-stealc-amadey-takedown-microsoft-europol</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-endgame-stealc-amadey-takedown-microsoft-europol</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[operation-endgame]]></category>
            <category><![CDATA[stealc]]></category>
            <category><![CDATA[amadey]]></category>
            <category><![CDATA[microsoft]]></category>
            <category><![CDATA[europol]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Thu, 25 Jun 2026 12:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Confirms Ubiquiti UniFi OS Flaws Now Exploited in Attacks]]></title>
            <description><![CDATA[CISA adds three maximum-severity Ubiquiti UniFi OS vulnerabilities to KEV catalog after confirming active exploitation. Federal agencies have until June 26 to patch under BOD 26-04.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-ubiquiti-unifi-os-cve-2026-34908-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-ubiquiti-unifi-os-cve-2026-34908-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Ubiquiti]]></category>
            <category><![CDATA[UniFi]]></category>
            <category><![CDATA[CVE-2026-34908]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 24 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Exploits Check Point VPN Zero-Day Since Early May]]></title>
            <description><![CDATA[CVE-2026-50751 allows unauthenticated VPN access via IKEv1 certificate validation flaw. CISA gave federal agencies three days to patch after linking attacks to ransomware affiliate.]]></description>
            <link>https://www.probablypwned.com/article/check-point-vpn-cve-2026-50751-qilin-ransomware-ikev1-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/check-point-vpn-cve-2026-50751-qilin-ransomware-ikev1-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Check Point]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-50751]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 24 Jun 2026 12:12:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RoguePlanet Zero-Day Grants SYSTEM Access via Defender Race Condition]]></title>
            <description><![CDATA[A publicly released exploit targets CVE-2026-50656 in Microsoft Defender's quarantine pipeline. Microsoft confirms the flaw but has no patch timeline yet.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-defender-rogueplanet-zero-day-cve-2026-50656-system-privileges</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-defender-rogueplanet-zero-day-cve-2026-50656-system-privileges</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Defender]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-50656]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Windows]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 24 Jun 2026 12:09:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[World Leaks Posts 200K Tata Electronics Files With Apple, Tesla Data]]></title>
            <description><![CDATA[The extortion group claims 630GB of manufacturing schematics, PCB designs, and trade secrets from Apple's iPhone supplier. Tata confirms incident but says operations unaffected.]]></description>
            <link>https://www.probablypwned.com/article/tata-electronics-world-leaks-apple-tesla-manufacturing-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tata-electronics-world-leaks-apple-tesla-manufacturing-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[World Leaks]]></category>
            <category><![CDATA[Tata Electronics]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[Tesla]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 24 Jun 2026 12:07:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[npm Typosquat Packages Drop PowerShell RAT Targeting Chrome Creds]]></title>
            <description><![CDATA[Three malicious packages impersonating PostCSS tools deploy a multi-stage Windows RAT. The payload steals saved passwords by bypassing Chrome's app-bound encryption.]]></description>
            <link>https://www.probablypwned.com/article/npm-postcss-typosquat-powershell-rat-chrome-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/npm-postcss-typosquat-powershell-rat-chrome-credential-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[typosquatting]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 24 Jun 2026 12:05:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[400+ Arch Linux AUR Packages Deliver eBPF Rootkit and Infostealer]]></title>
            <description><![CDATA[Attackers hijacked orphaned AUR packages to push malicious npm payloads. The rootkit hides processes at kernel level while the stealer exfiltrates developer credentials.]]></description>
            <link>https://www.probablypwned.com/article/arch-linux-aur-supply-chain-400-packages-rootkit-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/arch-linux-aur-supply-chain-400-packages-rootkit-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Arch Linux]]></category>
            <category><![CDATA[AUR]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[rootkit]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[eBPF]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 24 Jun 2026 12:03:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[macOS ClickFix Gains Silent DMG Mount to Push AMOS Stealer]]></title>
            <description><![CDATA[Unit 42 uncovers ClickFix campaign using hdiutil -nobrowse to silently mount disk images on macOS. Victims never see the DMG—just Atomic Stealer harvesting credentials.]]></description>
            <link>https://www.probablypwned.com/article/macos-clickfix-silent-dmg-mount-amos-stealer-unit42</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/macos-clickfix-silent-dmg-mount-amos-stealer-unit42</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Atomic Stealer]]></category>
            <category><![CDATA[AMOS]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Unit 42]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 23 Jun 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SearchLeak Let Attackers Steal M365 Emails and MFA Codes in One Click]]></title>
            <description><![CDATA[CVE-2026-42824 chained prompt injection, a timing race, and CSP bypass to exfiltrate Outlook emails, OneDrive files, and MFA codes via Microsoft 365 Copilot. Now patched.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-365-copilot-searchleak-cve-2026-42824-data-exfiltration</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-365-copilot-searchleak-cve-2026-42824-data-exfiltration</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[Copilot]]></category>
            <category><![CDATA[CVE-2026-42824]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 23 Jun 2026 12:08:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1584438784894-089d6a62b8fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1584438784894-089d6a62b8fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WhatsApp Campaign Spreads RMM Backdoors via VBScript Files]]></title>
            <description><![CDATA[Kaspersky uncovers a multi-country malware campaign using WhatsApp to distribute VBScript files that install ManageEngine remote access tools. Malaysia accounts for 80% of victims.]]></description>
            <link>https://www.probablypwned.com/article/whatsapp-vbscript-malware-manageengine-rmm-kaspersky</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/whatsapp-vbscript-malware-manageengine-rmm-kaspersky</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[VBScript]]></category>
            <category><![CDATA[RMM]]></category>
            <category><![CDATA[ManageEngine]]></category>
            <category><![CDATA[Kaspersky]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 23 Jun 2026 12:07:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AryStinger Botnet Hijacks 4,000+ D-Link Routers as Attack Proxies]]></title>
            <description><![CDATA[A previously undocumented botnet exploits 13-year-old D-Link flaws to build a distributed proxy network. South Korea and China account for 80% of infections.]]></description>
            <link>https://www.probablypwned.com/article/arystinger-botnet-4000-dlink-routers-proxy-network</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/arystinger-botnet-4000-dlink-routers-proxy-network</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[D-Link]]></category>
            <category><![CDATA[router malware]]></category>
            <category><![CDATA[AryStinger]]></category>
            <category><![CDATA[IoT]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 23 Jun 2026 12:06:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PixelSmash FFmpeg Bug Turns Media Files Into RCE Weapons]]></title>
            <description><![CDATA[CVE-2026-8461 is a heap overflow in FFmpeg's MagicYUV decoder that enables remote code execution via malicious video files. Jellyfin, Kodi, and Nextcloud affected.]]></description>
            <link>https://www.probablypwned.com/article/pixelsmash-ffmpeg-cve-2026-8461-magicyuv-rce-jellyfin</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pixelsmash-ffmpeg-cve-2026-8461-magicyuv-rce-jellyfin</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[FFmpeg]]></category>
            <category><![CDATA[CVE-2026-8461]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Jellyfin]]></category>
            <category><![CDATA[media server]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 23 Jun 2026 12:06:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Squidbleed Leaks Credentials From 29-Year-Old Squid Proxy Bug]]></title>
            <description><![CDATA[CVE-2026-47729 exposes a heap over-read in Squid's FTP parser that leaks HTTP authorization headers and cookies. The bug dates to 1997.]]></description>
            <link>https://www.probablypwned.com/article/squidbleed-cve-2026-47729-squid-proxy-29-year-heap-overread</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/squidbleed-cve-2026-47729-squid-proxy-29-year-heap-overread</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Squid]]></category>
            <category><![CDATA[CVE-2026-47729]]></category>
            <category><![CDATA[heap overflow]]></category>
            <category><![CDATA[proxy]]></category>
            <category><![CDATA[memory leak]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Tue, 23 Jun 2026 12:05:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AutoJack Turns AI Browsing Agents Into Zero-Click RCE Vectors]]></title>
            <description><![CDATA[Microsoft discloses AutoJack, an exploit chain that hijacks AutoGen Studio AI agents via malicious webpages. A single URL visit triggers arbitrary code execution on the host machine.]]></description>
            <link>https://www.probablypwned.com/article/autojack-microsoft-autogen-studio-rce-ai-agent-hijack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/autojack-microsoft-autogen-studio-rce-ai-agent-hijack</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[Microsoft AutoGen]]></category>
            <category><![CDATA[MCP]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI agents]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Mon, 22 Jun 2026 14:35:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Prinz Eugen Ransomware Targets Your Newest Files First]]></title>
            <description><![CDATA[Prinz Eugen ransomware prioritizes recently modified files for encryption, maximizing business disruption. Learn how this Go-based threat works and who's at risk.]]></description>
            <link>https://www.probablypwned.com/article/prinz-eugen-ransomware-recent-files-chacha20-encryption</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/prinz-eugen-ransomware-recent-files-chacha20-encryption</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Prinz Eugen]]></category>
            <category><![CDATA[ChaCha20]]></category>
            <category><![CDATA[double extortion]]></category>
            <category><![CDATA[RDP attacks]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Sat, 20 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI Chrome Extensions SiderAI and MaxAI Expose 10M Users]]></title>
            <description><![CDATA[Spyder and MaXSS vulnerabilities in popular AI browser extensions allow full session hijacking. Exploitation requires only visiting a malicious webpage.]]></description>
            <link>https://www.probablypwned.com/article/siderai-maxai-chrome-extensions-spyder-maxss-vulnerabilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/siderai-maxai-chrome-extensions-spyder-maxss-vulnerabilities</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[browser extension]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[SiderAI]]></category>
            <category><![CDATA[MaxAI]]></category>
            <category><![CDATA[XSS]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 20 Jun 2026 12:07:39 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DragonForce Hid C2 Traffic in Microsoft Teams for Two Months]]></title>
            <description><![CDATA[Symantec reveals ransomware group used Teams TURN relay infrastructure to mask command-and-control. First documented abuse of Teams relay for malware C2.]]></description>
            <link>https://www.probablypwned.com/article/dragonforce-ransomware-microsoft-teams-turn-relay-c2</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dragonforce-ransomware-microsoft-teams-turn-relay-c2</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DragonForce]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Microsoft Teams]]></category>
            <category><![CDATA[C2]]></category>
            <category><![CDATA[evasion]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Sat, 20 Jun 2026 12:07:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Texas Hunting License Vendor Breach Exposes 3M Records]]></title>
            <description><![CDATA[Texas Parks & Wildlife discloses third-party breach affecting 3 million fishing and hunting license holders. Driver's licenses, passports exposed.]]></description>
            <link>https://www.probablypwned.com/article/texas-parks-wildlife-vendor-breach-3-million-licenses</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/texas-parks-wildlife-vendor-breach-3-million-licenses</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Texas]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[third-party]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[driver's license]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Sat, 20 Jun 2026 12:06:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Airoha Bluetooth Flaw Turns Earbuds Into Wiretaps]]></title>
            <description><![CDATA[CVE-2025-20701 lets attackers hijack unpaired Beats, Sony, JBL earbuds to eavesdrop via microphone. CVSS 8.8 flaw affects 29 products from 10 brands.]]></description>
            <link>https://www.probablypwned.com/article/airoha-bluetooth-cve-2025-20701-beats-buds-eavesdropping</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/airoha-bluetooth-cve-2025-20701-beats-buds-eavesdropping</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Airoha]]></category>
            <category><![CDATA[Bluetooth]]></category>
            <category><![CDATA[CVE-2025-20701]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[eavesdropping]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Sat, 20 Jun 2026 12:06:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gentlemen Ransomware Runs Its Own EDR Killer Factory]]></title>
            <description><![CDATA[ESET unmasks GentleKiller, an 8-variant EDR killer framework targeting 400+ security processes. The gang ships updates to affiliates like a software vendor.]]></description>
            <link>https://www.probablypwned.com/article/gentlemen-ransomware-gentlekiller-edr-framework-eset</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gentlemen-ransomware-gentlekiller-edr-framework-eset</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Gentlemen]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[EDR killer]]></category>
            <category><![CDATA[BYOVD]]></category>
            <category><![CDATA[GentleKiller]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 19 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Splunk AI Toolkit Command Injection Enables System Takeover]]></title>
            <description><![CDATA[CVE-2026-20266 in Splunk AI Toolkit allows authenticated admins to execute arbitrary OS commands. CVSS 9.1 flaw affects versions below 5.7.4—upgrade or uninstall immediately.]]></description>
            <link>https://www.probablypwned.com/article/splunk-ai-toolkit-cve-2026-20266-command-injection-cvss-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/splunk-ai-toolkit-cve-2026-20266-command-injection-cvss-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Splunk]]></category>
            <category><![CDATA[CVE-2026-20266]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[CVSS 9.1]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 19 Jun 2026 12:10:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Klue OAuth Breach Exposes Salesforce CRM Data at Multiple Enterprises]]></title>
            <description><![CDATA[Attackers exploited a compromised Klue Battlecards integration to steal Salesforce CRM data from enterprises including Huntress. Salesforce has disabled the app connection.]]></description>
            <link>https://www.probablypwned.com/article/klue-salesforce-oauth-breach-crm-data-theft-huntress</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/klue-salesforce-oauth-breach-crm-data-theft-huntress</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Salesforce]]></category>
            <category><![CDATA[Klue]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[CRM]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Fri, 19 Jun 2026 12:09:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[USB Worm Spreads Crypto-Stealing Clipper via Windows Shortcuts]]></title>
            <description><![CDATA[Microsoft warns of CryptoBandits campaign spreading clipboard-hijacking malware through USB drives. The worm uses Tor C2, steals seed phrases, and replaces wallet addresses mid-transaction.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-cryptobandits-usb-clipper-tor-cryptocurrency-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-cryptobandits-usb-clipper-tor-cryptocurrency-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[clipper malware]]></category>
            <category><![CDATA[USB worm]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Tor]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Fri, 19 Jun 2026 12:07:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Unpatchable BootROM Flaw Hits iPhone XS, XR, and iPhone 11 Models]]></title>
            <description><![CDATA[Security researchers disclose usbliter8, an unpatchable BootROM vulnerability affecting Apple A12 and A13 chips. Physical access enables full boot chain compromise on millions of devices.]]></description>
            <link>https://www.probablypwned.com/article/apple-usbliter8-bootrom-unpatchable-a12-a13-iphone-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apple-usbliter8-bootrom-unpatchable-a12-a13-iphone-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[BootROM]]></category>
            <category><![CDATA[usbliter8]]></category>
            <category><![CDATA[iPhone]]></category>
            <category><![CDATA[hardware vulnerability]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 19 Jun 2026 12:06:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516259762381-22954d7d3ad2?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516259762381-22954d7d3ad2?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Firefox 152 Patches 40 Vulnerabilities Including RCE and Sandbox Escapes]]></title>
            <description><![CDATA[Mozilla releases Firefox 152 fixing 40 security flaws, including 10 high-severity vulnerabilities enabling remote code execution, privilege escalation, and sandbox escapes.]]></description>
            <link>https://www.probablypwned.com/article/firefox-152-security-update-40-cves-rce-sandbox-escape</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/firefox-152-security-update-40-cves-rce-sandbox-escape</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Firefox]]></category>
            <category><![CDATA[Mozilla]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[CVE-2026-12291]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 19 Jun 2026 12:05:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Operation Endgame Dismantles SocGholish: 106 Servers Seized]]></title>
            <description><![CDATA[International law enforcement seizes 106 servers and 101 domains behind SocGholish malware framework, cleaning up 15,000 infected WordPress sites. Evil Corp connection confirmed.]]></description>
            <link>https://www.probablypwned.com/article/operation-endgame-socgholish-takedown-106-servers-evil-corp</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-endgame-socgholish-takedown-106-servers-evil-corp</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[SocGholish]]></category>
            <category><![CDATA[Operation Endgame]]></category>
            <category><![CDATA[Evil Corp]]></category>
            <category><![CDATA[malware takedown]]></category>
            <category><![CDATA[law enforcement]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Fri, 19 Jun 2026 12:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[F5 Patches Two Critical NGINX Flaws Enabling Remote Code Execution]]></title>
            <description><![CDATA[F5 releases out-of-band patches for CVE-2026-42530 and CVE-2026-42055, both CVSS 9.2 vulnerabilities in NGINX Open Source that allow unauthenticated remote code execution.]]></description>
            <link>https://www.probablypwned.com/article/f5-nginx-cve-2026-42530-42055-critical-rce-http3-quic</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/f5-nginx-cve-2026-42530-42055-critical-rce-http3-quic</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[NGINX]]></category>
            <category><![CDATA[CVE-2026-42530]]></category>
            <category><![CDATA[CVE-2026-42055]]></category>
            <category><![CDATA[F5]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Fri, 19 Jun 2026 12:03:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Chain Three FortiSandbox Flaws for Code Execution]]></title>
            <description><![CDATA[Three critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) are under active exploitation. All carry CVSS 9.1 scores and allow unauthenticated remote code execution.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-fortisandbox-three-cves-cvss-9-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-fortisandbox-three-cves-cvss-9-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiSandbox]]></category>
            <category><![CDATA[CVE-2026-39813]]></category>
            <category><![CDATA[CVE-2026-39808]]></category>
            <category><![CDATA[CVE-2026-25089]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 18 Jun 2026 12:04:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Patch for CVSS 10 Joomla JCE Flaw by June 19]]></title>
            <description><![CDATA[CVE-2026-48907 in Joomla Content Editor allows unauthenticated attackers to upload and execute PHP code. CISA added it to the KEV catalog after active exploitation deploying web shells.]]></description>
            <link>https://www.probablypwned.com/article/joomla-jce-cve-2026-48907-cvss-10-cisa-kev-web-shell</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/joomla-jce-cve-2026-48907-cvss-10-cisa-kev-web-shell</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Joomla]]></category>
            <category><![CDATA[CVE-2026-48907]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[web shell]]></category>
            <category><![CDATA[PHP]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Thu, 18 Jun 2026 12:04:01 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[15 JetBrains Plugins With 70K Installs Caught Stealing AI Keys]]></title>
            <description><![CDATA[Malicious JetBrains IDE plugins disguised as AI coding assistants exfiltrated OpenAI and DeepSeek API keys from developers. All 15 plugins have been removed and publisher accounts terminated.]]></description>
            <link>https://www.probablypwned.com/article/jetbrains-malicious-plugins-70000-installs-ai-api-key-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/jetbrains-malicious-plugins-70000-installs-ai-api-key-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[JetBrains]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[developer tools]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Thu, 18 Jun 2026 12:03:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiBleed: 73,000 Fortinet VPN Credentials Exposed]]></title>
            <description><![CDATA[Russian-speaking threat group harvested plaintext credentials for 73,000+ Fortinet firewalls across 194 countries. Samsung, Oracle, and NATO contractor among victims.]]></description>
            <link>https://www.probablypwned.com/article/fortibleed-73000-fortinet-vpn-credentials-russian-threat-actors</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortibleed-73000-fortinet-vpn-credentials-russian-threat-actors</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiBleed]]></category>
            <category><![CDATA[credential leak]]></category>
            <category><![CDATA[VPN security]]></category>
            <category><![CDATA[Russian threat actors]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Wed, 17 Jun 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NVIDIA NeMo Code Injection Threatens AI Development Pipelines]]></title>
            <description><![CDATA[CVE-2026-24155 allows local privilege escalation in NVIDIA's AI framework across Windows, Linux, and macOS. The CVSS 7.8 flaw affects multi-tenant ML environments where isolation is critical.]]></description>
            <link>https://www.probablypwned.com/article/nvidia-nemo-cve-2026-24155-code-injection-ai-framework</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nvidia-nemo-cve-2026-24155-code-injection-ai-framework</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[NVIDIA]]></category>
            <category><![CDATA[CVE-2026-24155]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[code injection]]></category>
            <category><![CDATA[NeMo]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 17 Jun 2026 12:05:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Belarus-Linked Ghostwriter Targets Polish Officials via Gmail]]></title>
            <description><![CDATA[UNC1151 phishing campaign steals 2FA codes using fake Google security alerts. CERT Polska reports new domains appearing daily as attackers target government officials and their families.]]></description>
            <link>https://www.probablypwned.com/article/ghostwriter-unc1151-gmail-phishing-poland-2fa-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghostwriter-unc1151-gmail-phishing-poland-2fa-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Ghostwriter]]></category>
            <category><![CDATA[UNC1151]]></category>
            <category><![CDATA[Belarus]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Gmail]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Wed, 17 Jun 2026 12:05:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LiteSpeed cPanel Flaw Gives FTP Users Root Access]]></title>
            <description><![CDATA[CVE-2026-54420 exploits symlink mishandling to escalate privileges on shared hosting servers. CISA mandates federal patching within 48 hours as attackers target multi-tenant environments.]]></description>
            <link>https://www.probablypwned.com/article/litespeed-cpanel-cve-2026-54420-symlink-root-escalation-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/litespeed-cpanel-cve-2026-54420-symlink-root-escalation-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-54420]]></category>
            <category><![CDATA[LiteSpeed]]></category>
            <category><![CDATA[cPanel]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 17 Jun 2026 12:04:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Second Cisco SD-WAN Zero-Day Hits CISA KEV in Two Weeks]]></title>
            <description><![CDATA[CVE-2026-20262 joins CVE-2026-20245 on CISA's exploited vulnerabilities list. Attackers deploy malicious .war files via path traversal to gain root access on Catalyst SD-WAN Manager.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20262-path-traversal-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20262-path-traversal-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20262]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <dc:creator><![CDATA[Marcus Chen]]></dc:creator>
            <pubDate>Wed, 17 Jun 2026 12:04:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mastra npm Hijack Drops Crypto-Stealing RAT on AI Developers]]></title>
            <description><![CDATA[144 packages in the Mastra AI framework compromised via hijacked maintainer account. The malicious easy-day-js dependency deploys a crypto-stealing RAT affecting 1.1M weekly downloads.]]></description>
            <link>https://www.probablypwned.com/article/mastra-npm-supply-chain-144-packages-crypto-rat-ai-developers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mastra-npm-supply-chain-144-packages-crypto-rat-ai-developers</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Wed, 17 Jun 2026 12:03:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Steam Workshop Wallpapers Spread Infostealers, Backdoors]]></title>
            <description><![CDATA[Kaspersky uncovers malware campaign using Wallpaper Engine's Steam Workshop to distribute DarkKomet, Lumma, and Vidar. China-focused attacks stole Steam accounts and deployed cryptominers.]]></description>
            <link>https://www.probablypwned.com/article/steam-workshop-wallpaper-engine-malware-darkkomet-lumma-kaspersky</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/steam-workshop-wallpaper-engine-malware-darkkomet-lumma-kaspersky</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Steam]]></category>
            <category><![CDATA[Wallpaper Engine]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[DarkKomet]]></category>
            <category><![CDATA[Lumma]]></category>
            <category><![CDATA[Vidar]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 16 Jun 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Sysco Faces Second Extortion as ShinyHunters Claims 61M Records]]></title>
            <description><![CDATA[Food distribution giant Sysco hit with new extortion demand from ShinyHunters gang claiming 61 million Salesforce records, weeks after Qilin ransomware threat.]]></description>
            <link>https://www.probablypwned.com/article/sysco-shinyhunters-61-million-records-second-extortion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sysco-shinyhunters-61-million-records-second-extortion</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[Sysco]]></category>
            <category><![CDATA[Salesforce]]></category>
            <dc:creator><![CDATA[Sarah Mitchell]]></dc:creator>
            <pubDate>Tue, 16 Jun 2026 12:18:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Conti Ransomware Developer Pleads Guilty, Faces 20 Years]]></title>
            <description><![CDATA[Ukrainian national Oleksii Lytvynenko admits to developing loader malware for the Conti ransomware gang after extradition from Ireland. Sentencing set for September 2026.]]></description>
            <link>https://www.probablypwned.com/article/conti-ransomware-developer-lytvynenko-pleads-guilty-loader</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/conti-ransomware-developer-lytvynenko-pleads-guilty-loader</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Conti]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[cybercrime]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[prosecution]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 16 Jun 2026 12:17:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT37 Deploys NarwhalRAT via Fake Microsoft Security Alerts]]></title>
            <description><![CDATA[North Korean hackers impersonate Microsoft Account security notifications to deliver NarwhalRAT, a Python-based RAT with keylogging, screen capture, and cloud-based C2.]]></description>
            <link>https://www.probablypwned.com/article/apt37-narwhalrat-fake-microsoft-security-alerts-north-korea</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt37-narwhalrat-fake-microsoft-security-alerts-north-korea</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[APT37]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[NarwhalRAT]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[RAT]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 16 Jun 2026 12:17:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SprySOCKS Backdoor Gets Windows Variants With Kernel-Level Stealth]]></title>
            <description><![CDATA[China-linked FishMonger APT expands its Linux-only SprySOCKS backdoor to Windows with WIN_DRV and WIN_PLUS variants featuring kernel drivers and Print Spooler abuse.]]></description>
            <link>https://www.probablypwned.com/article/sprysocks-windows-backdoor-fishmonger-china-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sprysocks-windows-backdoor-fishmonger-china-espionage</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[FishMonger]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Windows malware]]></category>
            <dc:creator><![CDATA[James Rivera]]></dc:creator>
            <pubDate>Tue, 16 Jun 2026 12:16:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese Hackers Stole US Defense, AI Data for 14 Months Undetected]]></title>
            <description><![CDATA[Google TAG exposes UNC6508 campaign that compromised US and Canadian medical, academic, and military research labs since September 2023 using custom INFINITERED malware.]]></description>
            <link>https://www.probablypwned.com/article/unc6508-chinese-espionage-us-canada-research-labs-14-months</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unc6508-chinese-espionage-us-canada-research-labs-14-months</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[UNC6508]]></category>
            <category><![CDATA[Google TAG]]></category>
            <dc:creator><![CDATA[Alex Kowalski]]></dc:creator>
            <pubDate>Tue, 16 Jun 2026 12:15:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Kyushu Electric Loses Unencrypted SSD With 10.9M Records]]></title>
            <description><![CDATA[Japan's Kyushu Electric Power reports an unencrypted SSD containing 10.9 million customer records vanished from a locked server room, becoming Japan's largest data breach.]]></description>
            <link>https://www.probablypwned.com/article/kyushu-electric-power-ssd-missing-10-million-records-japan-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kyushu-electric-power-ssd-missing-10-million-records-japan-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Japan]]></category>
            <category><![CDATA[physical security]]></category>
            <category><![CDATA[Kyushu Electric]]></category>
            <category><![CDATA[unencrypted data]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 15 Jun 2026 12:08:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Black Wolves Claim Iran Banking Cyberattack Hitting 4 Banks]]></title>
            <description><![CDATA[A cyberattack disrupted services at four major Iranian banks on June 14, with hacktivist group Black Wolves claiming responsibility for targeting shared infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/iran-banks-cyberattack-black-wolves-melli-tejarat-saderat-disruption</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-banks-cyberattack-black-wolves-melli-tejarat-saderat-disruption</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[banking]]></category>
            <category><![CDATA[cyberattack]]></category>
            <category><![CDATA[Black Wolves]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 15 Jun 2026 12:07:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[152 Chrome Extensions Caught Harvesting Data, Faking Traffic]]></title>
            <description><![CDATA[Socket researchers expose a coordinated network of 152 Chrome 'live wallpaper' extensions stealing user data and generating fake Google organic search traffic.]]></description>
            <link>https://www.probablypwned.com/article/chrome-live-wallpaper-extensions-152-ad-fraud-data-harvesting-socket</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-live-wallpaper-extensions-152-ad-fraud-data-harvesting-socket</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[adware]]></category>
            <category><![CDATA[data harvesting]]></category>
            <category><![CDATA[ad fraud]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 15 Jun 2026 12:06:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Claims 26M Records From Madison Square Garden]]></title>
            <description><![CDATA[ShinyHunters threatens to leak 26 million customer records from MSG Sports, owner of the Knicks and Rangers, as today's June 15 deadline passes.]]></description>
            <link>https://www.probablypwned.com/article/shinyhunters-madison-square-garden-26-million-records-knicks-rangers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shinyhunters-madison-square-garden-26-million-records-knicks-rangers</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Madison Square Garden]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[sports]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 15 Jun 2026 12:05:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518432031352-d6fc5c10da5a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518432031352-d6fc5c10da5a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Dismantles Outsider — AI-Powered Phishing Ring Behind $1.9B]]></title>
            <description><![CDATA[Operation Ghost Hook takedown seizes 9,000 fake websites and $100K in crypto from Chinese phishing-as-a-service ring that weaponized Gemini AI to steal 3.8 million credit cards.]]></description>
            <link>https://www.probablypwned.com/article/fbi-outsider-enterprise-ai-phishing-takedown-operation-ghost-hook</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-outsider-enterprise-ai-phishing-takedown-operation-ghost-hook</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[AI abuse]]></category>
            <category><![CDATA[law enforcement]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 14 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Novo Nordisk Discloses Breach Exposing Clinical Trial Patient Data]]></title>
            <description><![CDATA[Pharmaceutical giant Novo Nordisk confirmed attackers copied clinical trial patient data and healthcare professional information from internal systems. The company says affected data was pseudonymized and cannot identify patients by name.]]></description>
            <link>https://www.probablypwned.com/article/novo-nordisk-clinical-trials-breach-patient-data-exposure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/novo-nordisk-clinical-trials-breach-patient-data-exposure</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Novo Nordisk]]></category>
            <category><![CDATA[healthcare breach]]></category>
            <category><![CDATA[clinical trials]]></category>
            <category><![CDATA[pharma]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 14 Jun 2026 12:09:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran-Linked Handala Claims Breach of California Water Utility]]></title>
            <description><![CDATA[Handala threat group claims to have compromised California Water Service, publishing 5GB of customer data. Security experts assess the group reached billing systems and GPS servers but likely cannot disrupt water operations.]]></description>
            <link>https://www.probablypwned.com/article/handala-iran-cal-water-hack-california-water-utility-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/handala-iran-cal-water-hack-california-water-utility-breach</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Handala]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[water utility]]></category>
            <category><![CDATA[MOIS]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 14 Jun 2026 12:07:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1584438784894-089d6a62b8fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1584438784894-089d6a62b8fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vidar Infostealer Spreads via Fake TikTok and Instagram Tutorials]]></title>
            <description><![CDATA[Cybercriminals are using TikTok and Instagram Reels videos to distribute Vidar malware through fake software tutorials. One campaign accumulated over 100,000 views promoting 'free Spotify Premium' hacks.]]></description>
            <link>https://www.probablypwned.com/article/vidar-infostealer-tiktok-instagram-reels-fake-software-tutorials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vidar-infostealer-tiktok-instagram-reels-fake-software-tutorials</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[TikTok]]></category>
            <category><![CDATA[Instagram]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 14 Jun 2026 12:06:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Splunk Enterprise Hit With Critical Unauthenticated RCE Flaw]]></title>
            <description><![CDATA[CVE-2026-20253 scores CVSS 9.8 and allows network attackers to execute arbitrary code on Splunk Enterprise servers without authentication. No workaround exists—patching is mandatory.]]></description>
            <link>https://www.probablypwned.com/article/splunk-cve-2026-20253-critical-postgresql-rce-unauthenticated</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/splunk-cve-2026-20253-critical-postgresql-rce-unauthenticated</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Splunk]]></category>
            <category><![CDATA[CVE-2026-20253]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVSS 9.8]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 14 Jun 2026 12:04:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Agentjacking Hijacks AI Coding Agents via Sentry MCP Injection]]></title>
            <description><![CDATA[Researchers at Tenet Security discovered Agentjacking, an attack that tricks AI coding assistants like Claude Code and Cursor into executing arbitrary code through malicious Sentry error events.]]></description>
            <link>https://www.probablypwned.com/article/agentjacking-sentry-mcp-injection-ai-coding-agents-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/agentjacking-sentry-mcp-injection-ai-coding-agents-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[MCP]]></category>
            <category><![CDATA[Sentry]]></category>
            <category><![CDATA[Claude Code]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 14 Jun 2026 12:03:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Velvet Ant Hid in Linux Auth Stack for Nearly a Decade]]></title>
            <description><![CDATA[Chinese APT Velvet Ant compromised PAM and OpenSSH on a critical infrastructure network, remaining undetected from 2016 to 2026. Here's how they did it.]]></description>
            <link>https://www.probablypwned.com/article/velvet-ant-operation-highland-pam-openssh-decade-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/velvet-ant-operation-highland-pam-openssh-decade-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Velvet Ant]]></category>
            <category><![CDATA[Chinese APT]]></category>
            <category><![CDATA[PAM backdoor]]></category>
            <category><![CDATA[air-gapped networks]]></category>
            <category><![CDATA[Sygnia]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 13 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Claims 15 Victims in 72 Hours]]></title>
            <description><![CDATA[Qilin's affiliate network hit healthcare, manufacturing, and critical infrastructure across nine countries in early June. The gang maintains 12-month dominance.]]></description>
            <link>https://www.probablypwned.com/article/qilin-ransomware-15-victims-72-hours-healthcare-manufacturing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/qilin-ransomware-15-victims-72-hours-healthcare-manufacturing</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 13 Jun 2026 12:07:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Check Point VPN PoC Drops as Exploitation Intensifies]]></title>
            <description><![CDATA[WatchTowr Labs published technical details and exploit code for CVE-2026-50751, the auth bypass flaw already used by Qilin ransomware. TCP 443 bypass works too.]]></description>
            <link>https://www.probablypwned.com/article/check-point-vpn-cve-2026-50751-poc-watchtowr-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/check-point-vpn-cve-2026-50751-poc-watchtowr-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Check Point]]></category>
            <category><![CDATA[CVE-2026-50751]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[proof-of-concept]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 13 Jun 2026 12:06:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LangGraph Vulnerability Chain Enables Full Server Takeover]]></title>
            <description><![CDATA[Check Point researchers chained SQL injection and unsafe deserialization flaws to achieve RCE on AI workflow platforms. Patch langgraph to 1.0.10+ immediately.]]></description>
            <link>https://www.probablypwned.com/article/langgraph-cve-2026-28277-sqli-rce-chain-checkpoint</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langgraph-cve-2026-28277-sqli-rce-chain-checkpoint</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[LangGraph]]></category>
            <category><![CDATA[LangChain]]></category>
            <category><![CDATA[CVE-2026-28277]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 13 Jun 2026 12:05:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Tchap Breach Exposes 73,000 French Government Accounts]]></title>
            <description><![CDATA[Attackers compromised France's secure messaging platform via social engineering, allegedly stealing 650,000 messages and 13.5GB of data from civil servants.]]></description>
            <link>https://www.probablypwned.com/article/tchap-french-government-breach-73000-accounts-anssi</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tchap-french-government-breach-73000-accounts-anssi</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Tchap]]></category>
            <category><![CDATA[France]]></category>
            <category><![CDATA[government breach]]></category>
            <category><![CDATA[ANSSI]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 13 Jun 2026 12:05:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ivanti Sentry CVE-2026-10520: CISA's First 3-Day Patch Mandate]]></title>
            <description><![CDATA[CISA orders federal agencies to patch CVSS 10.0 Ivanti Sentry flaw within 3 days—the first application of BOD 26-04. Exploitation is automated and widespread.]]></description>
            <link>https://www.probablypwned.com/article/ivanti-sentry-cve-2026-10520-cisa-3-day-mandate-root-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ivanti-sentry-cve-2026-10520-cisa-3-day-mandate-root-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[CVE-2026-10520]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 13 Jun 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[400+ Arch Linux AUR Packages Hijacked With eBPF Rootkit]]></title>
            <description><![CDATA[Attackers adopted orphaned AUR packages to push credential-stealing malware with kernel-level rootkit capabilities. Here's what Arch users need to do now.]]></description>
            <link>https://www.probablypwned.com/article/arch-linux-aur-400-packages-atomic-arch-ebpf-rootkit-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/arch-linux-aur-400-packages-atomic-arch-ebpf-rootkit-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Arch Linux]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[rootkit]]></category>
            <category><![CDATA[eBPF]]></category>
            <category><![CDATA[AUR]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 12 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[npm v12 Disables Install Scripts by Default to Block Supply Chain Attacks]]></title>
            <description><![CDATA[GitHub announces breaking changes for npm 12 releasing next month. Install scripts, Git dependencies, and remote URLs now require explicit approval to combat malicious packages.]]></description>
            <link>https://www.probablypwned.com/article/npm-v12-install-scripts-disabled-supply-chain-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/npm-v12-install-scripts-disabled-supply-chain-security</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[JavaScript]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 12 Jun 2026 12:04:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607799279861-4dd421887fb3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607799279861-4dd421887fb3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Europol Dismantles AudiA6 Crypto Laundry Used by Ransomware Gangs]]></title>
            <description><![CDATA[11-nation operation shuts down €336M cryptocurrency laundering service. Two operators arrested in Georgia, 25 domains seized, and over 6,000 money mule accounts exposed.]]></description>
            <link>https://www.probablypwned.com/article/europol-audia6-crypto-laundering-336-million-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/europol-audia6-crypto-laundering-336-million-ransomware</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Europol]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[money laundering]]></category>
            <category><![CDATA[law enforcement]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 12 Jun 2026 12:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OnyxC2 Infostealer Targets 210 Apps, Offers Refunds If Detected]]></title>
            <description><![CDATA[BlackFog researchers detail OnyxC2 MaaS stealer pricing at $250/month. Targets browsers, crypto wallets, password managers with DLL sideloading delivery that bypasses VirusTotal detection.]]></description>
            <link>https://www.probablypwned.com/article/onyxc2-infostealer-maas-250-monthly-blackfog</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/onyxc2-infostealer-maas-250-monthly-blackfog</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[MaaS]]></category>
            <category><![CDATA[OnyxC2]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 12 Jun 2026 12:03:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China-Linked OP-512 Deploys Cryptographic Web Shells on IIS Servers]]></title>
            <description><![CDATA[ReliaQuest uncovers OP-512 threat cluster targeting Windows IIS servers with three-part web shell framework. Each deployment is unique, self-reporting, and timestamps itself to evade forensics.]]></description>
            <link>https://www.probablypwned.com/article/op-512-china-iis-web-shell-framework-reliaquest</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/op-512-china-iis-web-shell-framework-reliaquest</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[IIS]]></category>
            <category><![CDATA[web shell]]></category>
            <category><![CDATA[OP-512]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 12 Jun 2026 12:03:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Finally Patches Exchange OWA Zero-Day After 26-Day Wait]]></title>
            <description><![CDATA[Microsoft releases CVE-2026-42897 fix for Exchange Server OWA XSS vulnerability exploited since May. ESU-only updates for 2016/2019 leave many systems exposed.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-exchange-cve-2026-42897-owa-xss-patch-esu</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-exchange-cve-2026-42897-owa-xss-patch-esu</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft Exchange]]></category>
            <category><![CDATA[CVE-2026-42897]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[OWA]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 12 Jun 2026 12:02:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Arista Refuses to Patch Exploited Flaw Added to CISA KEV]]></title>
            <description><![CDATA[CVE-2026-7473 lets attackers bypass tunnel security controls on Arista network devices. CISA added it to KEV—but Arista says patching would 'break existing configurations.']]></description>
            <link>https://www.probablypwned.com/article/arista-eos-cve-2026-7473-cisa-kev-no-patch-planned</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/arista-eos-cve-2026-7473-cisa-kev-no-patch-planned</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Arista]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[CVE-2026-7473]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 11 Jun 2026 12:06:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516259762381-22954d7d3ad2?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516259762381-22954d7d3ad2?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ServiceNow API Flaw Exposed Customer Data Before Patch]]></title>
            <description><![CDATA[Attackers exploited an unauthenticated API endpoint to query ServiceNow customer instances. The company received a bug report in April but didn't patch until June 5—after exploitation began.]]></description>
            <link>https://www.probablypwned.com/article/servicenow-api-unauthenticated-access-customer-data-exposure-june-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/servicenow-api-unauthenticated-access-customer-data-exposure-june-2026</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ServiceNow]]></category>
            <category><![CDATA[API security]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[unauthenticated access]]></category>
            <category><![CDATA[enterprise software]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 11 Jun 2026 12:05:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Langflow AI Platform RCE Flaw Exploited — 7,000 Instances Exposed]]></title>
            <description><![CDATA[CVE-2026-5027 allows unauthenticated attackers to write arbitrary files on Langflow servers. Patch to version 1.10.0 immediately—attackers are already exploiting exposed instances.]]></description>
            <link>https://www.probablypwned.com/article/langflow-cve-2026-5027-ai-platform-path-traversal-rce-7000-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langflow-cve-2026-5027-ai-platform-path-traversal-rce-7000-exposed</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Langflow]]></category>
            <category><![CDATA[CVE-2026-5027]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 11 Jun 2026 12:05:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Breaches 100+ Orgs via Oracle PeopleSoft RCE]]></title>
            <description><![CDATA[Oracle issues emergency patch for CVE-2026-35273 (CVSS 9.8) as ShinyHunters claims to have stolen data from 300 PeopleSoft instances. Nottingham University among confirmed victims.]]></description>
            <link>https://www.probablypwned.com/article/oracle-peoplesoft-cve-2026-35273-shinyhunters-100-organizations-breached</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-peoplesoft-cve-2026-35273-shinyhunters-100-organizations-breached</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[PeopleSoft]]></category>
            <category><![CDATA[CVE-2026-35273]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 11 Jun 2026 12:04:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RoguePlanet Zero-Day Bypasses Fully-Patched Windows Defender]]></title>
            <description><![CDATA[Security researcher Nightmare Eclipse releases fourth Microsoft Defender zero-day in months, granting SYSTEM privileges on patched Windows 10 and 11 systems. Here's what defenders need to know.]]></description>
            <link>https://www.probablypwned.com/article/rogueplanet-windows-defender-zero-day-system-privileges-nightmare-eclipse</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/rogueplanet-windows-defender-zero-day-system-privileges-nightmare-eclipse</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows Defender]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Nightmare Eclipse]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 11 Jun 2026 12:03:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ghost CMS Flaw Turns Harvard, Oxford Sites Into Malware Hosts]]></title>
            <description><![CDATA[Attackers exploited CVE-2026-26980 SQL injection in Ghost CMS to compromise 700+ websites including Harvard and Oxford, deploying ClickFix social engineering malware through fake CAPTCHA prompts.]]></description>
            <link>https://www.probablypwned.com/article/ghost-cms-cve-2026-26980-clickfix-malware-harvard-oxford</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghost-cms-cve-2026-26980-clickfix-malware-harvard-oxford</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Ghost CMS]]></category>
            <category><![CDATA[CVE-2026-26980]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[SQL Injection]]></category>
            <category><![CDATA[Social Engineering]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 10 Jun 2026 12:07:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1543946207-39bd91e70ca7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1543946207-39bd91e70ca7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SAP Patches Four Critical NetWeaver Flaws — CVSS 9.9 SAML Bypass]]></title>
            <description><![CDATA[SAP's June 2026 Security Patch Day addresses 15 vulnerabilities including CVE-2026-44748 (CVSS 9.9) enabling SAML authentication bypass and CVE-2026-27671 (CVSS 9.8) memory corruption RCE.]]></description>
            <link>https://www.probablypwned.com/article/sap-netweaver-june-2026-critical-cve-2026-44748-saml-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sap-netweaver-june-2026-critical-cve-2026-44748-saml-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SAP]]></category>
            <category><![CDATA[NetWeaver]]></category>
            <category><![CDATA[CVE-2026-44748]]></category>
            <category><![CDATA[SAML]]></category>
            <category><![CDATA[Enterprise Security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 10 Jun 2026 12:07:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544890225-2f3faec4cd60?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544890225-2f3faec4cd60?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Veeam Backup Flaw Lets Domain Users Execute Code on Servers]]></title>
            <description><![CDATA[CVE-2026-44963 in Veeam Backup & Replication enables any authenticated domain user to achieve remote code execution on backup servers. CVSS 9.4 critical severity.]]></description>
            <link>https://www.probablypwned.com/article/veeam-cve-2026-44963-backup-server-rce-domain-users</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/veeam-cve-2026-44963-backup-server-rce-domain-users</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Veeam]]></category>
            <category><![CDATA[CVE-2026-44963]]></category>
            <category><![CDATA[Backup Security]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Ransomware]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 10 Jun 2026 12:06:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1589652717521-10c0d092dea9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1589652717521-10c0d092dea9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome V8 Zero-Day Under Active Exploitation — Update Now]]></title>
            <description><![CDATA[Google patches CVE-2026-11645, the fifth actively exploited Chrome zero-day of 2026. The V8 out-of-bounds memory flaw enables sandbox code execution via malicious web pages.]]></description>
            <link>https://www.probablypwned.com/article/chrome-v8-cve-2026-11645-zero-day-oob-memory-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-v8-cve-2026-11645-zero-day-oob-memory-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Google Chrome]]></category>
            <category><![CDATA[CVE-2026-11645]]></category>
            <category><![CDATA[V8]]></category>
            <category><![CDATA[Zero-Day]]></category>
            <category><![CDATA[Browser Security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 10 Jun 2026 12:05:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches 206 Flaws Including Wormable Kernel RCE]]></title>
            <description><![CDATA[Microsoft's record-breaking June 2026 Patch Tuesday fixes 206 vulnerabilities including CVE-2026-45657, a CVSS 9.8 wormable kernel flaw allowing remote code execution without authentication.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-patch-tuesday-june-2026-cve-2026-45657-wormable-kernel-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-patch-tuesday-june-2026-cve-2026-45657-wormable-kernel-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[CVE-2026-45657]]></category>
            <category><![CDATA[Windows Kernel]]></category>
            <category><![CDATA[Zero-Day]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 10 Jun 2026 12:05:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1591696205602-2f950c417cb9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1591696205602-2f950c417cb9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Silent Ransom Gang Sends Fake IT Staff Into Law Firm Offices]]></title>
            <description><![CDATA[Mandiant tracks UNC3753 hitting dozens of law firms via vishing and physical intrusions. Data theft to extortion in under one hour. FBI issues flash alert.]]></description>
            <link>https://www.probablypwned.com/article/silent-ransom-group-unc3753-law-firms-vishing-physical-intrusion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/silent-ransom-group-unc3753-law-firms-vishing-physical-intrusion</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Silent Ransom Group]]></category>
            <category><![CDATA[UNC3753]]></category>
            <category><![CDATA[Law Firms]]></category>
            <category><![CDATA[Vishing]]></category>
            <category><![CDATA[Social Engineering]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 09 Jun 2026 12:06:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[One-Character Linux Kernel Bug Enables Root and Container Escape]]></title>
            <description><![CDATA[CVE-2026-23111 exploit code now public. A single misplaced character in nf_tables lets unprivileged users gain root and escape containers. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/linux-kernel-cve-2026-23111-nftables-container-escape-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/linux-kernel-cve-2026-23111-nftables-container-escape-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux Kernel]]></category>
            <category><![CDATA[CVE-2026-23111]]></category>
            <category><![CDATA[Container Escape]]></category>
            <category><![CDATA[Privilege Escalation]]></category>
            <category><![CDATA[nftables]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 09 Jun 2026 12:06:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LiteLLM Flaw Chains to Unauthenticated RCE—CISA Adds to KEV]]></title>
            <description><![CDATA[CVE-2026-42271 in LiteLLM chains with Starlette bypass for unauthenticated remote code execution. CISA adds to KEV catalog after active exploitation confirmed.]]></description>
            <link>https://www.probablypwned.com/article/litellm-cve-2026-42271-cisa-kev-unauthenticated-rce-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/litellm-cve-2026-42271-cisa-kev-unauthenticated-rce-chain</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[LiteLLM]]></category>
            <category><![CDATA[CVE-2026-42271]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 09 Jun 2026 12:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NSO Group Defies Court Order With New WhatsApp Phishing Wave]]></title>
            <description><![CDATA[Meta catches NSO Group targeting WhatsApp users in Jordan and Lebanon despite permanent injunction. Files contempt order after detecting one-click phishing attempts.]]></description>
            <link>https://www.probablypwned.com/article/nso-group-whatsapp-phishing-court-order-contempt-pegasus</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nso-group-whatsapp-phishing-court-order-contempt-pegasus</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[NSO Group]]></category>
            <category><![CDATA[Pegasus]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[spyware]]></category>
            <category><![CDATA[Meta]]></category>
            <category><![CDATA[phishing]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 08 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Miasma Worm Spreads to 73 Microsoft GitHub Repos, Forcing Takedowns]]></title>
            <description><![CDATA[Self-replicating Miasma malware compromises 73 Microsoft repositories across Azure, Microsoft, and MicrosoftDocs orgs. GitHub disables access as durabletask package gets reinfected.]]></description>
            <link>https://www.probablypwned.com/article/miasma-worm-microsoft-github-repos-supply-chain-durabletask</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/miasma-worm-microsoft-github-repos-supply-chain-durabletask</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Miasma]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[npm]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 08 Jun 2026 12:04:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Malware Hides C2 Payloads in Steam Profile Comments]]></title>
            <description><![CDATA[GoDaddy researchers uncover campaign infecting 2,000 WordPress sites with malware that extracts commands from invisible Unicode characters in Steam Community comments.]]></description>
            <link>https://www.probablypwned.com/article/wordpress-steam-profile-malware-unicode-c2-godaddy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wordpress-steam-profile-malware-unicode-c2-godaddy</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[Steam]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[Unicode steganography]]></category>
            <category><![CDATA[GoDaddy]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 08 Jun 2026 12:04:04 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI-Built Ransomware Toolkit Found Testing Evasion Against Top EDRs]]></title>
            <description><![CDATA[Sophos discovers ransomware framework using Claude Opus 4.5 to automate EDR evasion and Active Directory discovery. Toolkit tested 80+ modules against Sophos, CrowdStrike, and Defender.]]></description>
            <link>https://www.probablypwned.com/article/ai-ransomware-toolkit-sophos-edr-evasion-claude-opus</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-ransomware-toolkit-sophos-edr-evasion-claude-opus</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[EDR evasion]]></category>
            <category><![CDATA[Sophos]]></category>
            <category><![CDATA[Claude Opus]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 08 Jun 2026 12:04:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Claude Code GitHub Action Flaw Enabled Repo Hijacking via Issues]]></title>
            <description><![CDATA[Anthropic patches critical Claude Code GitHub Action vulnerability that let attackers steal tokens and hijack repositories through a single malicious issue. CVSS 7.8 flaw exploited bot actor trust.]]></description>
            <link>https://www.probablypwned.com/article/claude-code-github-action-prompt-injection-repository-hijack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/claude-code-github-action-prompt-injection-repository-hijack</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Claude Code]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Anthropic]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 08 Jun 2026 12:04:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FlutterShell Backdoor Spreads via Malicious Google and YouTube Ads]]></title>
            <description><![CDATA[Unit 42 uncovers FlutterShell backdoor campaign targeting macOS users through Google-verified shell companies. Malware evades detection via WebView architecture and Apple notarization.]]></description>
            <link>https://www.probablypwned.com/article/fluttershell-macos-backdoor-malvertising-google-youtube-unit42</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fluttershell-macos-backdoor-malvertising-google-youtube-unit42</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[FlutterShell]]></category>
            <category><![CDATA[macOS malware]]></category>
            <category><![CDATA[malvertising]]></category>
            <category><![CDATA[Unit 42]]></category>
            <category><![CDATA[adware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 08 Jun 2026 12:03:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[C0xmo Botnet Exploits DD-WRT Flaw to Build IoT DDoS Army]]></title>
            <description><![CDATA[Fortinet exposes C0xmo, a modular Gafgyt variant exploiting CVE-2021-27137 in DD-WRT routers to recruit IoT devices for DDoS attacks while killing rival malware.]]></description>
            <link>https://www.probablypwned.com/article/c0xmo-gafgyt-botnet-dd-wrt-upnp-iot-ddos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/c0xmo-gafgyt-botnet-dd-wrt-upnp-iot-ddos</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Botnet]]></category>
            <category><![CDATA[Gafgyt]]></category>
            <category><![CDATA[DD-WRT]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[DDoS]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 07 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hola Browser Supply Chain Breach Delivered Monero Miner to Users]]></title>
            <description><![CDATA[Sophos discovered a cryptocurrency miner bundled with Hola Browser for Windows. The malware creates a Windows service, adds Defender exclusions, and mines when idle.]]></description>
            <link>https://www.probablypwned.com/article/hola-browser-supply-chain-monero-cryptominer-windows</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hola-browser-supply-chain-monero-cryptominer-windows</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[cryptocurrency miner]]></category>
            <category><![CDATA[Hola Browser]]></category>
            <category><![CDATA[Monero]]></category>
            <category><![CDATA[Windows malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 07 Jun 2026 12:13:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Magecart Hides Skimmer Inside Stripe's Own API—Bypasses CSP]]></title>
            <description><![CDATA[New Magecart campaign stores payment card skimmer payloads in Stripe customer metadata, then exfiltrates stolen cards as fake customer records. CSP rules won't help.]]></description>
            <link>https://www.probablypwned.com/article/magecart-stripe-api-skimmer-gtm-csp-bypass-ecommerce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/magecart-stripe-api-skimmer-gtm-csp-bypass-ecommerce</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Magecart]]></category>
            <category><![CDATA[Stripe]]></category>
            <category><![CDATA[credit card skimmer]]></category>
            <category><![CDATA[web skimming]]></category>
            <category><![CDATA[ecommerce security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 07 Jun 2026 12:11:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Exim Mail Server RCE Requires Zero Auth—Patch to 4.99.3 Now]]></title>
            <description><![CDATA[CVE-2026-45185 is a use-after-free in Exim affecting GnuTLS builds with BDAT support. Unauthenticated attackers can achieve remote code execution via crafted SMTP traffic.]]></description>
            <link>https://www.probablypwned.com/article/exim-cve-2026-45185-gnutls-bdat-unauthenticated-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/exim-cve-2026-45185-gnutls-bdat-unauthenticated-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Exim]]></category>
            <category><![CDATA[CVE-2026-45185]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[mail server]]></category>
            <category><![CDATA[use-after-free]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 07 Jun 2026 12:08:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds SolarWinds Serv-U Flaw to KEV After Active Exploitation]]></title>
            <description><![CDATA[CVE-2026-28318 lets unauthenticated attackers crash SolarWinds Serv-U servers via malformed POST requests. CISA sets June 19 federal deadline after confirming active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/solarwinds-serv-u-cve-2026-28318-cisa-kev-dos-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/solarwinds-serv-u-cve-2026-28318-cisa-kev-dos-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[CVE-2026-28318]]></category>
            <category><![CDATA[denial of service]]></category>
            <category><![CDATA[file transfer]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 07 Jun 2026 12:06:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[IBM WebSphere Hit by Three Critical Flaws—CVSS 9.1 Spoofing, Dual RCE]]></title>
            <description><![CDATA[IBM discloses CVE-2026-8644, CVE-2026-9311, and CVE-2026-9319 affecting WebSphere 8.5 and 9.0. Attackers can chain identity spoofing with RCE for full server compromise.]]></description>
            <link>https://www.probablypwned.com/article/ibm-websphere-cve-2026-8644-9311-9319-critical-rce-spoofing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ibm-websphere-cve-2026-8644-9311-9319-critical-rce-spoofing</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[IBM WebSphere]]></category>
            <category><![CDATA[CVE-2026-8644]]></category>
            <category><![CDATA[CVE-2026-9311]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[identity spoofing]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 07 Jun 2026 12:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607799279861-4dd421887fb3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607799279861-4dd421887fb3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Plugin RCE Under Mass Exploitation — 29K Attacks]]></title>
            <description><![CDATA[CVE-2026-3300 in Everest Forms Pro allows unauthenticated attackers to execute PHP code via eval() injection. Over 29,300 exploit attempts blocked since April despite patch availability.]]></description>
            <link>https://www.probablypwned.com/article/everest-forms-pro-cve-2026-3300-wordpress-rce-active-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/everest-forms-pro-cve-2026-3300-wordpress-rce-active-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-3300]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Everest Forms]]></category>
            <category><![CDATA[PHP injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 06 Jun 2026 12:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Phantom Taurus: Chinese APT Deploys NET-STAR Malware Suite]]></title>
            <description><![CDATA[Unit 42 exposes Phantom Taurus, a China-aligned APT targeting governments and telecoms across Africa, the Middle East, and Asia with custom NET-STAR backdoors for IIS servers.]]></description>
            <link>https://www.probablypwned.com/article/phantom-taurus-chinese-apt-net-star-malware-africa-asia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/phantom-taurus-chinese-apt-net-star-malware-africa-asia</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Phantom Taurus]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[NET-STAR]]></category>
            <category><![CDATA[cyber espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 06 Jun 2026 12:05:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Zero-Day Exploited for Root Access — No Patch]]></title>
            <description><![CDATA[CVE-2026-20245 lets attackers with netadmin credentials execute arbitrary commands as root on Cisco Catalyst SD-WAN Manager. Active exploitation confirmed, no fix available yet.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20245-root-exploit-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20245-root-exploit-zero-day</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <category><![CDATA[CVE-2026-20245]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 06 Jun 2026 12:04:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EU Unveils Tech Sovereignty Package to Cut US, China Dependency]]></title>
            <description><![CDATA[European Commission announces Chips Act 2.0 and Cloud and AI Development Act to reduce reliance on US cloud giants and Chinese telecom vendors. Four-tier trust framework for cloud services incoming.]]></description>
            <link>https://www.probablypwned.com/article/eu-tech-sovereignty-package-chips-cloud-ai-us-china</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/eu-tech-sovereignty-package-chips-cloud-ai-us-china</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[EU]]></category>
            <category><![CDATA[tech sovereignty]]></category>
            <category><![CDATA[Chips Act]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 05 Jun 2026 14:22:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UN Food Agency Breach Exposes 600,000 Gaza Households]]></title>
            <description><![CDATA[A cyberattack on the World Food Programme exposed sensitive data of 600,000 Gaza households, potentially the largest humanitarian data breach on record. 17-day notification delay raises concerns.]]></description>
            <link>https://www.probablypwned.com/article/world-food-programme-breach-600000-gaza-households-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/world-food-programme-breach-600000-gaza-households-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[World Food Programme]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Gaza]]></category>
            <category><![CDATA[humanitarian]]></category>
            <category><![CDATA[UN]]></category>
            <category><![CDATA[privacy]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 05 Jun 2026 12:07:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Unified CM SSRF Flaw Leads to Root Access, PoC Public]]></title>
            <description><![CDATA[CVE-2026-20230 in Cisco Unified Communications Manager enables unauthenticated attackers to gain root privileges via SSRF. Public exploit code raises urgency for patching.]]></description>
            <link>https://www.probablypwned.com/article/cisco-unified-cm-cve-2026-20230-ssrf-root-exploit-public</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-unified-cm-cve-2026-20230-ssrf-root-exploit-public</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20230]]></category>
            <category><![CDATA[Unified Communications Manager]]></category>
            <category><![CDATA[SSRF]]></category>
            <category><![CDATA[root access]]></category>
            <category><![CDATA[exploit]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 05 Jun 2026 12:07:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516259762381-22954d7d3ad2?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516259762381-22954d7d3ad2?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VS Code Flaw Enabled One-Click GitHub Token Theft]]></title>
            <description><![CDATA[A vulnerability in GitHub.dev allowed attackers to steal GitHub OAuth tokens with full repo access via a single malicious link. Microsoft patched the flaw within 24 hours.]]></description>
            <link>https://www.probablypwned.com/article/vscode-github-dev-oauth-token-theft-one-click-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vscode-github-dev-oauth-token-theft-one-click-attack</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[token theft]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[developer security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 05 Jun 2026 12:06:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Kirki Flaw Lets Attackers Hijack Admin Accounts]]></title>
            <description><![CDATA[CVE-2026-8206 (CVSS 9.8) in the Kirki WordPress plugin enables unauthenticated account takeover via password reset manipulation. Over 500,000 sites at risk.]]></description>
            <link>https://www.probablypwned.com/article/wordpress-kirki-cve-2026-8206-privilege-escalation-500k-sites</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wordpress-kirki-cve-2026-8206-privilege-escalation-500k-sites</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-8206]]></category>
            <category><![CDATA[Kirki]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[account takeover]]></category>
            <category><![CDATA[CVSS 9.8]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 05 Jun 2026 12:05:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PCPJack Hijacks 230 Cloud Servers for Covert SMTP Relay Network]]></title>
            <description><![CDATA[Threat actor PCPJack compromised 230 AWS, Azure, and Google Cloud servers to build a hidden email relay network. Hunt.io and SentinelOne researchers expose the operation.]]></description>
            <link>https://www.probablypwned.com/article/pcpjack-230-cloud-servers-smtp-relay-aws-azure-gcp</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pcpjack-230-cloud-servers-smtp-relay-aws-azure-gcp</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[PCPJack]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[AWS]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[Google Cloud]]></category>
            <category><![CDATA[SMTP relay]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 05 Jun 2026 12:04:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Leaks 2.6M DentaQuest Records After Failed Extortion]]></title>
            <description><![CDATA[DentaQuest confirms breach after ShinyHunters dumps 233GB of patient data including Medicaid IDs, government IDs, and health insurance details. Class action investigations underway.]]></description>
            <link>https://www.probablypwned.com/article/dentaquest-shinyhunters-breach-2-6-million-medicaid-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dentaquest-shinyhunters-breach-2-6-million-medicaid-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[DentaQuest]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[healthcare breach]]></category>
            <category><![CDATA[Medicaid]]></category>
            <category><![CDATA[data extortion]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 04 Jun 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenStack Mistral CVSS 9.9 Flaw Allows RCE via Exposed Workflow API]]></title>
            <description><![CDATA[CVE-2026-41283 enables unauthenticated remote code execution on OpenStack Mistral through 22.0.0. Trivial exploitation when API is network-accessible.]]></description>
            <link>https://www.probablypwned.com/article/openstack-mistral-cve-2026-41283-rce-workflow-api-critical</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openstack-mistral-cve-2026-41283-rce-workflow-api-critical</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-41283]]></category>
            <category><![CDATA[OpenStack]]></category>
            <category><![CDATA[Mistral]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[cloud security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 04 Jun 2026 12:06:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Storm Infostealer Decrypts Stolen Credentials Server-Side to Evade Detection]]></title>
            <description><![CDATA[New MaaS stealer ships encrypted browser data to attacker infrastructure for decryption, bypassing endpoint detection. Session hijacking with geo-matched proxies defeats MFA.]]></description>
            <link>https://www.probablypwned.com/article/storm-infostealer-server-side-decryption-session-hijacking-maas</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/storm-infostealer-server-side-decryption-session-hijacking-maas</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Storm]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[MaaS]]></category>
            <category><![CDATA[session hijacking]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 04 Jun 2026 12:05:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[HTTP/2 Bomb Exploit Crashes Servers in Seconds — 880K Sites Vulnerable]]></title>
            <description><![CDATA[CVE-2026-49975 combines HPACK compression abuse with Slowloris-style holds to exhaust 32GB of server memory in 10 seconds. nginx and Apache patched; IIS, Envoy remain exposed.]]></description>
            <link>https://www.probablypwned.com/article/http2-bomb-cve-2026-49975-nginx-apache-iis-envoy-dos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/http2-bomb-cve-2026-49975-nginx-apache-iis-envoy-dos</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-49975]]></category>
            <category><![CDATA[HTTP/2]]></category>
            <category><![CDATA[DoS]]></category>
            <category><![CDATA[nginx]]></category>
            <category><![CDATA[Apache]]></category>
            <category><![CDATA[web server security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 04 Jun 2026 12:04:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Magento Cache Plugin RCE Under Active Exploit — CISA Sets June 6 Deadline]]></title>
            <description><![CDATA[CVE-2026-45247 in Mirasvit Full Page Cache Warmer allows unauthenticated RCE via PHP deserialization. CISA confirms active exploitation targeting e-commerce sites.]]></description>
            <link>https://www.probablypwned.com/article/mirasvit-magento-cve-2026-45247-cache-warmer-rce-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mirasvit-magento-cve-2026-45247-cache-warmer-rce-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-45247]]></category>
            <category><![CDATA[Magento]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[e-commerce security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 04 Jun 2026 12:03:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders 3-Day Patch for Android and Linux Flaws Under Attack]]></title>
            <description><![CDATA[Federal agencies face June 5 deadline to remediate CVE-2025-48595 and CVE-2022-0492 after CISA confirms active exploitation. Linux container escapes and Android privilege escalation at risk.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-android-linux-cve-2025-48595-cve-2022-0492-active-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-android-linux-cve-2025-48595-cve-2022-0492-active-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[CVE-2025-48595]]></category>
            <category><![CDATA[CVE-2022-0492]]></category>
            <category><![CDATA[KEV]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 03 Jun 2026 14:35:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gamaredon Exploits WinRAR Flaw to Deploy GammaWorm in Ukraine]]></title>
            <description><![CDATA[Russian FSB-linked hackers weaponize CVE-2025-8088 to spread self-propagating malware across Ukrainian networks. Worm spreads via USB and network shares.]]></description>
            <link>https://www.probablypwned.com/article/gamaredon-winrar-cve-2025-8088-gammaworm-gammasteel-ukraine</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gamaredon-winrar-cve-2025-8088-gammaworm-gammasteel-ukraine</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Gamaredon]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[WinRAR]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 03 Jun 2026 12:15:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Two-Year-Old Oracle WebLogic Flaw to KEV Catalog]]></title>
            <description><![CDATA[CVE-2024-21182 under active exploitation against Oracle Fusion deployments. CVSS 7.5 unauthenticated takeover—federal deadline is June 4, 2026.]]></description>
            <link>https://www.probablypwned.com/article/oracle-weblogic-cve-2024-21182-cisa-kev-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-weblogic-cve-2024-21182-cisa-kev-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[WebLogic]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[CVE-2024-21182]]></category>
            <category><![CDATA[exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 03 Jun 2026 12:13:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GHOST STADIUM Fraud Network Targets FIFA World Cup Fans]]></title>
            <description><![CDATA[Group-IB exposes 4,300+ fraudulent domains impersonating FIFA ahead of World Cup 2026. Six parallel scams could steal billions—check ticket sources carefully.]]></description>
            <link>https://www.probablypwned.com/article/ghost-stadium-fifa-world-cup-2026-fraud-phishing-billions</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghost-stadium-fifa-world-cup-2026-fraud-phishing-billions</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[GHOST STADIUM]]></category>
            <category><![CDATA[FIFA]]></category>
            <category><![CDATA[World Cup]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[fraud]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 03 Jun 2026 12:10:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Codex Users Hit by Token-Stealing npm Package]]></title>
            <description><![CDATA[Malicious codexui-android npm package stole OpenAI refresh tokens from 29K developers. Mobile apps with 60K installs also compromised—revoke credentials now.]]></description>
            <link>https://www.probablypwned.com/article/openai-codex-npm-supply-chain-codexui-android-token-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-codex-npm-supply-chain-codexui-android-token-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[Codex]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 03 Jun 2026 12:08:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WeedHack Malware Infects 116K Minecraft Players via Fake Mods]]></title>
            <description><![CDATA[Malware-as-a-service infostealer spreads through malicious Minecraft mods promoted on YouTube. Steals browser credentials, crypto wallets, and Discord tokens.]]></description>
            <link>https://www.probablypwned.com/article/weedhack-minecraft-malware-116000-infected-infostealer-maas</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/weedhack-minecraft-malware-116000-infected-infostealer-maas</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WeedHack]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Minecraft]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[gaming malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 03 Jun 2026 12:06:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Citrix NetScaler CVE-2026-3055 Under Mass Exploitation]]></title>
            <description><![CDATA[Fortinet confirms large-scale attacks against Citrix NetScaler ADC and Gateway appliances via CVE-2026-3055 SAML IDP flaw. CVSS 9.8—patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/citrix-netscaler-cve-2026-3055-saml-rce-fortinet-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/citrix-netscaler-cve-2026-3055-saml-rce-fortinet-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Citrix]]></category>
            <category><![CDATA[NetScaler]]></category>
            <category><![CDATA[CVE-2026-3055]]></category>
            <category><![CDATA[SAML]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 03 Jun 2026 12:04:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI Browsers Create New Attack Surface for Prompt Injection]]></title>
            <description><![CDATA[The 2026 State of Browser Security Report reveals AI-integrated browsers and agentic copilots face systemic prompt injection risks that may never be fully solved. Here's what enterprises need to know.]]></description>
            <link>https://www.probablypwned.com/article/ai-browser-security-2026-prompt-injection-hijacking-threats</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-browser-security-2026-prompt-injection-hijacking-threats</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[agentic AI]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 02 Jun 2026 15:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Android June 2026 Update Fixes Zero-Day and 123 Other Flaws]]></title>
            <description><![CDATA[Google patches actively exploited CVE-2025-48595 affecting Android 14+ alongside 123 additional vulnerabilities. Pixel devices get immediate updates—others must wait.]]></description>
            <link>https://www.probablypwned.com/article/android-june-2026-security-bulletin-cve-2025-48595-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/android-june-2026-security-bulletin-cve-2025-48595-zero-day</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[CVE-2025-48595]]></category>
            <category><![CDATA[mobile security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 02 Jun 2026 12:11:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[JINX-0164 Targets Crypto Developers via LinkedIn and macOS Malware]]></title>
            <description><![CDATA[New threat actor uses fake recruiter profiles to deploy AUDIOFIX and MINIRAT malware against cryptocurrency organizations. npm supply chain also compromised.]]></description>
            <link>https://www.probablypwned.com/article/jinx-0164-cryptocurrency-macos-audiofix-minirat-linkedin</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/jinx-0164-cryptocurrency-macos-audiofix-minirat-linkedin</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[JINX-0164]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[macOS malware]]></category>
            <category><![CDATA[LinkedIn]]></category>
            <category><![CDATA[AUDIOFIX]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 02 Jun 2026 12:09:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CIFSwitch: 19-Year Linux Kernel Flaw Grants Root Access]]></title>
            <description><![CDATA[A SpaceX security engineer discovered a privilege escalation bug hidden in the Linux kernel since 2007. Proof-of-concept exploit published—major distributions now patching.]]></description>
            <link>https://www.probablypwned.com/article/linux-cifswitch-19-year-kernel-privilege-escalation-root</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/linux-cifswitch-19-year-kernel-privilege-escalation-root</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[kernel]]></category>
            <category><![CDATA[CIFS]]></category>
            <category><![CDATA[CVE pending]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 02 Jun 2026 12:07:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gogs RCE Flaw Lets Any User Execute Code — No Patch Available]]></title>
            <description><![CDATA[Critical CVSS 9.4 vulnerability in Gogs self-hosted Git service allows authenticated users to achieve RCE via argument injection. Maintainers unresponsive since March disclosure.]]></description>
            <link>https://www.probablypwned.com/article/gogs-rce-cvss-9-4-argument-injection-no-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gogs-rce-cvss-9-4-argument-injection-no-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Gogs]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Git]]></category>
            <category><![CDATA[argument injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 02 Jun 2026 12:05:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Red Hat npm Packages Hit by Shai-Hulud Supply Chain Attack]]></title>
            <description><![CDATA[32+ Red Hat Cloud Services npm packages compromised with Mini Shai-Hulud credential-stealing malware. 80K weekly downloads affected—here's what developers need to know.]]></description>
            <link>https://www.probablypwned.com/article/red-hat-npm-miasma-shai-hulud-supply-chain-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/red-hat-npm-miasma-shai-hulud-supply-chain-credential-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[Red Hat]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Shai-Hulud]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 02 Jun 2026 12:03:49 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SHub Reaper Targets macOS With Fake Apple Security Updates]]></title>
            <description><![CDATA[New macOS infostealer SHub Reaper impersonates Apple, Microsoft, and Google software to steal passwords, crypto wallets, and iCloud data. Bypasses Tahoe 26.4 mitigations.]]></description>
            <link>https://www.probablypwned.com/article/shub-reaper-macos-infostealer-apple-microsoft-google-disguise</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shub-reaper-macos-infostealer-apple-microsoft-google-disguise</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[SHub Reaper]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 01 Jun 2026 12:05:04 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Windows Netlogon RCE CVE-2026-41089 Under Active Attack]]></title>
            <description><![CDATA[Critical Windows Netlogon vulnerability CVE-2026-41089 enables zero-click RCE on domain controllers. Active exploitation confirmed—patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/windows-netlogon-cve-2026-41089-zero-click-rce-domain-controllers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/windows-netlogon-cve-2026-41089-zero-click-rce-domain-controllers</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[CVE-2026-41089]]></category>
            <category><![CDATA[Netlogon]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[domain controller]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 01 Jun 2026 12:04:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Exchange OWA Zero-Day CVE-2026-42897 Exploited — No Patch]]></title>
            <description><![CDATA[Microsoft Exchange Server zero-day CVE-2026-42897 enables session hijacking via malicious emails. Active exploitation confirmed with no permanent fix available.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-exchange-cve-2026-42897-owa-xss-zero-day-no-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-exchange-cve-2026-42897-owa-xss-zero-day-no-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Exchange Server]]></category>
            <category><![CDATA[CVE-2026-42897]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[OWA]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 01 Jun 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Oracle ORDS CVE-2026-46840 Scores Perfect 10 — Full Takeover]]></title>
            <description><![CDATA[Oracle REST Data Services vulnerability CVE-2026-46840 earns maximum CVSS 10.0 score. Unauthenticated attackers can achieve complete system compromise via HTTPS.]]></description>
            <link>https://www.probablypwned.com/article/oracle-rest-data-services-cve-2026-46840-cvss-10-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-rest-data-services-cve-2026-46840-cvss-10-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[CVE-2026-46840]]></category>
            <category><![CDATA[ORDS]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <category><![CDATA[May 2026 CSPU]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 01 Jun 2026 12:03:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WP Maps Pro Flaw Creates Admin Accounts — 15K Sites at Risk]]></title>
            <description><![CDATA[CVE-2026-8732 in WP Maps Pro allows unauthenticated attackers to create administrator accounts. Over 3,600 attacks blocked in 24 hours. Patch to 6.1.1 now.]]></description>
            <link>https://www.probablypwned.com/article/wp-maps-pro-cve-2026-8732-admin-account-creation-active-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wp-maps-pro-cve-2026-8732-admin-account-creation-active-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-8732]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[WP Maps Pro]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[admin takeover]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 31 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516259762381-22954d7d3ad2?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516259762381-22954d7d3ad2?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SideCopy Targets Afghanistan's Finance Ministry With XenoRAT]]></title>
            <description><![CDATA[Operation XENOFISCAL delivers customized XenoRAT to Afghanistan's Ministry of Finance and 34 provincial revenue directorates. The Pakistan-linked APT used Pashto-language lures and bulletproof European hosting.]]></description>
            <link>https://www.probablypwned.com/article/operation-xenofiscal-sidecopy-apt-afghanistan-finance-ministry-xenorat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-xenofiscal-sidecopy-apt-afghanistan-finance-ministry-xenorat</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[SideCopy]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[XenoRAT]]></category>
            <category><![CDATA[Afghanistan]]></category>
            <category><![CDATA[Pakistan]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 31 May 2026 12:07:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Flowise One-Click RCE — Import a Chatflow, Lose Your Server]]></title>
            <description><![CDATA[CVE-2026-40933 (CVSS 9.9) allows attackers to compromise self-hosted Flowise AI agent builders by tricking users into importing a malicious chatflow. The payload executes during import without user action.]]></description>
            <link>https://www.probablypwned.com/article/flowise-cve-2026-40933-one-click-rce-mcp-chatflow-import</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/flowise-cve-2026-40933-one-click-rce-mcp-chatflow-import</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Flowise]]></category>
            <category><![CDATA[CVE-2026-40933]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[MCP]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 31 May 2026 12:06:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ChatGPhish Turns ChatGPT Web Summaries Into Phishing Delivery]]></title>
            <description><![CDATA[Researchers discover ChatGPT's Markdown rendering trusts attacker-controlled content from summarized pages, enabling phishing URLs, IP exfiltration, and fake security alerts inside the AI interface.]]></description>
            <link>https://www.probablypwned.com/article/chatgphish-chatgpt-prompt-injection-web-summaries-phishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chatgphish-chatgpt-prompt-injection-web-summaries-phishing</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 31 May 2026 12:06:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Palo Alto GlobalProtect Auth Bypass Under Active Attack — CISA KEV]]></title>
            <description><![CDATA[CVE-2026-0257 lets attackers forge VPN cookies to access internal networks without credentials. CISA adds to KEV after Rapid7 confirms exploitation since May 17. Federal deadline June 19.]]></description>
            <link>https://www.probablypwned.com/article/palo-alto-globalprotect-cve-2026-0257-auth-bypass-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/palo-alto-globalprotect-cve-2026-0257-auth-bypass-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Palo Alto Networks]]></category>
            <category><![CDATA[CVE-2026-0257]]></category>
            <category><![CDATA[GlobalProtect]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 30 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical Formie Plugin Flaw Lets Attackers Hijack Craft CMS Sites]]></title>
            <description><![CDATA[CVE-2026-45697 (CVSS 9.8) in the Formie Craft CMS plugin allows unauthenticated attackers to execute arbitrary code via Twig template injection in Hidden fields. Patch to 2.2.20 or 3.1.24 immediately.]]></description>
            <link>https://www.probablypwned.com/article/formie-craft-cms-cve-2026-45697-twig-ssti-rce-critical</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/formie-craft-cms-cve-2026-45697-twig-ssti-rce-critical</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-45697]]></category>
            <category><![CDATA[Craft CMS]]></category>
            <category><![CDATA[Formie]]></category>
            <category><![CDATA[SSTI]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 30 May 2026 12:07:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious Sicoob NuGet Package Steals Banking Certs as npm Campaign Targets AWS Keys]]></title>
            <description><![CDATA[A fake Sicoob SDK on NuGet exfiltrated PFX certificates and banking credentials from Brazilian developers, while 14 malicious npm packages harvested AWS keys, Vault tokens, and CI/CD secrets.]]></description>
            <link>https://www.probablypwned.com/article/sicoob-nuget-npm-supply-chain-attack-banking-credentials-aws</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sicoob-nuget-npm-supply-chain-attack-banking-credentials-aws</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[NuGet]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[Sicoob]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[AWS]]></category>
            <category><![CDATA[CI/CD]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 30 May 2026 12:06:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Deploy LLM Agent for Post-Exploitation in Marimo Attack]]></title>
            <description><![CDATA[Sysdig documents the first AI-agent-driven intrusion: attackers exploited Marimo CVE-2026-39987, then used an LLM agent to pivot through AWS and exfiltrate a PostgreSQL database in under an hour.]]></description>
            <link>https://www.probablypwned.com/article/llm-agent-marimo-cve-2026-39987-aws-postgresql-exfiltration</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/llm-agent-marimo-cve-2026-39987-aws-postgresql-exfiltration</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[LLM]]></category>
            <category><![CDATA[AI agent]]></category>
            <category><![CDATA[Marimo]]></category>
            <category><![CDATA[CVE-2026-39987]]></category>
            <category><![CDATA[AWS]]></category>
            <category><![CDATA[data exfiltration]]></category>
            <category><![CDATA[post-exploitation]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 30 May 2026 12:05:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GREYVIBE APT Uses ChatGPT and Gemini to Target Ukraine]]></title>
            <description><![CDATA[Russian-linked GREYVIBE threat actor deploys AI-generated malware including PhantomRelay and LegionRelay against Ukrainian military and government targets. WithSecure analysis reveals the group's OPSEC failures.]]></description>
            <link>https://www.probablypwned.com/article/greyvibe-russia-ukraine-ai-apt-phantomrelay-legionrelay</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/greyvibe-russia-ukraine-ai-apt-phantomrelay-legionrelay</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[GREYVIBE]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[PhantomRelay]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 30 May 2026 12:04:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DirtyDecrypt PoC Released: Linux Kernel Flaw Grants Root]]></title>
            <description><![CDATA[CVE-2026-31635 exploits a missing copy-on-write guard in RxGK to corrupt privileged file caches. Fedora, Arch, and openSUSE at risk. Here's who's affected.]]></description>
            <link>https://www.probablypwned.com/article/dirtydecrypt-cve-2026-31635-linux-kernel-rxgk-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dirtydecrypt-cve-2026-31635-linux-kernel-rxgk-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[CVE-2026-31635]]></category>
            <category><![CDATA[DirtyDecrypt]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[RxGK]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 29 May 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Carnival Cruise Confirms 6 Million Customer Records Stolen]]></title>
            <description><![CDATA[ShinyHunters claims responsibility for Carnival breach exposing names, passport numbers, and driver's licenses. Company offering two years of credit monitoring.]]></description>
            <link>https://www.probablypwned.com/article/carnival-cruise-shinyhunters-breach-6-million-passport-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/carnival-cruise-shinyhunters-breach-6-million-passport-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Carnival Cruise]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[passport data]]></category>
            <category><![CDATA[phishing]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 29 May 2026 12:05:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Three Supply Chain Attacks to KEV — Federal Deadline June 10]]></title>
            <description><![CDATA[Daemon Tools, TanStack, and Nx Console all compromised via supply chain attacks. CVSS scores up to 9.5. CISA mandates federal remediation by June 10.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-supply-chain-daemon-tools-tanstack-nx-console-cve-2026-8398</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-supply-chain-daemon-tools-tanstack-nx-console-cve-2026-8398</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[Daemon Tools]]></category>
            <category><![CDATA[TanStack]]></category>
            <category><![CDATA[npm]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 29 May 2026 12:04:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dirty Frag: Linux Zero-Day Grants Root on All Major Distros]]></title>
            <description><![CDATA[CVE-2026-43284 and CVE-2026-43500 chain together for deterministic root access. PoC exploit is public, patches still rolling out. Here's how to detect and mitigate.]]></description>
            <link>https://www.probablypwned.com/article/dirty-frag-linux-zero-day-cve-2026-43284-root-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dirty-frag-linux-zero-day-cve-2026-43284-root-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[CVE-2026-43284]]></category>
            <category><![CDATA[Dirty Frag]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 29 May 2026 12:04:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN CVSS 10 Flaw Under Active Attack — Patch Now]]></title>
            <description><![CDATA[CVE-2026-20182 lets unauthenticated attackers gain admin access to Cisco Catalyst SD-WAN controllers. CISA adds to KEV with federal deadline. Here's what you need to know.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20182-cvss-10-auth-bypass-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20182-cvss-10-auth-bypass-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20182]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 29 May 2026 12:03:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiClient EMS Exploited to Push Fake Patch That Steals Credentials]]></title>
            <description><![CDATA[Attackers weaponize CVE-2026-35616 to deploy EKZ infostealer via FortiClient EMS management features. Fake Fortinet patch harvests browser passwords and cookies.]]></description>
            <link>https://www.probablypwned.com/article/forticlient-ems-ekz-infostealer-fake-patch-arctic-wolf</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/forticlient-ems-ekz-infostealer-fake-patch-arctic-wolf</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[FortiClient EMS]]></category>
            <category><![CDATA[EKZ Infostealer]]></category>
            <category><![CDATA[CVE-2026-35616]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Arctic Wolf]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 28 May 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake OpenAI Repo Hit #1 on Hugging Face, Stole Windows Credentials]]></title>
            <description><![CDATA[Malicious repository impersonating OpenAI's Privacy Filter reached 244,000 downloads before removal. Infostealer targeted Windows users via trending Hugging Face page.]]></description>
            <link>https://www.probablypwned.com/article/hugging-face-fake-openai-privacy-filter-infostealer-244k-downloads</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hugging-face-fake-openai-privacy-filter-infostealer-244k-downloads</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Hugging Face]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 28 May 2026 12:05:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI: Extortion Gang Walks Into Law Firms Posing as IT Staff]]></title>
            <description><![CDATA[Silent Ransom Group escalates from vishing to physical infiltration. FBI FLASH alert warns 38+ law firms already breached, with operatives plugging USB drives into office computers.]]></description>
            <link>https://www.probablypwned.com/article/fbi-silent-ransom-group-law-firms-physical-infiltration</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-silent-ransom-group-law-firms-physical-infiltration</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Silent Ransom Group]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[law firms]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[vishing]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 28 May 2026 12:05:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI Chatbots Now Directing Users to Cryptojacking Malware]]></title>
            <description><![CDATA[Microsoft warns of active campaign using AI chatbot recommendations to distribute GPU mining malware. Attackers target high-end graphics card owners through fake utility downloads.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-ai-chatbot-cryptojacking-gpu-mining-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-ai-chatbot-cryptojacking-gpu-mining-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[cryptojacking]]></category>
            <category><![CDATA[AI chatbots]]></category>
            <category><![CDATA[GPU mining]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 28 May 2026 12:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[npm Package Targeted Claude AI Users, Leaked Own GitHub Token]]></title>
            <description><![CDATA[Malicious npm package mouse5212-super-formatter stole files from Claude AI's working directory. The attacker's own GitHub token was exposed in the code, allowing researchers to trace exfiltration.]]></description>
            <link>https://www.probablypwned.com/article/npm-claude-ai-infostealer-mouse5212-github-token-leak</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/npm-claude-ai-infostealer-mouse5212-github-token-leak</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[Claude AI]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[GitHub]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 28 May 2026 12:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gitea Flaw Exposed Private Container Images for 4 Years]]></title>
            <description><![CDATA[CVE-2026-27771 let attackers pull private container images without authentication. Over 30,000 Gitea deployments affected across healthcare, aerospace, and retail. Update to 1.26.2 now.]]></description>
            <link>https://www.probablypwned.com/article/gitea-cve-2026-27771-private-container-images-exposed-30000-deployments</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gitea-cve-2026-27771-private-container-images-exposed-30000-deployments</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Gitea]]></category>
            <category><![CDATA[CVE-2026-27771]]></category>
            <category><![CDATA[container security]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[DevSecOps]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 28 May 2026 12:03:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AD Password Policies That Users Won't Hate]]></title>
            <description><![CDATA[NIST's updated password guidelines eliminate forced expiration and complexity rules. Here's how to enforce strong Active Directory passwords without driving users to workarounds.]]></description>
            <link>https://www.probablypwned.com/article/active-directory-password-policy-nist-guidelines-usability</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/active-directory-password-policy-nist-guidelines-usability</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[Active Directory]]></category>
            <category><![CDATA[password security]]></category>
            <category><![CDATA[NIST]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[identity management]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 27 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[7-Eleven Confirms ShinyHunters Breach of Franchise Systems]]></title>
            <description><![CDATA[7-Eleven confirms data breach after ShinyHunters demanded $250K ransom. Over 600,000 Salesforce records allegedly stolen from franchise application systems.]]></description>
            <link>https://www.probablypwned.com/article/7-eleven-shinyhunters-breach-600k-salesforce-records-franchise-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/7-eleven-shinyhunters-breach-600k-salesforce-records-franchise-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[7-Eleven]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Salesforce]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[retail]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 27 May 2026 12:08:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1548092372-0d1bd40894a3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1548092372-0d1bd40894a3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DocketWise Breach Exposes 143K Immigration Clients' SSNs and Passports]]></title>
            <description><![CDATA[Immigration law platform DocketWise confirms data breach affecting 143,480 people. SSNs, passport numbers, and medical information compromised via cloned repositories.]]></description>
            <link>https://www.probablypwned.com/article/docketwise-data-breach-143000-immigration-law-firm-ssn-passport</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/docketwise-data-breach-143000-immigration-law-firm-ssn-passport</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[DocketWise]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[immigration]]></category>
            <category><![CDATA[legal tech]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[PII exposure]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 27 May 2026 12:07:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DigiCert Revokes 60 Certificates After Support Portal Breach]]></title>
            <description><![CDATA[Attackers compromised DigiCert's support portal via malicious chat attachment, stealing EV code signing certificates. 11 certificates used to sign Zhong Stealer malware.]]></description>
            <link>https://www.probablypwned.com/article/digicert-support-portal-hack-60-certificates-revoked-zhong-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/digicert-support-portal-hack-60-certificates-revoked-zhong-stealer</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[DigiCert]]></category>
            <category><![CDATA[certificate authority]]></category>
            <category><![CDATA[code signing]]></category>
            <category><![CDATA[Zhong Stealer]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 27 May 2026 12:07:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SonicWall VPN MFA Bypass Fuels Ransomware Attacks on EOL Devices]]></title>
            <description><![CDATA[CVE-2024-12802 lets attackers bypass MFA on SonicWall Gen6 VPNs even after patching. Ransomware operators actively exploiting incomplete fixes. Gen6 reached EOL April 16.]]></description>
            <link>https://www.probablypwned.com/article/sonicwall-vpn-mfa-bypass-cve-2024-12802-ransomware-gen6-eol</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sonicwall-vpn-mfa-bypass-cve-2024-12802-ransomware-gen6-eol</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SonicWall]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[CVE-2024-12802]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[end-of-life]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 27 May 2026 12:06:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LiteSpeed cPanel Flaw Grants Root Access—CISA Sets 3-Day Deadline]]></title>
            <description><![CDATA[Critical CVE-2026-48172 in LiteSpeed cPanel plugin enables root privilege escalation. CVSS 10.0, actively exploited, CISA KEV deadline May 29. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/litespeed-cpanel-cve-2026-48172-root-privilege-escalation-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/litespeed-cpanel-cve-2026-48172-root-privilege-escalation-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-48172]]></category>
            <category><![CDATA[LiteSpeed]]></category>
            <category><![CDATA[cPanel]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[web hosting]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 27 May 2026 12:05:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Varonis Atlas Monitors Claude AI With New Compliance API]]></title>
            <description><![CDATA[Varonis joins 27 other security vendors integrating Anthropic's Claude Compliance API, enabling enterprises to monitor AI conversations, detect data leaks, and enforce governance policies in real time.]]></description>
            <link>https://www.probablypwned.com/article/varonis-atlas-claude-compliance-api-ai-governance-monitoring</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/varonis-atlas-claude-compliance-api-ai-governance-monitoring</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Claude AI]]></category>
            <category><![CDATA[AI governance]]></category>
            <category><![CDATA[Varonis]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 26 May 2026 15:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Payload Ransomware Hits Windows and ESXi With Babuk-Style Encryption]]></title>
            <description><![CDATA[New ransomware group Payload uses Babuk-derived code to target Windows and VMware ESXi systems. 12 victims across 7 countries within hours of launching leak site.]]></description>
            <link>https://www.probablypwned.com/article/payload-ransomware-babuk-style-windows-esxi-double-extortion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/payload-ransomware-babuk-style-windows-esxi-double-extortion</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Payload]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Babuk]]></category>
            <category><![CDATA[ESXi]]></category>
            <category><![CDATA[double extortion]]></category>
            <category><![CDATA[VMware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 26 May 2026 12:06:49 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lazarus Deploys Memory-Only RAT Against Crypto Firms, Stealing $577M]]></title>
            <description><![CDATA[North Korea's Lazarus Group uses RemotePE, a fileless RAT that executes entirely in RAM, to target DeFi platforms. The group has stolen $577M in crypto this year alone.]]></description>
            <link>https://www.probablypwned.com/article/lazarus-remotepe-memory-only-rat-crypto-defi-577m</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lazarus-remotepe-memory-only-rat-crypto-defi-577m</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Lazarus]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[RemotePE]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[fileless malware]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 26 May 2026 12:06:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[7-Zip NTFS Handler Flaw Enables Code Execution via Crafted Archives]]></title>
            <description><![CDATA[CVE-2026-48095 in 7-Zip allows attackers to execute arbitrary code through malicious NTFS images. CVSS 8.8 - update to v26.01 immediately.]]></description>
            <link>https://www.probablypwned.com/article/7-zip-cve-2026-48095-ntfs-heap-buffer-overflow-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/7-zip-cve-2026-48095-ntfs-heap-buffer-overflow-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[7-Zip]]></category>
            <category><![CDATA[CVE-2026-48095]]></category>
            <category><![CDATA[heap overflow]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[file compression]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 26 May 2026 12:05:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Anthropic's Mythos Toggle Appears in Claude Code—Then Vanishes]]></title>
            <description><![CDATA[A toggle for claude-mythos-1-preview briefly surfaced in Claude Code before removal. The restricted model found 10,000+ zero-days in its first month through Project Glasswing.]]></description>
            <link>https://www.probablypwned.com/article/claude-mythos-claude-code-10000-zero-days-glasswing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/claude-mythos-claude-code-10000-zero-days-glasswing</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[Claude Mythos]]></category>
            <category><![CDATA[Project Glasswing]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[vulnerability discovery]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 25 May 2026 18:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Charter Communications Breach: ShinyHunters Claims 42M Records]]></title>
            <description><![CDATA[ShinyHunters threatens to leak 42 million Charter Communications customer records by May 27. The telecom giant confirms incident but disputes data sensitivity claims.]]></description>
            <link>https://www.probablypwned.com/article/charter-communications-shinyhunters-42-million-records-spectrum</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/charter-communications-shinyhunters-42-million-records-spectrum</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Charter Communications]]></category>
            <category><![CDATA[Spectrum]]></category>
            <category><![CDATA[Salesforce]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 25 May 2026 12:07:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Operation Saffron Dismantles VPN Used by 25 Ransomware Gangs]]></title>
            <description><![CDATA[International law enforcement seizes 33 servers and shuts down First VPN, a criminal service used by at least 25 ransomware groups since 2014. 15 nations participated.]]></description>
            <link>https://www.probablypwned.com/article/operation-saffron-first-vpn-takedown-25-ransomware-gangs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-saffron-first-vpn-takedown-25-ransomware-gangs</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[VPN takedown]]></category>
            <category><![CDATA[Operation Saffron]]></category>
            <category><![CDATA[Europol]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 25 May 2026 12:06:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TrapDoor Hits npm, PyPI, Crates.io—34 Packages Target AI Devs]]></title>
            <description><![CDATA[Supply chain attack deploys 34 malicious packages across npm, PyPI, and Crates.io to steal crypto wallets, SSH keys, and developer credentials. AI assistants weaponized.]]></description>
            <link>https://www.probablypwned.com/article/trapdoor-supply-chain-npm-pypi-crates-crypto-ai-developers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trapdoor-supply-chain-npm-pypi-crates-crypto-ai-developers</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[npm malware]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 25 May 2026 12:06:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[700 Sites Hijacked as Ghost CMS SQLi Fuels ClickFix Attacks]]></title>
            <description><![CDATA[Attackers exploit CVE-2026-26980 to steal admin API keys and inject malicious scripts across 700+ Ghost CMS sites, including Harvard and Oxford. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/ghost-cms-cve-2026-26980-sqli-clickfix-700-sites</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghost-cms-cve-2026-26980-sqli-clickfix-700-sites</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-26980]]></category>
            <category><![CDATA[Ghost CMS]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 24 May 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Warns Kali365 PhaaS Steals Microsoft 365 Tokens at Scale]]></title>
            <description><![CDATA[New phishing-as-a-service platform bypasses MFA via OAuth device code flow. FBI PSA details how Kali365's AI-generated lures and $250/month pricing are enabling widespread credential theft.]]></description>
            <link>https://www.probablypwned.com/article/fbi-kali365-phaas-microsoft-365-oauth-token-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-kali365-phaas-microsoft-365-oauth-token-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Kali365]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[FBI]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 24 May 2026 12:07:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Trend Micro Apex One Zero-Day Added to CISA KEV]]></title>
            <description><![CDATA[CVE-2026-34926 lets attackers inject malicious code into Apex One servers and deploy it to all connected endpoint agents. CISA confirms active exploitation with June 4 federal deadline.]]></description>
            <link>https://www.probablypwned.com/article/trend-micro-apex-one-cve-2026-34926-zero-day-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trend-micro-apex-one-cve-2026-34926-zero-day-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-34926]]></category>
            <category><![CDATA[Trend Micro]]></category>
            <category><![CDATA[Apex One]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[endpoint security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 24 May 2026 12:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Exploits Langflow Flaw for Initial Access]]></title>
            <description><![CDATA[CISA adds CVE-2025-34291 to KEV after Iranian APT MuddyWater weaponizes the CORS/CSRF chain for account takeover and RCE. CVSS 9.4 flaw requires only a malicious link click.]]></description>
            <link>https://www.probablypwned.com/article/langflow-cve-2025-34291-muddywater-account-takeover-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langflow-cve-2025-34291-muddywater-account-takeover-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-34291]]></category>
            <category><![CDATA[Langflow]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 24 May 2026 12:06:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Drupal SQL Injection Now Under Active Attack — 15K Exploits in 48 Hours]]></title>
            <description><![CDATA[CVE-2026-9082 exploitation began within hours of patch release. Imperva tracked 15,000+ attacks against PostgreSQL-backed Drupal sites across 65 countries in the first two days.]]></description>
            <link>https://www.probablypwned.com/article/drupal-cve-2026-9082-sql-injection-active-exploitation-postgresql</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/drupal-cve-2026-9082-sql-injection-active-exploitation-postgresql</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-9082]]></category>
            <category><![CDATA[Drupal]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[PostgreSQL]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 24 May 2026 12:05:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Megalodon Attack Backdoors 5,561 GitHub Repos in Six Hours]]></title>
            <description><![CDATA[Automated Megalodon campaign pushed 5,718 malicious commits to GitHub repos on May 18, injecting CI/CD workflows that exfiltrate cloud credentials, SSH keys, and secrets. SafeDep links it to TeamPCP.]]></description>
            <link>https://www.probablypwned.com/article/megalodon-github-cicd-attack-5561-repos-backdoored-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/megalodon-github-cicd-attack-5561-repos-backdoored-credentials</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[CI/CD]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Megalodon]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 23 May 2026 12:05:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Laravel-Lang Supply Chain Attack Deploys Credential Stealer]]></title>
            <description><![CDATA[Attackers compromised 700+ versions of Laravel-Lang PHP packages via tag poisoning, deploying a sophisticated stealer targeting cloud credentials, crypto wallets, and browser data. Packagist pulled affected versions.]]></description>
            <link>https://www.probablypwned.com/article/laravel-lang-php-supply-chain-attack-credential-stealer-composer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/laravel-lang-php-supply-chain-attack-credential-stealer-composer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Laravel]]></category>
            <category><![CDATA[PHP]]></category>
            <category><![CDATA[Composer]]></category>
            <category><![CDATA[credential stealer]]></category>
            <category><![CDATA[Packagist]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 23 May 2026 12:04:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apache HTTP/2 Double-Free Enables DoS and RCE]]></title>
            <description><![CDATA[CVE-2026-23918 in Apache HTTP Server 2.4.66 lets attackers crash workers trivially or achieve remote code execution through a double-free in mod_http2. Upgrade to 2.4.67 immediately.]]></description>
            <link>https://www.probablypwned.com/article/apache-http2-cve-2026-23918-double-free-rce-dos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apache-http2-cve-2026-23918-double-free-rce-dos</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache]]></category>
            <category><![CDATA[HTTP/2]]></category>
            <category><![CDATA[CVE-2026-23918]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[DoS]]></category>
            <category><![CDATA[double-free]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 23 May 2026 12:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ubiquiti Patches Three CVSS 10.0 Flaws in UniFi OS]]></title>
            <description><![CDATA[Ubiquiti releases emergency patches for three maximum-severity vulnerabilities in UniFi OS that allow unauthenticated remote attackers to take full control of network appliances. 100,000 devices exposed.]]></description>
            <link>https://www.probablypwned.com/article/ubiquiti-unifi-os-cve-2026-34908-34909-34910-maximum-severity</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ubiquiti-unifi-os-cve-2026-34908-34909-34910-maximum-severity</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ubiquiti]]></category>
            <category><![CDATA[UniFi]]></category>
            <category><![CDATA[CVE-2026-34908]]></category>
            <category><![CDATA[CVE-2026-34909]]></category>
            <category><![CDATA[CVE-2026-34910]]></category>
            <category><![CDATA[network security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 23 May 2026 12:03:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[KimWolf Botnet Operator Arrested After 30 Tbps DDoS Attacks]]></title>
            <description><![CDATA[Canadian authorities arrest 23-year-old Jacob Butler for operating the KimWolf IoT botnet. The DDoS-for-hire operation enslaved nearly 2 million devices and set volumetric attack records.]]></description>
            <link>https://www.probablypwned.com/article/kimwolf-ddos-botnet-operator-arrest-canada-30tbps</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kimwolf-ddos-botnet-operator-arrest-canada-30tbps</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[KimWolf]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[arrest]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 22 May 2026 12:14:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese APT Calypso Deploys Showboat and JFMBackdoor Against Telecoms]]></title>
            <description><![CDATA[China-linked Calypso group targets telecoms across Middle East and Asia Pacific with new Linux and Windows malware. Showboat provides SOCKS5 proxy access; JFMBackdoor enables full system control.]]></description>
            <link>https://www.probablypwned.com/article/calypso-apt-showboat-jfmbackdoor-telecom-china-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/calypso-apt-showboat-jfmbackdoor-telecom-china-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Calypso]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Showboat]]></category>
            <category><![CDATA[JFMBackdoor]]></category>
            <category><![CDATA[telecom]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 22 May 2026 12:11:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Leaked Shai-Hulud Code Spawns npm Infostealer With DDoS Capabilities]]></title>
            <description><![CDATA[Leaked Shai-Hulud malware source code fuels new npm supply chain attack. Four malicious packages steal credentials and deploy DDoS bot with TCP/UDP flood capabilities.]]></description>
            <link>https://www.probablypwned.com/article/shai-hulud-npm-malware-copycat-ddos-infostealer-deadcode</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shai-hulud-npm-malware-copycat-ddos-infostealer-deadcode</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Shai-Hulud]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 22 May 2026 12:08:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Secure Workload CVSS 10 Flaw Grants Site Admin Access]]></title>
            <description><![CDATA[Cisco patches CVE-2026-20223, a maximum-severity REST API vulnerability in Secure Workload enabling unauthenticated attackers to gain Site Admin privileges across tenants.]]></description>
            <link>https://www.probablypwned.com/article/cisco-secure-workload-cve-2026-20223-cvss-10-site-admin</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-secure-workload-cve-2026-20223-cvss-10-site-admin</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20223]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[REST API]]></category>
            <category><![CDATA[Secure Workload]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 22 May 2026 12:05:49 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Leaks Details of Unfixed Chromium Flaw After 29 Months]]></title>
            <description><![CDATA[A Chromium bug reported in 2022 that turns browsers into silent botnets was accidentally exposed on Google's issue tracker. No patch exists despite 'fixed' status.]]></description>
            <link>https://www.probablypwned.com/article/google-chromium-service-worker-flaw-exposed-29-months-unfixed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-chromium-service-worker-flaw-exposed-29-months-unfixed</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Chromium]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[Service Worker]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 21 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Webworm APT Deploys Discord, MS Graph Backdoors Against Europe]]></title>
            <description><![CDATA[ESET exposes Webworm's EchoCreep and GraphWorm backdoors targeting European governments. The China-aligned APT uses Discord and OneDrive for C2, hitting Belgium, Italy, Poland, and Spain.]]></description>
            <link>https://www.probablypwned.com/article/webworm-apt-echocreep-graphworm-discord-microsoft-graph-europe</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/webworm-apt-echocreep-graphworm-discord-microsoft-graph-europe</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Webworm]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Discord]]></category>
            <category><![CDATA[Microsoft Graph]]></category>
            <category><![CDATA[European governments]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 21 May 2026 12:11:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA KEV Adds 7 Flaws Including Exploited Defender Bugs]]></title>
            <description><![CDATA[CISA's May 20 KEV update includes two actively exploited Microsoft Defender vulnerabilities and five legacy flaws from 2008-2010. Federal agencies have until June 3 to patch.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-microsoft-defender-cve-2026-41091-45498-legacy-flaws</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-microsoft-defender-cve-2026-41091-45498-legacy-flaws</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[Microsoft Defender]]></category>
            <category><![CDATA[CVE-2026-41091]]></category>
            <category><![CDATA[CVE-2026-45498]]></category>
            <category><![CDATA[federal mandate]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 21 May 2026 12:08:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[nginx-poolslip: New Zero-Day Bypasses ASLR for RCE, No Patch]]></title>
            <description><![CDATA[Security researchers disclose nginx-poolslip, an unpatched zero-day in NGINX 1.31.0 that defeats ASLR protection. Millions of servers at risk with no CVE or fix available yet.]]></description>
            <link>https://www.probablypwned.com/article/nginx-poolslip-zero-day-aslr-bypass-rce-no-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nginx-poolslip-zero-day-aslr-bypass-rce-no-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[NGINX]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[ASLR bypass]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[web server security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 21 May 2026 12:06:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Grafana Breach Traced to Single Missed Token After TanStack Attack]]></title>
            <description><![CDATA[Grafana Labs confirms hackers stole source code through a GitHub token that slipped through rotation after the TanStack supply chain compromise. The company refused to pay the ransom demand.]]></description>
            <link>https://www.probablypwned.com/article/grafana-breach-tanstack-token-rotation-cicd-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/grafana-breach-tanstack-token-rotation-cicd-security</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Grafana]]></category>
            <category><![CDATA[TanStack]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[token management]]></category>
            <category><![CDATA[CI/CD security]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 20 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DBIR 2026: Vulnerability Exploitation Now the Top Breach Cause]]></title>
            <description><![CDATA[Verizon's 2026 Data Breach Investigations Report reveals vulnerability exploitation surpassed credential theft as the leading breach vector for the first time in 19 years. Only 26% of KEV flaws get patched.]]></description>
            <link>https://www.probablypwned.com/article/verizon-dbir-2026-vulnerability-exploitation-breach-vector</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/verizon-dbir-2026-vulnerability-exploitation-breach-vector</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DBIR]]></category>
            <category><![CDATA[Verizon]]></category>
            <category><![CDATA[vulnerability management]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[breach statistics]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 20 May 2026 12:04:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Drupal Warns of Highly Critical Flaw — Patches Due Today]]></title>
            <description><![CDATA[Drupal releases patches for a highly critical vulnerability (severity 20/25) affecting all supported versions. Exploits may emerge within hours—administrators should update between 5-9pm UTC today.]]></description>
            <link>https://www.probablypwned.com/article/drupal-highly-critical-security-release-may-20-psa-2026-05-18</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/drupal-highly-critical-security-release-may-20-psa-2026-05-18</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Drupal]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <category><![CDATA[web security]]></category>
            <category><![CDATA[CMS]]></category>
            <category><![CDATA[patch management]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 20 May 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SEPPMail Gateway Flaws Enable Complete Mail System Takeover]]></title>
            <description><![CDATA[Seven vulnerabilities including CVE-2026-2743 (CVSS 10.0) allow unauthenticated attackers to compromise SEPPMail secure email gateways, read all traffic, and establish persistent access. Patch to 15.0.4 immediately.]]></description>
            <link>https://www.probablypwned.com/article/seppmail-critical-rce-cve-2026-2743-email-gateway-vulnerabilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/seppmail-critical-rce-cve-2026-2743-email-gateway-vulnerabilities</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SEPPMail]]></category>
            <category><![CDATA[CVE-2026-2743]]></category>
            <category><![CDATA[email security]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 20 May 2026 12:04:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Dismantles Fox Tempest Malware-Signing Operation]]></title>
            <description><![CDATA[Microsoft's Digital Crimes Unit seizes infrastructure behind Fox Tempest, a malware-signing service that helped Rhysida, Akira, and Qilin ransomware gangs disguise malicious code as legitimate software.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-fox-tempest-malware-signing-service-takedown-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-fox-tempest-malware-signing-service-takedown-ransomware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Fox Tempest]]></category>
            <category><![CDATA[malware signing]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[code signing abuse]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 20 May 2026 12:04:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft's Driver Quality Initiative Targets Crashes, Overheating]]></title>
            <description><![CDATA[Microsoft unveils four-pillar Driver Quality Initiative at WinHEC 2026, enforcing stricter power, thermal, and security standards for Windows 11 drivers starting this year.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-driver-quality-initiative-winhec-2026-kernel-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-driver-quality-initiative-winhec-2026-kernel-security</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Windows 11]]></category>
            <category><![CDATA[driver security]]></category>
            <category><![CDATA[WinHEC 2026]]></category>
            <category><![CDATA[WHCP]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 19 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Nx Console VS Code Extension Hijacked for 11 Minutes]]></title>
            <description><![CDATA[Attackers published malicious Nx Console 18.95.0 to VS Code Marketplace, stealing developer credentials via triple-channel exfiltration and Sigstore-signed npm package poisoning.]]></description>
            <link>https://www.probablypwned.com/article/nx-console-vscode-extension-compromise-credential-theft-sigstore</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nx-console-vscode-extension-compromise-credential-theft-sigstore</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Nx Console]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Sigstore]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 19 May 2026 12:07:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[REMUS Infostealer Evolves Into Session-Stealing MaaS Platform]]></title>
            <description><![CDATA[REMUS, a 64-bit Lumma Stealer successor, now offers session theft, EtherHiding blockchain C2, and full MaaS infrastructure targeting browser credentials and auth tokens.]]></description>
            <link>https://www.probablypwned.com/article/remus-infostealer-maas-lumma-successor-etherhiding-session-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/remus-infostealer-maas-lumma-successor-etherhiding-session-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[MaaS]]></category>
            <category><![CDATA[REMUS]]></category>
            <category><![CDATA[Lumma]]></category>
            <category><![CDATA[session theft]]></category>
            <category><![CDATA[EtherHiding]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 19 May 2026 12:06:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SHub Reaper Stealer Hijacks macOS via AppleScript URL Scheme]]></title>
            <description><![CDATA[SHub Reaper macOS infostealer bypasses Tahoe 26.4 defenses using applescript:// URLs, spoofs Apple, Google, and Microsoft to steal credentials and backdoor systems.]]></description>
            <link>https://www.probablypwned.com/article/shub-reaper-macos-stealer-applescript-apple-google-microsoft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shub-reaper-macos-stealer-applescript-apple-google-microsoft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[AppleScript]]></category>
            <category><![CDATA[SHub Reaper]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 19 May 2026 12:05:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Launches Daybreak — AI-Powered Vulnerability Detection for Defenders]]></title>
            <description><![CDATA[OpenAI's Daybreak initiative brings GPT-5.5 variants to defensive security. Partners include Cisco, CrowdStrike, and Fortinet. Red team model available for authorized testing.]]></description>
            <link>https://www.probablypwned.com/article/openai-daybreak-ai-vulnerability-detection-gpt-55-cyber-defenders</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-daybreak-ai-vulnerability-detection-gpt-55-cyber-defenders</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[Daybreak]]></category>
            <category><![CDATA[GPT-5.5]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[vulnerability detection]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 18 May 2026 12:06:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pwn2Own Berlin Finale: DEVCORE Wins Master of Pwn, 47 Zero-Days Fall]]></title>
            <description><![CDATA[DEVCORE claims Master of Pwn with $505K across three days. VMware ESXi and SharePoint exploits highlight Day 3 as Pwn2Own Berlin 2026 awards $1.29M total.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-berlin-2026-day-three-devcore-master-pwn-47-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-berlin-2026-day-three-devcore-master-pwn-47-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[DEVCORE]]></category>
            <category><![CDATA[VMware ESXi]]></category>
            <category><![CDATA[Microsoft SharePoint]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 18 May 2026 12:05:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MiniPlasma Zero-Day Grants SYSTEM on Patched Windows — PoC Released]]></title>
            <description><![CDATA[Chaotic Eclipse drops working exploit for Windows Cloud Filter driver flaw allegedly patched in 2020. Race condition in cldflt.sys spawns SYSTEM shell on Windows 11.]]></description>
            <link>https://www.probablypwned.com/article/miniplasma-windows-zero-day-cldflt-system-privileges-chaotic-eclipse</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/miniplasma-windows-zero-day-cldflt-system-privileges-chaotic-eclipse</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows zero-day]]></category>
            <category><![CDATA[MiniPlasma]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[cldflt.sys]]></category>
            <category><![CDATA[Chaotic Eclipse]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 18 May 2026 12:04:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Device Code Phishing Surges 40% — Hundreds Compromised Daily]]></title>
            <description><![CDATA[AI-enabled device code phishing campaigns hit hundreds of Microsoft 365 accounts daily since mid-March. Criminal toolkits proliferate as attacks bypass MFA at scale.]]></description>
            <link>https://www.probablypwned.com/article/device-code-phishing-surge-ai-automation-microsoft-365-daily-compromises</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/device-code-phishing-surge-ai-automation-microsoft-365-daily-compromises</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[device code phishing]]></category>
            <category><![CDATA[OAuth abuse]]></category>
            <category><![CDATA[AI-enabled attacks]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[phishing-as-a-service]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 17 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[The Gentlemen Ransomware Gang Gets a Taste of Its Own Medicine]]></title>
            <description><![CDATA[Internal database of #2 ransomware group leaked after 4VPS hosting breach exposes chat logs, affiliate rosters, and operational playbooks from 400+ attacks.]]></description>
            <link>https://www.probablypwned.com/article/gentlemen-ransomware-gang-hacked-internal-backend-leak-4vps</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gentlemen-ransomware-gang-hacked-internal-backend-leak-4vps</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[The Gentlemen]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <category><![CDATA[data leak]]></category>
            <category><![CDATA[RaaS]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 17 May 2026 12:07:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WooCommerce Stores Under Attack via Funnel Builder Flaw]]></title>
            <description><![CDATA[Attackers exploit unauthenticated vulnerability in Funnel Builder plugin to inject payment skimmers on 40,000+ WordPress stores. Patch to 3.15.0.3 immediately.]]></description>
            <link>https://www.probablypwned.com/article/funnel-builder-wordpress-woocommerce-payment-skimmer-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/funnel-builder-wordpress-woocommerce-payment-skimmer-active-exploitation</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[WooCommerce]]></category>
            <category><![CDATA[payment skimmer]]></category>
            <category><![CDATA[Funnel Builder]]></category>
            <category><![CDATA[Magecart]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 17 May 2026 12:06:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ollama Flaw Leaks AI Server Memory to Attackers — 300K at Risk]]></title>
            <description><![CDATA[Critical CVE-2026-7482 vulnerability in Ollama's GGUF model loader lets remote attackers extract API keys, prompts, and conversation data from 300,000+ exposed servers.]]></description>
            <link>https://www.probablypwned.com/article/ollama-cve-2026-7482-bleeding-llama-memory-leak-gguf-300k-servers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ollama-cve-2026-7482-bleeding-llama-memory-leak-gguf-300k-servers</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ollama]]></category>
            <category><![CDATA[CVE-2026-7482]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[memory leak]]></category>
            <category><![CDATA[GGUF]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 17 May 2026 12:05:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Turla's Kazuar Backdoor Evolves Into Modular P2P Botnet]]></title>
            <description><![CDATA[Microsoft exposes how Russia's FSB-linked Secret Blizzard transformed Kazuar from a monolithic backdoor into a three-module P2P botnet with advanced anti-detection capabilities.]]></description>
            <link>https://www.probablypwned.com/article/turla-kazuar-backdoor-modular-p2p-botnet-fsb</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/turla-kazuar-backdoor-modular-p2p-botnet-fsb</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Turla]]></category>
            <category><![CDATA[Secret Blizzard]]></category>
            <category><![CDATA[Kazuar]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[FSB]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 16 May 2026 17:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenClaw 'Claw Chain' Flaws Let Attackers Steal Data and Plant Backdoors]]></title>
            <description><![CDATA[Cyera discloses four chainable OpenClaw vulnerabilities (CVE-2026-44112 through 44118) exposing 245,000 servers to credential theft, privilege escalation, and persistent access.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-claw-chain-four-cves-44112-44118-data-theft-persistence</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-claw-chain-four-cves-44112-44118-data-theft-persistence</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[CVE-2026-44112]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 16 May 2026 12:06:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pwn2Own Berlin Day 2: Exchange RCE Chain Earns $200K, 15 Zero-Days Fall]]></title>
            <description><![CDATA[Day two of Pwn2Own Berlin 2026 yields 15 new zero-days worth $385,750. Orange Tsai chains three bugs for SYSTEM-level Exchange RCE, earning the event's largest payout.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-berlin-2026-day-two-exchange-rce-385k-15-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-berlin-2026-day-two-exchange-rce-385k-15-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Microsoft Exchange]]></category>
            <category><![CDATA[Windows 11]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 16 May 2026 12:05:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Exchange Server Zero-Day CVE-2026-42897 Exploited via Crafted Emails]]></title>
            <description><![CDATA[Microsoft confirms active exploitation of CVE-2026-42897, an XSS flaw in Exchange OWA that executes JavaScript via malicious emails. No patch available yet.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-exchange-cve-2026-42897-zero-day-xss-owa-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-exchange-cve-2026-42897-zero-day-xss-owa-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft Exchange]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-42897]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[OWA]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 16 May 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome 148 Patches 79 Vulnerabilities Including 14 Critical Flaws]]></title>
            <description><![CDATA[Google's May 2026 Chrome update addresses 79 security issues with 14 rated critical. Memory corruption bugs dominate—update immediately to version 148.0.7778.167.]]></description>
            <link>https://www.probablypwned.com/article/chrome-148-security-update-79-vulnerabilities-14-critical</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-148-security-update-79-vulnerabilities-14-critical</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[use-after-free]]></category>
            <category><![CDATA[memory corruption]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 15 May 2026 12:06:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[node-ipc Hijacked via Expired Domain, Steals 90+ Credential Types]]></title>
            <description><![CDATA[Attackers seized control of node-ipc by re-registering the maintainer's expired email domain. Three malicious versions now harvest AWS, GCP, Azure keys and more.]]></description>
            <link>https://www.probablypwned.com/article/node-ipc-npm-supply-chain-attack-credential-stealer-10-million-downloads</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/node-ipc-npm-supply-chain-attack-credential-stealer-10-million-downloads</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[node-ipc]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[JavaScript]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 15 May 2026 12:06:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Linux Fragnesia Flaw Gives Any Local User Root Access Without Racing]]></title>
            <description><![CDATA[CVE-2026-46300 exploits a logic bug in the XFRM ESP-in-TCP subsystem to corrupt page cache and gain root. Kernel patches rolling out now—mitigation available.]]></description>
            <link>https://www.probablypwned.com/article/linux-fragnesia-cve-2026-46300-kernel-privilege-escalation-root</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/linux-fragnesia-cve-2026-46300-kernel-privilege-escalation-root</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[CVE-2026-46300]]></category>
            <category><![CDATA[kernel]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Fragnesia]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 15 May 2026 12:05:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NGINX Rift: 18-Year-Old Heap Overflow Enables RCE on Web Servers]]></title>
            <description><![CDATA[CVE-2026-42945 is a critical heap buffer overflow in NGINX's rewrite module that went undetected since 2008. CVSS 9.2 with public PoC available—patch now.]]></description>
            <link>https://www.probablypwned.com/article/nginx-rift-cve-2026-42945-18-year-old-heap-buffer-overflow-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nginx-rift-cve-2026-42945-18-year-old-heap-buffer-overflow-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[NGINX]]></category>
            <category><![CDATA[CVE-2026-42945]]></category>
            <category><![CDATA[heap buffer overflow]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[web server]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 15 May 2026 12:04:53 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Auth Bypass Hits CVSS 10.0, CISA Sets May 17 Deadline]]></title>
            <description><![CDATA[CVE-2026-20182 allows unauthenticated attackers to gain admin access to Cisco Catalyst SD-WAN controllers. CISA added it to the KEV catalog after confirmed exploitation.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20182-authentication-bypass-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20182-authentication-bypass-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20182]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 15 May 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[24 Zero-Days Fall on Day One of Pwn2Own Berlin 2026]]></title>
            <description><![CDATA[Security researchers exploited Windows 11, Microsoft Edge, Red Hat Linux, and multiple AI platforms on the first day of Pwn2Own Berlin 2026, earning $523,000 for 24 unique zero-day vulnerabilities.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-berlin-2026-windows-11-edge-24-zero-days-day-one</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-berlin-2026-windows-11-edge-24-zero-days-day-one</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Windows 11]]></category>
            <category><![CDATA[Microsoft Edge]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 14 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft's MDASH AI System Found 16 Windows Flaws Before Attackers Did]]></title>
            <description><![CDATA[Microsoft unveiled MDASH, a multi-agent AI system that discovered 16 Windows vulnerabilities including 4 critical RCEs in networking and auth stacks. Now available in limited preview.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-mdash-ai-vulnerability-discovery-100-agents-16-windows-flaws</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-mdash-ai-vulnerability-discovery-100-agents-16-windows-flaws</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[vulnerability discovery]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[MDASH]]></category>
            <category><![CDATA[automated security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 14 May 2026 12:07:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RubyGems Halts New Signups After 500+ Malicious Packages Flood Registry]]></title>
            <description><![CDATA[RubyGems suspended new account registration after attackers uploaded over 500 malicious packages in a coordinated spam attack targeting the Ruby package ecosystem.]]></description>
            <link>https://www.probablypwned.com/article/rubygems-suspends-signups-500-malicious-packages-gemstuffer-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/rubygems-suspends-signups-500-malicious-packages-gemstuffer-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[RubyGems]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[package managers]]></category>
            <category><![CDATA[GemStuffer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 14 May 2026 12:06:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SAP Patches CVSS 9.6 SQL Injection and RCE Flaws in S/4HANA, Commerce]]></title>
            <description><![CDATA[SAP's May 2026 security update addresses 15 vulnerabilities, including CVE-2026-34260 SQL injection in S/4HANA and CVE-2026-34263 unauthenticated RCE in Commerce Cloud.]]></description>
            <link>https://www.probablypwned.com/article/sap-s4hana-commerce-cloud-cve-2026-34260-34263-sql-injection-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sap-s4hana-commerce-cloud-cve-2026-34260-34263-sql-injection-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SAP]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[CVE-2026-34260]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 14 May 2026 12:05:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Researcher Drops YellowKey BitLocker Bypass, GreenPlasma SYSTEM Exploit]]></title>
            <description><![CDATA[A disgruntled researcher released two unpatched Windows zero-days: YellowKey bypasses BitLocker encryption via USB, while GreenPlasma grants SYSTEM privileges. No patches available yet.]]></description>
            <link>https://www.probablypwned.com/article/yellowkey-greenplasma-microsoft-zero-days-bitlocker-bypass-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/yellowkey-greenplasma-microsoft-zero-days-bitlocker-bypass-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[BitLocker]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 14 May 2026 12:04:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Foxconn Confirms Ransomware Attack on US Factories After 8TB Theft Claim]]></title>
            <description><![CDATA[Nitrogen ransomware gang claims 8TB of data including Apple, Nvidia, and Intel files from Foxconn's Wisconsin and Texas facilities. Fourth major ransomware incident for the electronics giant.]]></description>
            <link>https://www.probablypwned.com/article/foxconn-nitrogen-ransomware-8tb-apple-nvidia-intel-north-america</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/foxconn-nitrogen-ransomware-8tb-apple-nvidia-intel-north-america</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Ransomware]]></category>
            <category><![CDATA[Foxconn]]></category>
            <category><![CDATA[Nitrogen]]></category>
            <category><![CDATA[Supply Chain]]></category>
            <category><![CDATA[Manufacturing]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 13 May 2026 18:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[xlabs_v1 Botnet Hijacks Android TVs via ADB for DDoS Attacks]]></title>
            <description><![CDATA[Hunt.io uncovers xlabs_v1, a Mirai-based botnet exploiting Android Debug Bridge on port 5555 to conscript IoT devices into a DDoS-for-hire service targeting game servers.]]></description>
            <link>https://www.probablypwned.com/article/xlabs-v1-mirai-botnet-adb-iot-ddos-for-hire</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/xlabs-v1-mirai-botnet-adb-iot-ddos-for-hire</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Botnet]]></category>
            <category><![CDATA[Mirai]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Android]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 13 May 2026 12:06:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware Hits West Pharmaceutical, Disrupts Global Operations]]></title>
            <description><![CDATA[Pharma supplier West Pharmaceutical Services discloses ransomware attack in SEC filing. Attackers exfiltrated data before encrypting systems. Unit 42 investigating.]]></description>
            <link>https://www.probablypwned.com/article/west-pharmaceutical-ransomware-unit42-global-operations-disrupted</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/west-pharmaceutical-ransomware-unit42-global-operations-disrupted</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Ransomware]]></category>
            <category><![CDATA[Healthcare]]></category>
            <category><![CDATA[West Pharmaceutical]]></category>
            <category><![CDATA[Unit 42]]></category>
            <category><![CDATA[Data Breach]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 13 May 2026 12:05:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Exim 'Dead.Letter' Flaw Enables Unauthenticated RCE on Mail Servers]]></title>
            <description><![CDATA[CVE-2026-45185 is a critical use-after-free vulnerability in Exim mail servers using GnuTLS. XBOW researchers call it one of the highest-caliber bugs found in Exim.]]></description>
            <link>https://www.probablypwned.com/article/exim-cve-2026-45185-dead-letter-critical-rce-gnutls</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/exim-cve-2026-45185-dead-letter-critical-rce-gnutls</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Exim]]></category>
            <category><![CDATA[CVE-2026-45185]]></category>
            <category><![CDATA[Mail Server]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[GnuTLS]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 13 May 2026 12:05:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Fixes 120 Flaws in May Patch Tuesday, 17 Critical]]></title>
            <description><![CDATA[Microsoft's May 2026 Patch Tuesday addresses 120 vulnerabilities including 17 critical RCE flaws. No zero-days, but Word preview pane attacks and Netlogon bugs demand immediate attention.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-patch-tuesday-may-2026-120-flaws-17-critical-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-patch-tuesday-may-2026-120-flaws-17-critical-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Office]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 13 May 2026 12:04:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet Patches Critical RCE in FortiSandbox, FortiAuthenticator]]></title>
            <description><![CDATA[Fortinet discloses CVE-2026-44277 and CVE-2026-26083, unauthenticated RCE flaws affecting FortiSandbox and FortiAuthenticator. Patch now before attackers weaponize these.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-fortisandbox-fortiauthoricator-cve-2026-44277-26083-critical-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-fortisandbox-fortiauthoricator-cve-2026-44277-26083-critical-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiSandbox]]></category>
            <category><![CDATA[FortiAuthenticator]]></category>
            <category><![CDATA[CVE-2026-44277]]></category>
            <category><![CDATA[CVE-2026-26083]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 12 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Zara Breach Exposes 197K Customers via Third-Party Analytics Provider]]></title>
            <description><![CDATA[ShinyHunters leaked 140GB of Zara customer data stolen through compromised Anodot authentication tokens. The breach exposed email addresses, order history, and support tickets from Snowflake and BigQuery integrations.]]></description>
            <link>https://www.probablypwned.com/article/zara-inditex-data-breach-197000-customers-shinyhunters-anodot</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zara-inditex-data-breach-197000-customers-shinyhunters-anodot</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Zara]]></category>
            <category><![CDATA[Inditex]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Anodot]]></category>
            <category><![CDATA[Snowflake]]></category>
            <category><![CDATA[third-party risk]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 12 May 2026 12:09:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cline AI Agent Flaw Let Any Website Execute Code on Developer Machines]]></title>
            <description><![CDATA[CVE-2026-44211 (CVSS 9.7) allowed malicious websites to hijack Cline's Kanban WebSocket server, exfiltrate workspace data, and execute arbitrary commands through the AI agent. Patched in v0.1.66.]]></description>
            <link>https://www.probablypwned.com/article/cline-kanban-cve-2026-44211-websocket-hijacking-ai-agent-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cline-kanban-cve-2026-44211-websocket-hijacking-ai-agent-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cline]]></category>
            <category><![CDATA[AI agent]]></category>
            <category><![CDATA[WebSocket]]></category>
            <category><![CDATA[CVE-2026-44211]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[developer tools]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 12 May 2026 12:08:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GhostLock Locks 500K Files in 3 Minutes Without Encryption]]></title>
            <description><![CDATA[A new proof-of-concept tool abuses Windows CreateFileW API to block file access across SMB shares. The technique evades all tested EDR products and requires no elevated privileges.]]></description>
            <link>https://www.probablypwned.com/article/ghostlock-windows-api-file-locking-ransomware-evasion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghostlock-windows-api-file-locking-ransomware-evasion</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[GhostLock]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[SMB]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[EDR evasion]]></category>
            <category><![CDATA[proof of concept]]></category>
            <category><![CDATA[file locking]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 12 May 2026 12:07:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551808525-51a94da548ce?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TrickMo Banking Trojan Moves C2 to Telegram's TON Blockchain]]></title>
            <description><![CDATA[A new TrickMo variant routes Android trojan traffic through The Open Network, making domain takedowns ineffective. The malware adds SSH tunneling and SOCKS5 proxy capabilities for network pivoting.]]></description>
            <link>https://www.probablypwned.com/article/trickmo-android-banking-trojan-ton-blockchain-c2-france-italy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trickmo-android-banking-trojan-ton-blockchain-c2-france-italy</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TrickMo]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[TON]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[France]]></category>
            <category><![CDATA[Italy]]></category>
            <category><![CDATA[Austria]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 12 May 2026 12:06:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TanStack npm Packages Backdoored in 6-Minute Supply Chain Blitz]]></title>
            <description><![CDATA[TeamPCP compromised 84 versions across 42 TanStack packages on May 11 using GitHub Actions cache poisoning. The malware steals CI/CD credentials and includes a wiper that triggers on token revocation.]]></description>
            <link>https://www.probablypwned.com/article/tanstack-npm-supply-chain-cve-2026-45321-mini-shai-hulud-84-packages</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tanstack-npm-supply-chain-cve-2026-45321-mini-shai-hulud-84-packages</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TanStack]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[Mini Shai-Hulud]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <category><![CDATA[CVE-2026-45321]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 12 May 2026 12:05:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Catches First AI-Generated Zero-Day Exploit in the Wild]]></title>
            <description><![CDATA[Google's Threat Intelligence Group identifies a criminal group using an LLM-generated exploit to bypass 2FA in a web admin tool—marking the first confirmed AI-built zero-day in active use.]]></description>
            <link>https://www.probablypwned.com/article/google-gtig-ai-generated-zero-day-exploit-2fa-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-gtig-ai-generated-zero-day-exploit-2fa-bypass</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[exploit development]]></category>
            <category><![CDATA[threat actors]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 11 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LiteLLM SQL Injection Exploited 36 Hours After Disclosure—CISA Issues Deadline]]></title>
            <description><![CDATA[CVE-2026-42208, a CVSS 9.3 pre-auth SQL injection in the LiteLLM LLM gateway, was weaponized within 36 hours of disclosure. CISA added it to KEV with a May 11 federal deadline.]]></description>
            <link>https://www.probablypwned.com/article/litellm-cve-2026-42208-sql-injection-36-hours-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/litellm-cve-2026-42208-sql-injection-36-hours-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[cve]]></category>
            <category><![CDATA[sql-injection]]></category>
            <category><![CDATA[llm]]></category>
            <category><![CDATA[cisa-kev]]></category>
            <category><![CDATA[ai-security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 11 May 2026 12:18:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Two Americans Get 18 Months for Running North Korean Laptop Farms]]></title>
            <description><![CDATA[Matthew Knoot and Erick Prince sentenced for operating laptop farms that helped North Korean IT workers infiltrate 70 US companies, generating over $1.2 million for Pyongyang.]]></description>
            <link>https://www.probablypwned.com/article/north-korean-laptop-farms-americans-sentenced-18-months</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korean-laptop-farms-americans-sentenced-18-months</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[north-korea]]></category>
            <category><![CDATA[insider-threat]]></category>
            <category><![CDATA[fraud]]></category>
            <category><![CDATA[doj]]></category>
            <category><![CDATA[sanctions]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 11 May 2026 12:15:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Operation HookedWing: 4-Year Phishing Campaign Hit 500+ Organizations]]></title>
            <description><![CDATA[SOCRadar documents a persistent phishing operation that stole 2,000+ credentials from aviation, energy, and government sectors over four years using GitHub-hosted infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/operation-hookedwing-phishing-500-organizations-4-years</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-hookedwing-phishing-500-organizations-4-years</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[credential-theft]]></category>
            <category><![CDATA[github]]></category>
            <category><![CDATA[apt]]></category>
            <category><![CDATA[aviation]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 11 May 2026 12:12:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious NuGet Packages Impersonate Chinese UI Libraries, Steal Credentials]]></title>
            <description><![CDATA[Five NuGet packages typosquatting popular Chinese .NET libraries have racked up 65,000 downloads while stealing browser credentials, crypto wallets, and SSH keys from developer machines.]]></description>
            <link>https://www.probablypwned.com/article/nuget-typosquat-chinese-ui-libraries-65000-downloads-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nuget-typosquat-chinese-ui-libraries-65000-downloads-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[nuget]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[typosquatting]]></category>
            <category><![CDATA[dotnet]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 11 May 2026 12:08:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Weaponize Claude.ai Shared Chats to Push Mac Malware]]></title>
            <description><![CDATA[Malvertising campaign abuses Google Ads and Claude.ai shared chats to deliver MacSync infostealer. Victims searching for Claude downloads get tricked into running malicious terminal commands.]]></description>
            <link>https://www.probablypwned.com/article/claude-ai-malvertising-google-ads-macsync-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/claude-ai-malvertising-google-ads-macsync-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[malvertising]]></category>
            <category><![CDATA[macos]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[claude]]></category>
            <category><![CDATA[google-ads]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 11 May 2026 12:05:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[JDownloader Website Hacked—Malicious Installers Served for 24 Hours]]></title>
            <description><![CDATA[Attackers exploited a CMS flaw on JDownloader's website to swap download links with trojanized installers. Windows users got a Python RAT; Linux users got root-persisted ELF binaries.]]></description>
            <link>https://www.probablypwned.com/article/jdownloader-supply-chain-attack-python-rat-windows-linux</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/jdownloader-supply-chain-attack-python-rat-windows-linux</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[JDownloader]]></category>
            <category><![CDATA[Python RAT]]></category>
            <category><![CDATA[CMS vulnerability]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 10 May 2026 15:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NVIDIA Confirms GeForce NOW Partner Breach Affecting Armenian Users]]></title>
            <description><![CDATA[Armenian GeForce NOW operator GFN.AM suffered a data breach exposing user emails, names, and phone numbers. NVIDIA clarifies its own infrastructure wasn't compromised. ShinyHunters claims credit.]]></description>
            <link>https://www.probablypwned.com/article/nvidia-geforce-now-gfn-am-breach-armenian-users-shinyhunters</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nvidia-geforce-now-gfn-am-breach-armenian-users-shinyhunters</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[NVIDIA]]></category>
            <category><![CDATA[GeForce NOW]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[GFN.AM]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[cloud gaming]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 10 May 2026 12:06:49 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[cPanel Ships Second Emergency Patch in 10 Days: Three New CVEs]]></title>
            <description><![CDATA[cPanel releases emergency fixes for CVE-2026-29201, 29202, and 29203—including file read, code execution, and privilege escalation flaws. Comes days after 44,000 servers were hit by ransomware.]]></description>
            <link>https://www.probablypwned.com/article/cpanel-three-cves-29201-29202-29203-second-emergency-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cpanel-three-cves-29201-29202-29203-second-emergency-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[cPanel]]></category>
            <category><![CDATA[CVE-2026-29201]]></category>
            <category><![CDATA[CVE-2026-29202]]></category>
            <category><![CDATA[CVE-2026-29203]]></category>
            <category><![CDATA[web hosting]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 10 May 2026 12:06:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AzuraCast Patches Two High-Severity Flaws: RCE and Account Takeover]]></title>
            <description><![CDATA[Two vulnerabilities in AzuraCast radio automation software enable authenticated RCE via path traversal and unauthenticated account takeover through password reset poisoning. Upgrade to 0.23.6 now.]]></description>
            <link>https://www.probablypwned.com/article/azuracast-cve-2026-42605-42606-rce-account-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/azuracast-cve-2026-42605-42606-rce-account-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AzuraCast]]></category>
            <category><![CDATA[CVE-2026-42605]]></category>
            <category><![CDATA[CVE-2026-42606]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[account takeover]]></category>
            <category><![CDATA[path traversal]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 10 May 2026 12:05:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Talos Exposes UAT-8302: China APT Armed With Shared Malware]]></title>
            <description><![CDATA[China-nexus APT group UAT-8302 targets South American and European governments using NetDraft, CloudSorcerer, and VShell backdoors. Cisco Talos reveals connections to multiple Chinese threat clusters.]]></description>
            <link>https://www.probablypwned.com/article/uat-8302-china-apt-netdraft-cloudsorcerer-government-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-8302-china-apt-netdraft-cloudsorcerer-government-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UAT-8302]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[NetDraft]]></category>
            <category><![CDATA[CloudSorcerer]]></category>
            <category><![CDATA[government espionage]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 10 May 2026 12:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PCPJack Worm Kicks Out Rivals, Steals Cloud Credentials at Scale]]></title>
            <description><![CDATA[SentinelLABS uncovers PCPJack, a credential-stealing worm that removes TeamPCP infections before harvesting API keys from Docker, Kubernetes, and cloud services. Five CVEs enable worm-like spread.]]></description>
            <link>https://www.probablypwned.com/article/pcpjack-worm-teampcp-rival-credential-theft-cloud-infrastructure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pcpjack-worm-teampcp-rival-credential-theft-cloud-infrastructure</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PCPJack]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[worm]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[Kubernetes]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 10 May 2026 12:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Rust Stealer Hidden in Fake OpenAI Model Tops Hugging Face]]></title>
            <description><![CDATA[A typosquatted OpenAI repository on Hugging Face delivered Rust-based infostealer malware to Windows users, racking up 244K downloads before removal.]]></description>
            <link>https://www.probablypwned.com/article/rust-stealer-fake-openai-model-hugging-face-244k-downloads</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/rust-stealer-fake-openai-model-hugging-face-244k-downloads</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[hugging-face]]></category>
            <category><![CDATA[supply-chain-attack]]></category>
            <category><![CDATA[openai]]></category>
            <category><![CDATA[typosquatting]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 09 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Infostealer Campaign Abuses Bun Runtime to Evade Detection]]></title>
            <description><![CDATA[NWHStealer spreads via fake gaming mods and TradingView scripts, using Bun JavaScript runtime and XOR-encrypted C2 to bypass security tools.]]></description>
            <link>https://www.probablypwned.com/article/nwhstealer-bun-javascript-runtime-evasion-anti-vm-encrypted-c2</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nwhstealer-bun-javascript-runtime-evasion-anti-vm-encrypted-c2</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[NWHStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Bun]]></category>
            <category><![CDATA[malware evasion]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 09 May 2026 12:07:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches 3 Copilot Flaws That Leaked Sensitive Data]]></title>
            <description><![CDATA[CVE-2026-26129, CVE-2026-26164, and CVE-2026-33111 allowed information disclosure via injection attacks in Microsoft 365 Copilot. No admin action required.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-365-copilot-three-cves-information-disclosure-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-365-copilot-three-cves-information-disclosure-injection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Copilot]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[CVE-2026-26129]]></category>
            <category><![CDATA[information disclosure]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 09 May 2026 12:06:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[28 Fake 'Call History' Apps Scammed 7.3 Million Android Users]]></title>
            <description><![CDATA[ESET exposes CallPhantom campaign: fraudulent Google Play apps promised call records for any number, delivered hardcoded fake data after payment.]]></description>
            <link>https://www.probablypwned.com/article/callphantom-google-play-scam-apps-7-million-downloads-fake-call-history</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/callphantom-google-play-scam-apps-7-million-downloads-fake-call-history</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[Google Play]]></category>
            <category><![CDATA[scam apps]]></category>
            <category><![CDATA[CallPhantom]]></category>
            <category><![CDATA[ESET]]></category>
            <category><![CDATA[mobile security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 09 May 2026 12:05:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Let's Encrypt Halts All Certificate Issuance After Root Signing Mishap]]></title>
            <description><![CDATA[Let's Encrypt suspended certificate operations for 2.5 hours on May 8 after discovering a cross-signed certificate linking Generation X and Y roots incorrectly.]]></description>
            <link>https://www.probablypwned.com/article/lets-encrypt-certificate-issuance-halt-generation-y-root-incident</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lets-encrypt-certificate-issuance-halt-generation-y-root-incident</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Let's Encrypt]]></category>
            <category><![CDATA[TLS certificates]]></category>
            <category><![CDATA[PKI]]></category>
            <category><![CDATA[infrastructure]]></category>
            <category><![CDATA[ACME]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 09 May 2026 12:05:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Sentry SAML Flaw Lets Attackers Hijack Any Account—No Password Needed]]></title>
            <description><![CDATA[CVE-2026-42354 (CVSS 9.1) allows attackers to take over any Sentry user account via malicious SAML IdP. Patch to version 26.4.1 immediately.]]></description>
            <link>https://www.probablypwned.com/article/sentry-cve-2026-42354-saml-sso-account-takeover-cvss-9-1</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sentry-cve-2026-42354-saml-sso-account-takeover-cvss-9-1</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Sentry]]></category>
            <category><![CDATA[SAML]]></category>
            <category><![CDATA[CVE-2026-42354]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[account takeover]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 09 May 2026 12:04:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dirty Frag: Zero-Day Linux Exploit Gives Root With No Patches]]></title>
            <description><![CDATA[A new Linux kernel flaw dubbed Dirty Frag (CVE-2026-43284) enables instant root on all major distros. No patches exist after embargo collapsed.]]></description>
            <link>https://www.probablypwned.com/article/dirty-frag-linux-kernel-privilege-escalation-cve-2026-43284-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dirty-frag-linux-kernel-privilege-escalation-cve-2026-43284-zero-day</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[CVE-2026-43284]]></category>
            <category><![CDATA[CVE-2026-43500]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 08 May 2026 15:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TCLBanker Trojan Spreads via WhatsApp and Outlook, Abuses Signed Logitech Installer]]></title>
            <description><![CDATA[Brazilian banking trojan TCLBanker targets 59 financial platforms using a trojanized Logitech installer. It hijacks WhatsApp Web and Outlook to self-propagate, while WPF overlays facilitate real-time fraud.]]></description>
            <link>https://www.probablypwned.com/article/tclbanker-brazil-trojan-logitech-whatsapp-outlook-worm</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tclbanker-brazil-trojan-logitech-whatsapp-outlook-worm</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TCLBanker]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[Brazil]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 08 May 2026 12:06:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Used Teams Screen-Sharing to Steal Creds, Deployed Ransomware as Cover]]></title>
            <description><![CDATA[Iranian APT MuddyWater hijacked Microsoft Teams to harvest credentials via live screen-sharing, then dropped Chaos ransomware as a false flag to hide espionage. Rapid7 linked the campaign to 36 victims.]]></description>
            <link>https://www.probablypwned.com/article/muddywater-microsoft-teams-chaos-ransomware-false-flag</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/muddywater-microsoft-teams-chaos-ransomware-false-flag</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[Microsoft Teams]]></category>
            <category><![CDATA[Chaos ransomware]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 08 May 2026 12:05:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DAEMON Tools Trojanized Since April—Backdoor Hit 100+ Countries]]></title>
            <description><![CDATA[Kaspersky uncovered a supply chain attack on DAEMON Tools official website. Trojanized installers deployed QUIC RAT backdoors to thousands of systems, with a dozen government and manufacturing targets receiving advanced payloads.]]></description>
            <link>https://www.probablypwned.com/article/daemon-tools-supply-chain-attack-quic-rat-backdoor</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/daemon-tools-supply-chain-attack-quic-rat-backdoor</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[DAEMON Tools]]></category>
            <category><![CDATA[QUIC RAT]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[China APT]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 08 May 2026 12:05:04 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[12 Critical Flaws in vm2 Node.js Sandbox Enable Host Takeover]]></title>
            <description><![CDATA[Security researchers disclosed 12 sandbox escape vulnerabilities in vm2, including three with CVSS 10.0 scores. The popular JavaScript isolation library can no longer be trusted to contain untrusted code.]]></description>
            <link>https://www.probablypwned.com/article/vm2-nodejs-sandbox-escape-12-critical-cves-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vm2-nodejs-sandbox-escape-12-critical-cves-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[vm2]]></category>
            <category><![CDATA[Node.js]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[CVE-2026-24118]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 08 May 2026 12:04:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ivanti EPMM Zero-Day Exploited in the Wild—CISA Sets May 10 Deadline]]></title>
            <description><![CDATA[CVE-2026-6973 lets attackers achieve RCE on Ivanti Endpoint Manager Mobile with admin credentials. CISA added it to KEV with a two-day patch deadline for federal agencies.]]></description>
            <link>https://www.probablypwned.com/article/ivanti-epmm-cve-2026-6973-zero-day-rce-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ivanti-epmm-cve-2026-6973-zero-day-rce-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CVE-2026-6973]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[mobile device management]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 08 May 2026 12:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese APT Behind Palo Alto Zero-Day Shares Tools With Volt Typhoon]]></title>
            <description><![CDATA[Unit 42 links CL-STA-1132 to Chinese state-sponsored actors exploiting CVE-2026-0300 for espionage. IOCs and attack timeline revealed after a month of active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/palo-alto-zero-day-cl-sta-1132-china-apt-volt-typhoon-earthworm</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/palo-alto-zero-day-cl-sta-1132-china-apt-volt-typhoon-earthworm</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Palo Alto Networks]]></category>
            <category><![CDATA[CL-STA-1132]]></category>
            <category><![CDATA[Volt Typhoon]]></category>
            <category><![CDATA[APT41]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[Earthworm]]></category>
            <category><![CDATA[CVE-2026-0300]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 07 May 2026 09:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenCTI Auth Bypass Lets Attackers Hijack Admin Accounts (CVSS 9.8)]]></title>
            <description><![CDATA[CVE-2026-27960 in OpenCTI 6.6.0-6.9.12 allows unauthenticated API access as any user, including admin. Upgrade to 6.9.13 or disable the default admin account.]]></description>
            <link>https://www.probablypwned.com/article/opencti-cve-2026-27960-unauthenticated-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/opencti-cve-2026-27960-unauthenticated-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenCTI]]></category>
            <category><![CDATA[CVE-2026-27960]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <category><![CDATA[CVSS 9.8]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 06 May 2026 12:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apache HTTP/2 Double-Free Bug Enables DoS and RCE on Default Installs]]></title>
            <description><![CDATA[CVE-2026-23918 in Apache 2.4.66 lets attackers crash servers or achieve code execution with just two HTTP/2 frames. Upgrade to 2.4.67 immediately.]]></description>
            <link>https://www.probablypwned.com/article/apache-http2-cve-2026-23918-double-free-dos-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apache-http2-cve-2026-23918-double-free-dos-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache]]></category>
            <category><![CDATA[CVE-2026-23918]]></category>
            <category><![CDATA[HTTP/2]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[DoS]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 06 May 2026 12:03:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Palo Alto Firewalls Under Active Attack via Root-Level RCE Flaw]]></title>
            <description><![CDATA[CVE-2026-0300 allows unauthenticated attackers to execute code as root on PA-Series and VM-Series firewalls. Patches coming May 13—here's how to mitigate now.]]></description>
            <link>https://www.probablypwned.com/article/palo-alto-cve-2026-0300-root-rce-firewalls-active-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/palo-alto-cve-2026-0300-root-rce-firewalls-active-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Palo Alto Networks]]></category>
            <category><![CDATA[CVE-2026-0300]]></category>
            <category><![CDATA[firewall]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 06 May 2026 12:03:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FTC Bans Kochava From Selling Location Data Tied to Clinics]]></title>
            <description><![CDATA[The FTC settled with data broker Kochava, barring the sale of geolocation data that tracked visits to reproductive health clinics, addiction facilities, and domestic violence shelters.]]></description>
            <link>https://www.probablypwned.com/article/ftc-kochava-ban-sensitive-location-data-settlement</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ftc-kochava-ban-sensitive-location-data-settlement</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[FTC]]></category>
            <category><![CDATA[Kochava]]></category>
            <category><![CDATA[location data]]></category>
            <category><![CDATA[data broker]]></category>
            <category><![CDATA[privacy]]></category>
            <category><![CDATA[reproductive health]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 05 May 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mandiant: 28% of CVEs Exploited Within 24 Hours of Disclosure]]></title>
            <description><![CDATA[M-Trends 2026 reveals attackers now outpace patches, with AI accelerating exploitation and ransomware handoffs dropping to 22 seconds. Defenders are losing ground.]]></description>
            <link>https://www.probablypwned.com/article/mandiant-m-trends-2026-ai-attacks-22-second-handoff-exploit-speed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mandiant-m-trends-2026-ai-attacks-22-second-handoff-exploit-speed</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Mandiant]]></category>
            <category><![CDATA[M-Trends 2026]]></category>
            <category><![CDATA[AI attacks]]></category>
            <category><![CDATA[vulnerability exploitation]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 05 May 2026 12:06:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MicroStealer Targets Telecom and Education With Low Detection]]></title>
            <description><![CDATA[New infostealer MicroStealer evades major antivirus while stealing browser credentials, crypto wallets, and Discord tokens from US and German organizations.]]></description>
            <link>https://www.probablypwned.com/article/microstealer-infostealer-telecom-education-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microstealer-infostealer-telecom-education-credential-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[MicroStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[telecom]]></category>
            <category><![CDATA[education sector]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 05 May 2026 12:05:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[INTERPOL Crackdown Nets 276 Arrests, Seizes $701 Million]]></title>
            <description><![CDATA[Operation First Light 2026 dismantles nine scam centers across Asia, arrests 276 suspects, and seizes $701M in assets. FBI identifies 9,000 victims.]]></description>
            <link>https://www.probablypwned.com/article/interpol-operation-first-light-2026-276-arrests-701-million-seized</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/interpol-operation-first-light-2026-276-arrests-701-million-seized</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[INTERPOL]]></category>
            <category><![CDATA[Operation First Light]]></category>
            <category><![CDATA[pig butchering]]></category>
            <category><![CDATA[cybercrime enforcement]]></category>
            <category><![CDATA[scam centers]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 05 May 2026 12:05:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MOVEit Automation Auth Bypass Hits CVSS 9.8 — Patch Now]]></title>
            <description><![CDATA[Progress patches CVE-2026-4670, a critical authentication bypass in MOVEit Automation that could give attackers admin control. No workarounds available.]]></description>
            <link>https://www.probablypwned.com/article/moveit-automation-cve-2026-4670-critical-auth-bypass-cvss-9-8</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/moveit-automation-cve-2026-4670-critical-auth-bypass-cvss-9-8</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[MOVEit]]></category>
            <category><![CDATA[CVE-2026-4670]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[Progress Software]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 05 May 2026 12:04:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Xinference AI Package Compromised on PyPI in TeamPCP Wave]]></title>
            <description><![CDATA[Three malicious versions of the xinference AI inference library were uploaded to PyPI, targeting cloud credentials and SSH keys from 680K+ users. TeamPCP claims a copycat is responsible.]]></description>
            <link>https://www.probablypwned.com/article/xinference-pypi-supply-chain-teampcp-ai-ml-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/xinference-pypi-supply-chain-teampcp-ai-ml-credential-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[xinference]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 04 May 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FEMITBOT Scam Uses Telegram Mini Apps to Push Crypto Fraud]]></title>
            <description><![CDATA[CTM360 exposes FEMITBOT, a large-scale fraud operation abusing Telegram Mini Apps to run crypto scams, impersonate brands like Apple and NVIDIA, and distribute Android malware.]]></description>
            <link>https://www.probablypwned.com/article/femitbot-telegram-mini-apps-crypto-scams-android-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/femitbot-telegram-mini-apps-crypto-scams-android-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FEMITBOT]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[crypto scam]]></category>
            <category><![CDATA[Android malware]]></category>
            <category><![CDATA[fraud]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 04 May 2026 12:05:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Claims 275M Records in Instructure Canvas Breach]]></title>
            <description><![CDATA[Educational tech giant Instructure confirms data breach affecting Canvas LMS users. ShinyHunters claims 275 million student and teacher records stolen from 9,000 schools, with a May 6 leak deadline.]]></description>
            <link>https://www.probablypwned.com/article/instructure-canvas-breach-shinyhunters-275-million-students-teachers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/instructure-canvas-breach-shinyhunters-275-million-students-teachers</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Instructure]]></category>
            <category><![CDATA[Canvas]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[education breach]]></category>
            <category><![CDATA[data theft]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 04 May 2026 12:05:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PyPI Package With 1.1M Downloads Hijacked to Push Infostealer]]></title>
            <description><![CDATA[Attackers compromised elementary-data version 0.23.3 on PyPI, pushing malicious code to 1.1 million monthly users. The infection extended to Docker images via automated workflows.]]></description>
            <link>https://www.probablypwned.com/article/elementary-data-pypi-supply-chain-infostealer-docker-compromise</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/elementary-data-pypi-supply-chain-infostealer-docker-compromise</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[elementary-data]]></category>
            <category><![CDATA[Python]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 04 May 2026 12:05:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DEEP#DOOR Backdoor Harvests Passwords, Cloud Tokens, SSH Keys]]></title>
            <description><![CDATA[Securonix uncovers DEEP#DOOR, a Python-based backdoor that steals browser passwords, AWS/Azure credentials, and SSH keys while evading detection through bore.pub tunneling and extensive anti-analysis.]]></description>
            <link>https://www.probablypwned.com/article/deepdoor-python-backdoor-credential-stealer-bore-tunneling</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/deepdoor-python-backdoor-credential-stealer-bore-tunneling</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[DEEP#DOOR]]></category>
            <category><![CDATA[Python malware]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 04 May 2026 12:05:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Defender Flags Legit DigiCert Certs as Trojans]]></title>
            <description><![CDATA[A faulty signature update caused Windows Defender to detect trusted DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha. Microsoft has released a fix, but some users already reinstalled Windows.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-defender-digicert-false-positive-trojan-cerdigent</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-defender-digicert-false-positive-trojan-cerdigent</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Microsoft-Defender]]></category>
            <category><![CDATA[DigiCert]]></category>
            <category><![CDATA[false-positive]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[certificate-security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sun, 03 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Trellix Confirms Breach of Source Code Repository]]></title>
            <description><![CDATA[Trellix, formed from McAfee Enterprise and FireEye merger, disclosed unauthorized access to source code. Forensic investigation ongoing with no evidence of code exploitation.]]></description>
            <link>https://www.probablypwned.com/article/trellix-source-code-breach-unauthorized-repository-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trellix-source-code-breach-unauthorized-repository-access</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Trellix]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[source code]]></category>
            <category><![CDATA[McAfee]]></category>
            <category><![CDATA[FireEye]]></category>
            <category><![CDATA[security vendor]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 03 May 2026 12:09:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China-Linked APT Clusters Hit 8 Countries Including NATO State]]></title>
            <description><![CDATA[SHADOW-EARTH-053, GLITTER CARP, and SEQUIN CARP target Asian governments, journalists, and activists across Pakistan, Thailand, Poland, and 5 other nations with ShadowPad.]]></description>
            <link>https://www.probablypwned.com/article/china-apt-shadow-earth-glitter-carp-asian-governments-nato</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/china-apt-shadow-earth-glitter-carp-asian-governments-nato</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[ShadowPad]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[SHADOW-EARTH]]></category>
            <category><![CDATA[cyber espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 03 May 2026 12:07:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ConsentFix v3 Automates OAuth Phishing Against Azure Tenants]]></title>
            <description><![CDATA[New ConsentFix v3 attack automates Microsoft Azure OAuth credential theft using Pipedream webhooks and Cloudflare phishing pages. Pre-trusted apps bypass MFA entirely.]]></description>
            <link>https://www.probablypwned.com/article/consentfix-v3-oauth-azure-automated-phishing-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/consentfix-v3-oauth-azure-automated-phishing-attack</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[ConsentFix]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 03 May 2026 12:06:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Sorry Ransomware Hits 44,000 cPanel Servers via CVE-2026-41940]]></title>
            <description><![CDATA[Go-based Sorry ransomware exploits cPanel auth bypass CVE-2026-41940, encrypting files with ChaCha20/RSA-2048. 44,000+ IPs compromised as attackers demand Tox ransom.]]></description>
            <link>https://www.probablypwned.com/article/sorry-ransomware-cpanel-cve-2026-41940-mass-exploitation-44000-servers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sorry-ransomware-cpanel-cve-2026-41940-mass-exploitation-44000-servers</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[cPanel]]></category>
            <category><![CDATA[CVE-2026-41940]]></category>
            <category><![CDATA[Sorry ransomware]]></category>
            <category><![CDATA[Linux malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 03 May 2026 12:05:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OAuth Token Abuse Surges 146% as Attackers Target Cloud Integrations]]></title>
            <description><![CDATA[AiTM and token theft attacks hit 40,000 daily incidents in 2026. CISA warns OAuth tokens bypass MFA, enabling invisible lateral movement across SaaS apps.]]></description>
            <link>https://www.probablypwned.com/article/oauth-token-abuse-cloud-services-146-percent-surge-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oauth-token-abuse-cloud-services-146-percent-surge-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[token theft]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[SaaS]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[identity security]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 02 May 2026 18:35:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Coast Guard Warns Maritime Sector of INC Ransom Attacks]]></title>
            <description><![CDATA[US Coast Guard Cyber Command issued an alert warning that INC Ransom is actively targeting maritime and logistics networks with double-extortion ransomware.]]></description>
            <link>https://www.probablypwned.com/article/inc-ransom-coast-guard-maritime-sector-alert-double-extortion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/inc-ransom-coast-guard-maritime-sector-alert-double-extortion</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[INC Ransom]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[maritime]]></category>
            <category><![CDATA[Coast Guard]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[double extortion]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 02 May 2026 12:06:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vietnamese Phishing Op Hijacks 30K Facebook Accounts via AppSheet]]></title>
            <description><![CDATA[A Vietnamese threat actor dubbed AccountDumpling compromised 30,000 Facebook Business accounts using Google AppSheet emails to bypass spam filters.]]></description>
            <link>https://www.probablypwned.com/article/facebook-appsheet-phishing-accountdumpling-30000-accounts</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/facebook-appsheet-phishing-accountdumpling-30000-accounts</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Facebook]]></category>
            <category><![CDATA[Google AppSheet]]></category>
            <category><![CDATA[AccountDumpling]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Vietnam]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 02 May 2026 12:05:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ADT Breach Exposes 5.5 Million Customers After Vishing Attack]]></title>
            <description><![CDATA[ShinyHunters breached home security giant ADT via voice phishing to compromise an employee's Okta SSO, stealing 5.5 million customer records from Salesforce.]]></description>
            <link>https://www.probablypwned.com/article/adt-breach-5-5-million-shinyhunters-vishing-okta-salesforce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/adt-breach-5-5-million-shinyhunters-vishing-okta-salesforce</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ADT]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[Okta]]></category>
            <category><![CDATA[Salesforce]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 02 May 2026 12:05:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware Negotiators Get 4 Years for BlackCat Attacks]]></title>
            <description><![CDATA[Former Sygnia and DigitalMint employees Ryan Goldberg and Kevin Martin sentenced for deploying ALPHV BlackCat ransomware while working as incident responders.]]></description>
            <link>https://www.probablypwned.com/article/ransomware-negotiators-sentenced-4-years-blackcat-alphv-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ransomware-negotiators-sentenced-4-years-blackcat-alphv-attacks</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[ALPHV]]></category>
            <category><![CDATA[BlackCat]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[insider threat]]></category>
            <category><![CDATA[sentencing]]></category>
            <category><![CDATA[DOJ]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 01 May 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SAP npm Packages Backdoored in TeamPCP Supply Chain Attack]]></title>
            <description><![CDATA[Four official SAP CAP ecosystem packages compromised on April 29, harvesting developer credentials, cloud secrets, and CI/CD tokens through malicious preinstall scripts.]]></description>
            <link>https://www.probablypwned.com/article/sap-npm-packages-teampcp-mini-shai-hulud-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sap-npm-packages-teampcp-mini-shai-hulud-credential-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[SAP]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[Mini Shai-Hulud]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 01 May 2026 12:05:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PyTorch Lightning Compromised on PyPI to Steal Developer Secrets]]></title>
            <description><![CDATA[TeamPCP threat actors backdoored versions 2.6.2 and 2.6.3 of the popular AI framework, harvesting SSH keys, cloud credentials, and GitHub tokens from millions of developers.]]></description>
            <link>https://www.probablypwned.com/article/pytorch-lightning-pypi-supply-chain-teampcp-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pytorch-lightning-pypi-supply-chain-teampcp-credential-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PyTorch Lightning]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[AI framework]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 01 May 2026 12:04:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Linux Copy Fail Flaw Grants Root in Seconds — Patch Now]]></title>
            <description><![CDATA[CVE-2026-31431 lets attackers gain root on every major Linux distro since 2017 with a 732-byte Python script. Here's how it works and what to do.]]></description>
            <link>https://www.probablypwned.com/article/linux-copy-fail-cve-2026-31431-kernel-root-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/linux-copy-fail-cve-2026-31431-kernel-root-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[CVE-2026-31431]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[kernel vulnerability]]></category>
            <category><![CDATA[container security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 30 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28's PRISMEX Malware Targets NATO Supply Chains]]></title>
            <description><![CDATA[Russian military hackers deployed PRISMEX steganography malware against Ukraine and NATO logistics networks, exploiting zero-days CVE-2026-21509 and CVE-2026-21513 weeks before patches.]]></description>
            <link>https://www.probablypwned.com/article/apt28-prismex-malware-nato-logistics-ukraine</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-prismex-malware-nato-logistics-ukraine</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[PRISMEX]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[NATO]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 30 Apr 2026 12:05:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GitHub RCE Flaw Let Attackers Access Millions of Private Repos]]></title>
            <description><![CDATA[CVE-2026-3854 allowed authenticated attackers to execute code on GitHub servers via a single git push. 88% of Enterprise Server instances remain unpatched.]]></description>
            <link>https://www.probablypwned.com/article/github-cve-2026-3854-rce-git-push-millions-repos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/github-cve-2026-3854-rce-git-push-millions-repos</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[CVE-2026-3854]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[git]]></category>
            <category><![CDATA[Enterprise Server]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 30 Apr 2026 12:04:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Scattered Spider Member Arrested in Finland, Faces US Charges]]></title>
            <description><![CDATA[Peter Stokes, 19, was detained while boarding a flight to Japan. Federal prosecutors allege he participated in breaches that forced companies to pay millions in ransoms.]]></description>
            <link>https://www.probablypwned.com/article/scattered-spider-member-arrested-finland-us-extradition</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/scattered-spider-member-arrested-finland-us-extradition</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[arrest]]></category>
            <category><![CDATA[extradition]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 29 Apr 2026 12:12:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT37 Exploits Facebook Friendships to Deploy RokRAT]]></title>
            <description><![CDATA[North Korean threat actors are befriending targets on Facebook, building trust over weeks, then delivering RokRAT malware through trojanized PDF readers. Military and government officials targeted.]]></description>
            <link>https://www.probablypwned.com/article/apt37-facebook-social-engineering-rokrat-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt37-facebook-social-engineering-rokrat-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT37]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[RokRAT]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[Facebook]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 29 Apr 2026 12:10:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenClaw Pairing Flaw Enables CVSS 9.1 Privilege Escalation]]></title>
            <description><![CDATA[CVE-2026-41386 allows attackers to manipulate bootstrap setup codes during device pairing, bypassing role restrictions and gaining elevated privileges in OpenClaw.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-cve-2026-41386-pairing-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-cve-2026-41386-pairing-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[CVE-2026-41386]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[AI agents]]></category>
            <category><![CDATA[IoT pairing]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 29 Apr 2026 12:08:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[cPanel Auth Bypass CVE-2026-41940 Exploited Before Patch]]></title>
            <description><![CDATA[Critical CVSS 9.8 flaw in cPanel/WHM allowed attackers to bypass authentication via CRLF injection. Exploits confirmed in the wild before emergency patches.]]></description>
            <link>https://www.probablypwned.com/article/cpanel-emergency-patch-authentication-bypass-april-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cpanel-emergency-patch-authentication-bypass-april-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[cPanel]]></category>
            <category><![CDATA[WHM]]></category>
            <category><![CDATA[CVE-2026-41940]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 29 Apr 2026 12:06:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LiteLLM SQL Injection Exploited 36 Hours After Disclosure]]></title>
            <description><![CDATA[CVE-2026-42208 lets attackers steal API keys and forge admin sessions in LiteLLM without authentication. Exploitation began within 36 hours of public disclosure.]]></description>
            <link>https://www.probablypwned.com/article/litellm-cve-2026-42208-sql-injection-exploited-36-hours</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/litellm-cve-2026-42208-sql-injection-exploited-36-hours</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[LiteLLM]]></category>
            <category><![CDATA[CVE-2026-42208]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[API keys]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 29 Apr 2026 12:04:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Needle Stealer Spreads via Fake TradingView AI Tool]]></title>
            <description><![CDATA[Malwarebytes uncovers campaign using fake TradingClaw website to distribute Needle Stealer malware. The infostealer hijacks browsers to harvest credentials, crypto wallets, and financial data from traders.]]></description>
            <link>https://www.probablypwned.com/article/needle-stealer-tradingclaw-fake-tradingview-browser-hijacking</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/needle-stealer-tradingclaw-fake-tradingview-browser-hijacking</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Needle-Stealer]]></category>
            <category><![CDATA[TradingView]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[browser-hijacking]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 28 Apr 2026 12:06:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Exploiting Windows Shell Flaw to Steal NTLM Credentials]]></title>
            <description><![CDATA[Russian state hackers weaponize CVE-2026-32202, an incomplete patch for Windows Shell that enables zero-click NTLM hash theft. Microsoft confirms active exploitation after Akamai discovers the bypass.]]></description>
            <link>https://www.probablypwned.com/article/windows-shell-cve-2026-32202-active-exploitation-spoofing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/windows-shell-cve-2026-32202-active-exploitation-spoofing</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[CVE-2026-32202]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[NTLM]]></category>
            <category><![CDATA[active-exploitation]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 28 Apr 2026 12:05:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Entra ID Flaw Let Attackers Hijack Any Service Principal]]></title>
            <description><![CDATA[Silverfort researchers discover Microsoft's AI agent management role could be abused to take over arbitrary service principals in Entra ID tenants. Microsoft patched the privilege escalation flaw on April 9.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-entra-id-agent-administrator-service-principal-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-entra-id-agent-administrator-service-principal-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft-Entra-ID]]></category>
            <category><![CDATA[privilege-escalation]]></category>
            <category><![CDATA[identity-management]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[service-principal]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 28 Apr 2026 12:04:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Silk Typhoon Hacker Extradited to U.S. for COVID Vaccine Theft]]></title>
            <description><![CDATA[Chinese national Xu Zewei faces nine federal counts after extradition from Italy for alleged role in Silk Typhoon attacks stealing COVID-19 vaccine research from U.S. universities and research institutions.]]></description>
            <link>https://www.probablypwned.com/article/silk-typhoon-xu-zewei-extradition-covid-vaccine-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/silk-typhoon-xu-zewei-extradition-covid-vaccine-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Silk-Typhoon]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[COVID-19]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 28 Apr 2026 12:04:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ASP.NET Core Bug Lets Attackers Forge Auth Cookies for SYSTEM Access]]></title>
            <description><![CDATA[Microsoft releases emergency patch for CVE-2026-40372 (CVSS 9.1), a critical ASP.NET Core flaw allowing attackers to forge authentication cookies and gain SYSTEM privileges on Linux and macOS servers.]]></description>
            <link>https://www.probablypwned.com/article/aspnet-core-cve-2026-40372-system-privilege-escalation-cookie-forgery</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aspnet-core-cve-2026-40372-system-privilege-escalation-cookie-forgery</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ASP.NET-Core]]></category>
            <category><![CDATA[CVE-2026-40372]]></category>
            <category><![CDATA[privilege-escalation]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[authentication-bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 28 Apr 2026 12:03:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PhantomRPC: Unpatched Windows Flaw Enables SYSTEM Escalation]]></title>
            <description><![CDATA[Kaspersky discloses PhantomRPC, an architectural Windows RPC vulnerability enabling SYSTEM-level privilege escalation across all Windows versions. Microsoft declined to patch despite five exploitation paths.]]></description>
            <link>https://www.probablypwned.com/article/phantomrpc-windows-rpc-privilege-escalation-all-versions</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/phantomrpc-windows-rpc-privilege-escalation-all-versions</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[PhantomRPC]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[RPC]]></category>
            <category><![CDATA[Kaspersky]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 27 Apr 2026 12:09:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PhantomCore Exploits TrueConf Flaws to Breach Russian Networks]]></title>
            <description><![CDATA[Pro-Ukrainian hacktivist group PhantomCore chains three TrueConf vulnerabilities including CVSS 9.8 command injection to infiltrate Russian government and private organizations since September 2025.]]></description>
            <link>https://www.probablypwned.com/article/phantomcore-trueconf-exploit-chain-russian-targets</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/phantomcore-trueconf-exploit-chain-russian-targets</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[PhantomCore]]></category>
            <category><![CDATA[TrueConf]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[hacktivism]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[video conferencing]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 27 Apr 2026 12:08:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[73 GlassWorm Sleeper Extensions Found in Open VSX Marketplace]]></title>
            <description><![CDATA[Socket researchers identify 73 malicious VS Code extensions on Open VSX tied to GlassWorm campaign. Six already activated to deliver malware through native binaries and obfuscated JavaScript.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-v2-73-open-vsx-sleeper-extensions-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-v2-73-open-vsx-sleeper-extensions-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[Open VSX]]></category>
            <category><![CDATA[developer security]]></category>
            <category><![CDATA[sleeper malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 27 Apr 2026 12:07:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[fast16: State-Backed Sabotage Malware Predates Stuxnet by 5 Years]]></title>
            <description><![CDATA[SentinelOne reveals fast16, a 2005 cyber sabotage framework targeting engineering software. The Lua-based malware corrupted high-precision calculations years before Stuxnet emerged.]]></description>
            <link>https://www.probablypwned.com/article/fast16-pre-stuxnet-sabotage-malware-sentinelone-shadowbrokers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fast16-pre-stuxnet-sabotage-malware-sentinelone-shadowbrokers</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[fast16]]></category>
            <category><![CDATA[SentinelOne]]></category>
            <category><![CDATA[Stuxnet]]></category>
            <category><![CDATA[cyber sabotage]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[ShadowBrokers]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 27 Apr 2026 12:06:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GeoVision IP Device Utility Leaks Credentials Over Broadcast]]></title>
            <description><![CDATA[CVE-2026-42363 exposes admin credentials in GeoVision GV-IP Device Utility 9.0.5 via UDP broadcast packets. CVSS 9.3 critical flaw lets LAN attackers decrypt device passwords.]]></description>
            <link>https://www.probablypwned.com/article/geovision-cve-2026-42363-credential-leak-ip-device-utility</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/geovision-cve-2026-42363-credential-leak-ip-device-utility</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-42363]]></category>
            <category><![CDATA[GeoVision]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[IoT security]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 27 Apr 2026 12:05:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[One Researcher, Four Critical RCE Bugs in AI Frameworks]]></title>
            <description><![CDATA[Security researcher Valentin Lobstein discovers CVSS 9.8 pickle deserialization vulnerabilities in LeRobot, ktransformers, and LightLLM. ML frameworks using pickle for network serialization create widespread attack surface.]]></description>
            <link>https://www.probablypwned.com/article/pickle-deserialization-rce-ai-ml-frameworks-chocapikk-four-cves</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pickle-deserialization-rce-ai-ml-frameworks-chocapikk-four-cves</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[pickle-deserialization]]></category>
            <category><![CDATA[AI-security]]></category>
            <category><![CDATA[remote-code-execution]]></category>
            <category><![CDATA[HuggingFace]]></category>
            <category><![CDATA[machine-learning]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 26 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SGLang CVSS 9.8 Flaw Allows RCE via Malicious AI Model Files]]></title>
            <description><![CDATA[Critical CVE-2026-5760 in SGLang enables unauthenticated RCE through poisoned GGUF model files. Attackers can weaponize Hugging Face models to compromise inference servers.]]></description>
            <link>https://www.probablypwned.com/article/sglang-cve-2026-5760-gguf-model-rce-jinja2-ssti</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sglang-cve-2026-5760-gguf-model-rce-jinja2-ssti</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SGLang]]></category>
            <category><![CDATA[CVE-2026-5760]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[GGUF]]></category>
            <category><![CDATA[SSTI]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 26 Apr 2026 12:07:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Oracle Patches 481 Vulnerabilities in April Critical Patch Update]]></title>
            <description><![CDATA[Oracle's April 2026 CPU addresses 450 CVEs across 28 product families. Over 300 flaws are remotely exploitable without authentication, with Communications leading at 139 patches.]]></description>
            <link>https://www.probablypwned.com/article/oracle-april-2026-cpu-481-patches-300-remote-exploits</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-april-2026-cpu-481-patches-300-remote-exploits</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[patch Tuesday]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[critical patch]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 26 Apr 2026 12:06:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Phantom Claude Campaign Targets Developers With macOS Infostealer]]></title>
            <description><![CDATA[Attackers use SEO poisoning to push malicious Claude Code installers to developers. The two-stage macOS malware steals credentials, crypto wallets, and establishes persistent backdoor access.]]></description>
            <link>https://www.probablypwned.com/article/phantom-claude-macos-infostealer-anthropic-seo-poisoning-crypto</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/phantom-claude-macos-infostealer-anthropic-seo-poisoning-crypto</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Claude]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 26 Apr 2026 12:05:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BlackFile Gang Uses Vishing to Hit Retail and Hospitality Orgs]]></title>
            <description><![CDATA[New extortion group BlackFile impersonates IT helpdesks via phone calls to steal credentials and demand seven-figure ransoms. Targets include retail chains and hospitality companies.]]></description>
            <link>https://www.probablypwned.com/article/blackfile-extortion-vishing-retail-hospitality-seven-figure-ransoms</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/blackfile-extortion-vishing-retail-hospitality-seven-figure-ransoms</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[BlackFile]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[retail]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 26 Apr 2026 12:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Firestarter Malware Survives Cisco Firewall Patches and Reboots]]></title>
            <description><![CDATA[CISA and NCSC warn of Firestarter backdoor persisting on Cisco ASA and Firepower devices. The malware survives firmware updates and requires physical power disconnection to remove.]]></description>
            <link>https://www.probablypwned.com/article/firestarter-malware-cisco-asa-firepower-cisa-ncsc-persistence</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/firestarter-malware-cisco-asa-firepower-cisa-ncsc-persistence</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[Firestarter]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[firewall malware]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 26 Apr 2026 12:04:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Samsung, SimpleHelp, D-Link Flaws to Must-Patch List]]></title>
            <description><![CDATA[Four actively exploited vulnerabilities added to CISA's KEV catalog on April 24. Federal agencies face May 8 deadline—here's what's being targeted.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-april-24-samsung-magicinfo-simplehelp-dlink</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-april-24-samsung-magicinfo-simplehelp-dlink</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[Samsung MagicINFO]]></category>
            <category><![CDATA[SimpleHelp]]></category>
            <category><![CDATA[D-Link]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 25 Apr 2026 12:05:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Clerk Auth Bypass Lets Attackers Skip Middleware in Next.js Apps]]></title>
            <description><![CDATA[CVE-2026-41248 in Clerk's JavaScript libraries allows crafted requests to bypass authentication middleware. CVSS 9.1—patch your Next.js, Nuxt, and Astro apps now.]]></description>
            <link>https://www.probablypwned.com/article/clerk-cve-2026-41248-auth-bypass-nextjs-nuxt-astro</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clerk-cve-2026-41248-auth-bypass-nextjs-nuxt-astro</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Clerk]]></category>
            <category><![CDATA[CVE-2026-41248]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[Next.js]]></category>
            <category><![CDATA[middleware]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 25 Apr 2026 12:05:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Bitwarden CLI Compromised in Shai-Hulud Supply Chain Attack]]></title>
            <description><![CDATA[A malicious npm package hijacked Bitwarden CLI's publishing pipeline on April 22, harvesting credentials from 334 developers. Here's what happened.]]></description>
            <link>https://www.probablypwned.com/article/bitwarden-cli-shai-hulud-supply-chain-attack-npm-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bitwarden-cli-shai-hulud-supply-chain-attack-npm-credential-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Bitwarden]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[Shai-Hulud]]></category>
            <category><![CDATA[Checkmarx]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 25 Apr 2026 12:04:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrowdStrike LogScale Path Traversal Lets Attackers Read Any File]]></title>
            <description><![CDATA[CVE-2026-40050 exposes CrowdStrike LogScale servers to unauthenticated file access via path traversal. CVSS 9.8—here's who's affected and how to patch.]]></description>
            <link>https://www.probablypwned.com/article/crowdstrike-logscale-cve-2026-40050-path-traversal-file-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crowdstrike-logscale-cve-2026-40050-path-traversal-file-access</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CrowdStrike]]></category>
            <category><![CDATA[CVE-2026-40050]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[LogScale]]></category>
            <category><![CDATA[SIEM]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 25 Apr 2026 12:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pack2TheRoot: 12-Year-Old PackageKit Bug Grants Root on Linux]]></title>
            <description><![CDATA[CVE-2026-41651 lets any local user gain root privileges on Ubuntu, Debian, and Fedora via a TOCTOU race in PackageKit. Patch to version 1.3.5 immediately.]]></description>
            <link>https://www.probablypwned.com/article/pack2theroot-cve-2026-41651-linux-root-packagekit-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pack2theroot-cve-2026-41651-linux-root-packagekit-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[privilege-escalation]]></category>
            <category><![CDATA[PackageKit]]></category>
            <category><![CDATA[CVE-2026-41651]]></category>
            <category><![CDATA[Ubuntu]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 24 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Masjesu Botnet: DDoS-for-Hire Service Targeting Global IoT]]></title>
            <description><![CDATA[Masjesu botnet, marketed via Telegram, exploits 12 vulnerabilities to conscript routers and IoT devices for DDoS attacks. Nearly 50% of traffic originates from Vietnam.]]></description>
            <link>https://www.probablypwned.com/article/masjesu-botnet-ddos-for-hire-iot-devices-telegram</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/masjesu-botnet-ddos-for-hire-iot-devices-telegram</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[Masjesu]]></category>
            <category><![CDATA[Telegram]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 24 Apr 2026 12:06:39 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LMDeploy SSRF Exploited 12 Hours After Disclosure]]></title>
            <description><![CDATA[CVE-2026-33626 in LMDeploy AI toolkit was weaponized within 12 hours of publication, targeting AWS credentials and internal services. Patch to v0.12.3 immediately.]]></description>
            <link>https://www.probablypwned.com/article/lmdeploy-cve-2026-33626-ssrf-exploited-12-hours-ai-llm</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lmdeploy-cve-2026-33626-ssrf-exploited-12-hours-ai-llm</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-33626]]></category>
            <category><![CDATA[LMDeploy]]></category>
            <category><![CDATA[SSRF]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[LLM]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 24 Apr 2026 12:05:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UNC6692 Deploys SNOW Malware via Fake IT Helpdesk Teams Calls]]></title>
            <description><![CDATA[Google Cloud uncovers UNC6692, a threat actor impersonating IT helpdesk staff on Microsoft Teams to deploy the modular SNOW malware suite targeting senior executives.]]></description>
            <link>https://www.probablypwned.com/article/unc6692-snow-malware-microsoft-teams-helpdesk-impersonation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unc6692-snow-malware-microsoft-teams-helpdesk-impersonation</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UNC6692]]></category>
            <category><![CDATA[SNOW malware]]></category>
            <category><![CDATA[Microsoft Teams]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[phishing]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 24 Apr 2026 12:05:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GopherWhisper APT Abuses Discord and Slack to Spy on Mongolia]]></title>
            <description><![CDATA[ESET uncovers GopherWhisper, a China-aligned APT using Go-based backdoors and legitimate cloud services like Discord, Slack, and Outlook to target Mongolian government systems.]]></description>
            <link>https://www.probablypwned.com/article/gopherwhisper-apt-china-mongolia-discord-slack-go-backdoors</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gopherwhisper-apt-china-mongolia-discord-slack-go-backdoors</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Mongolia]]></category>
            <category><![CDATA[Discord]]></category>
            <category><![CDATA[Slack]]></category>
            <category><![CDATA[Go malware]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 24 Apr 2026 12:04:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Defender Zero-Days Hit Live Attacks - Two Still Unpatched]]></title>
            <description><![CDATA[Huntress confirms hands-on-keyboard exploitation of all three Windows Defender zero-days. Microsoft patched BlueHammer, but RedSun and UnDefend remain unpatched as attackers chain them for SYSTEM access.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-defender-zero-days-active-exploitation-bluehammer-redsun</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-defender-zero-days-active-exploitation-bluehammer-redsun</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows Defender]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[BlueHammer]]></category>
            <category><![CDATA[RedSun]]></category>
            <category><![CDATA[UnDefend]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[CVE-2026-33825]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 23 Apr 2026 12:18:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Exposed SystemBC Server Reveals 1,570+ Hidden Ransomware Victims]]></title>
            <description><![CDATA[Check Point researchers gained access to a SystemBC C2 server operated by The Gentlemen ransomware group, uncovering over 1,570 compromised corporate networks that haven't been publicly disclosed.]]></description>
            <link>https://www.probablypwned.com/article/systembc-c2-server-1570-victims-gentlemen-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/systembc-c2-server-1570-victims-gentlemen-ransomware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[SystemBC]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[The Gentlemen]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <category><![CDATA[C2 infrastructure]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 23 Apr 2026 12:17:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mirai Variant Targets End-of-Life D-Link Routers]]></title>
            <description><![CDATA[Akamai detects active exploitation of CVE-2025-29635 in discontinued D-Link DIR-823X routers. The tuxnokill variant spreads via command injection and launches DDoS attacks from compromised devices.]]></description>
            <link>https://www.probablypwned.com/article/mirai-tuxnokill-dlink-routers-cve-2025-29635-botnet</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mirai-tuxnokill-dlink-routers-cve-2025-29635-botnet</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Mirai]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[D-Link]]></category>
            <category><![CDATA[CVE-2025-29635]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[command injection]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 23 Apr 2026 12:17:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Kyber Ransomware Deploys Post-Quantum Crypto on Windows]]></title>
            <description><![CDATA[New Kyber ransomware operation uses NIST-standardized Kyber1024 encryption on Windows while targeting VMware ESXi with a separate variant. Rapid7 analysis reveals the ESXi version's claims are false.]]></description>
            <link>https://www.probablypwned.com/article/kyber-ransomware-post-quantum-encryption-windows-esxi</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kyber-ransomware-post-quantum-encryption-windows-esxi</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[post-quantum cryptography]]></category>
            <category><![CDATA[Kyber1024]]></category>
            <category><![CDATA[VMware ESXi]]></category>
            <category><![CDATA[Windows]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 23 Apr 2026 12:16:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Webex SSO Flaw Let Attackers Impersonate Any User]]></title>
            <description><![CDATA[CVE-2026-20184 (CVSS 9.8) in Cisco Webex Services allowed unauthenticated attackers to impersonate any user through SSO certificate validation bypass. Cloud service already patched.]]></description>
            <link>https://www.probablypwned.com/article/cisco-webex-cve-2026-20184-sso-user-impersonation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-webex-cve-2026-20184-sso-user-impersonation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco Webex]]></category>
            <category><![CDATA[CVE-2026-20184]]></category>
            <category><![CDATA[SSO]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[user impersonation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 22 Apr 2026 12:06:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds 8 Exploited Flaws to KEV, Cisco SD-WAN Deadline Tomorrow]]></title>
            <description><![CDATA[CISA added eight vulnerabilities to its KEV catalog including three Cisco Catalyst SD-WAN Manager flaws. Federal agencies face an April 23 deadline for the Cisco patches.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-8-vulnerabilities-cisco-sd-wan-april-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-8-vulnerabilities-cisco-sd-wan-april-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[Cisco SD-WAN]]></category>
            <category><![CDATA[PaperCut]]></category>
            <category><![CDATA[JetBrains TeamCity]]></category>
            <category><![CDATA[federal deadline]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 22 Apr 2026 12:05:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Claude AI Installer Delivers PlugX RAT via DLL Sideloading]]></title>
            <description><![CDATA[Attackers are distributing PlugX malware through phishing campaigns impersonating Anthropic's Claude AI. The fake installer abuses a legitimate G DATA binary for DLL sideloading.]]></description>
            <link>https://www.probablypwned.com/article/fake-claude-ai-installer-plugx-rat-dll-sideloading</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fake-claude-ai-installer-plugx-rat-dll-sideloading</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PlugX]]></category>
            <category><![CDATA[Claude AI]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[China]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 22 Apr 2026 12:04:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OAuth2 Proxy Auth Bypass Lets Attackers Access Protected Routes]]></title>
            <description><![CDATA[CVE-2026-40575 (CVSS 9.1) allows unauthenticated attackers to bypass OAuth2 Proxy authentication via X-Forwarded-Uri header spoofing. Patch to v7.15.2 immediately.]]></description>
            <link>https://www.probablypwned.com/article/oauth2-proxy-cve-2026-40575-auth-bypass-header-spoofing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oauth2-proxy-cve-2026-40575-auth-bypass-header-spoofing</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OAuth2 Proxy]]></category>
            <category><![CDATA[CVE-2026-40575]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[header spoofing]]></category>
            <category><![CDATA[reverse proxy]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 22 Apr 2026 12:04:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lotus Wiper Targeted Venezuelan Energy Sector Before Maduro Capture]]></title>
            <description><![CDATA[Kaspersky exposes Lotus, a data wiper deployed against Venezuela's energy utilities in December 2025. The malware destroys recovery mechanisms and leaves systems unrecoverable.]]></description>
            <link>https://www.probablypwned.com/article/lotus-data-wiper-venezuela-energy-utilities-kaspersky</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lotus-data-wiper-venezuela-energy-utilities-kaspersky</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Lotus]]></category>
            <category><![CDATA[wiper malware]]></category>
            <category><![CDATA[Venezuela]]></category>
            <category><![CDATA[PDVSA]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[energy sector]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 21 Apr 2026 17:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Hits Canada Life With 5.6M Record Breach]]></title>
            <description><![CDATA[ShinyHunters claims breach of Canada Life Assurance exposing 5.6 million Salesforce records with PII. Ransom deadline passed April 21, 2026—data leak threatened.]]></description>
            <link>https://www.probablypwned.com/article/canada-life-assurance-shinyhunters-5-6m-salesforce-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/canada-life-assurance-shinyhunters-5-6m-salesforce-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Canada Life]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Salesforce]]></category>
            <category><![CDATA[financial services]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 21 Apr 2026 12:05:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korean Hackers Backdoored Axios npm Package in 40 Minutes]]></title>
            <description><![CDATA[Google attributes the Axios npm supply chain attack to UNC1069, a North Korean threat actor. Malicious versions deployed WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.]]></description>
            <link>https://www.probablypwned.com/article/unc1069-axios-npm-supply-chain-waveshaper-north-korea</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unc1069-axios-npm-supply-chain-waveshaper-north-korea</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UNC1069]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[npm supply chain]]></category>
            <category><![CDATA[Axios]]></category>
            <category><![CDATA[WAVESHAPER]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 21 Apr 2026 12:04:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NewSoftOA Command Injection Lets Local Attackers Own Servers]]></title>
            <description><![CDATA[CVE-2026-5965 in NewSoftOA enables unauthenticated OS command injection with CVSS 9.8. Local attackers can execute arbitrary commands and fully compromise systems.]]></description>
            <link>https://www.probablypwned.com/article/newsoftoa-cve-2026-5965-os-command-injection-cvss-9-8</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/newsoftoa-cve-2026-5965-os-command-injection-cvss-9-8</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-5965]]></category>
            <category><![CDATA[NewSoftOA]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <category><![CDATA[server compromise]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 21 Apr 2026 12:04:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenClaw Sandbox Escape Hits CVSS 9.9—Upgrade Before It's Exploited]]></title>
            <description><![CDATA[CVE-2026-41329 lets attackers bypass OpenClaw's sandbox via heartbeat context manipulation, achieving privilege escalation. CVSS 9.9 demands immediate patching.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-cve-2026-41329-sandbox-escape-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-cve-2026-41329-sandbox-escape-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[CVE-2026-41329]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 21 Apr 2026 12:03:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Seiko USA Website Defaced With Ransom Note, Customer Data Allegedly Stolen]]></title>
            <description><![CDATA[Attackers hijacked Seiko USA's website to post a ransom demand, claiming theft of customer data from the watchmaker's Shopify store. A 72-hour deadline was issued before public release.]]></description>
            <link>https://www.probablypwned.com/article/seiko-usa-website-defacement-shopify-customer-data-extortion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/seiko-usa-website-defacement-shopify-customer-data-extortion</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Seiko]]></category>
            <category><![CDATA[website defacement]]></category>
            <category><![CDATA[Shopify]]></category>
            <category><![CDATA[data extortion]]></category>
            <category><![CDATA[ransom]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 20 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PHANTOMPULSE RAT Spreads via Malicious Obsidian Vaults]]></title>
            <description><![CDATA[Threat actors pose as VCs on LinkedIn, share weaponized Obsidian vaults that silently deploy an AI-generated backdoor using blockchain C2 infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/phantompulse-rat-obsidian-plugin-abuse-crypto-finance</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/phantompulse-rat-obsidian-plugin-abuse-crypto-finance</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PHANTOMPULSE]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[Obsidian]]></category>
            <category><![CDATA[Social Engineering]]></category>
            <category><![CDATA[Cryptocurrency]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 20 Apr 2026 12:06:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BLACKWATER Ransomware Debuts with 3.3TB Healthcare Attack]]></title>
            <description><![CDATA[New ransomware operation claims Medical Park Hospitals as first victim. 36 Turkish hospitals face data leak threats after 3.3TB exfiltration.]]></description>
            <link>https://www.probablypwned.com/article/blackwater-ransomware-medical-park-hospitals-turkey-3tb</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/blackwater-ransomware-medical-park-hospitals-turkey-3tb</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[BLACKWATER]]></category>
            <category><![CDATA[Ransomware]]></category>
            <category><![CDATA[Healthcare]]></category>
            <category><![CDATA[Data Breach]]></category>
            <category><![CDATA[Turkey]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 20 Apr 2026 12:05:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Patches Four CVSS 9.9 Flaws in Identity Services Engine]]></title>
            <description><![CDATA[Critical ISE vulnerabilities let authenticated users escalate to root. Read-only admin accounts can execute arbitrary commands on underlying OS.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ise-critical-rce-cve-2026-20186-cvss-9-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ise-critical-rce-cve-2026-20186-cvss-9-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco ISE]]></category>
            <category><![CDATA[CVE-2026-20186]]></category>
            <category><![CDATA[CVE-2026-20180]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Privilege Escalation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 20 Apr 2026 12:04:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apache ActiveMQ RCE Added to CISA KEV After Exploit Surge]]></title>
            <description><![CDATA[CVE-2026-34197 lets attackers execute arbitrary code via ActiveMQ's Jolokia API. CISA mandates federal patching by April 30 as exploitation peaks.]]></description>
            <link>https://www.probablypwned.com/article/apache-activemq-cve-2026-34197-cisa-kev-jolokia-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apache-activemq-cve-2026-34197-cisa-kev-jolokia-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache ActiveMQ]]></category>
            <category><![CDATA[CVE-2026-34197]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Jolokia]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 20 Apr 2026 12:03:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vercel Breach Traced to Compromised Third-Party OAuth App]]></title>
            <description><![CDATA[Compromised Google Workspace OAuth app 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj breached Vercel, exposing API keys and source code. Hackers demand $2M; audit Workspace apps and rotate credentials.]]></description>
            <link>https://www.probablypwned.com/article/vercel-breach-shinyhunters-2m-ransom-oauth-compromise</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vercel-breach-shinyhunters-2m-ransom-oauth-compromise</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Vercel]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[API keys]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 19 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AVEVA Pipeline Simulation Flaw Lets Attackers Manipulate Oil and Gas Training Systems]]></title>
            <description><![CDATA[CVE-2026-5387 gives unauthenticated attackers admin access to pipeline simulation environments. CVSS 9.3 - affects oil, gas, and chemical sectors.]]></description>
            <link>https://www.probablypwned.com/article/aveva-pipeline-simulation-cve-2026-5387-ics-critical-infrastructure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aveva-pipeline-simulation-cve-2026-5387-ics-critical-infrastructure</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AVEVA]]></category>
            <category><![CDATA[CVE-2026-5387]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[SCADA]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[oil and gas]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 19 Apr 2026 12:09:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Payouts King Ransomware Hides Inside QEMU VMs to Dodge Endpoint Security]]></title>
            <description><![CDATA[New ransomware operation linked to ex-BlackBasta affiliates runs Alpine Linux VMs on compromised hosts. Endpoint tools can't see inside the VM boundary.]]></description>
            <link>https://www.probablypwned.com/article/payouts-king-ransomware-qemu-vm-evasion-blackbasta</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/payouts-king-ransomware-qemu-vm-evasion-blackbasta</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Payouts King]]></category>
            <category><![CDATA[QEMU]]></category>
            <category><![CDATA[BlackBasta]]></category>
            <category><![CDATA[evasion techniques]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 19 Apr 2026 12:09:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[April Patch Breaks Windows Domain Controllers — LSASS Crashes Trigger Reboot Loops]]></title>
            <description><![CDATA[Microsoft's KB5082063 causes LSASS crashes on non-Global Catalog domain controllers using PAM. Affected servers stuck in restart loops - no fix yet.]]></description>
            <link>https://www.probablypwned.com/article/windows-domain-controller-lsass-crash-kb5082063-april-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/windows-domain-controller-lsass-crash-kb5082063-april-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Windows Server]]></category>
            <category><![CDATA[domain controller]]></category>
            <category><![CDATA[LSASS]]></category>
            <category><![CDATA[patch tuesday]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 19 Apr 2026 12:08:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SAP Patches 9.9-Severity SQL Injection in BPC and Business Warehouse]]></title>
            <description><![CDATA[CVE-2026-27681 allows low-privileged users to execute arbitrary SQL commands in SAP Business Planning and Consolidation. CVSS 9.9 - patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/sap-bpc-bw-cve-2026-27681-sql-injection-cvss-9-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sap-bpc-bw-cve-2026-27681-sql-injection-cvss-9-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SAP]]></category>
            <category><![CDATA[CVE-2026-27681]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[patch tuesday]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 19 Apr 2026 12:07:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Protobuf.js RCE Flaw Threatens 50 Million Weekly npm Downloads]]></title>
            <description><![CDATA[Critical code injection vulnerability (GHSA-xq3m-2v4x-88gg, CVSS 9.9) in protobuf.js allows arbitrary JavaScript execution via malicious schemas. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/protobufjs-ghsa-xq3m-rce-50-million-npm-downloads</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/protobufjs-ghsa-xq3m-rce-50-million-npm-downloads</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[protobuf.js]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[JavaScript]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 18 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Sanctioned Grinex Exchange Claims $13M Hack by Western Spies]]></title>
            <description><![CDATA[Russia-linked crypto exchange Grinex halts operations after $13 million theft, blaming 'Western special services.' Blockchain analysts find no evidence supporting the attribution.]]></description>
            <link>https://www.probablypwned.com/article/grinex-crypto-exchange-13m-hack-western-intelligence-claims</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/grinex-crypto-exchange-13m-hack-western-intelligence-claims</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Grinex]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[sanctions]]></category>
            <category><![CDATA[state-sponsored]]></category>
            <category><![CDATA[attribution]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 18 Apr 2026 12:08:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Thymeleaf SSTI Flaw Enables Java RCE via Template Injection]]></title>
            <description><![CDATA[CVE-2026-40478 bypasses Thymeleaf's expression protections, allowing attackers to execute arbitrary Java code through crafted template input. Upgrade to 3.1.4.RELEASE now.]]></description>
            <link>https://www.probablypwned.com/article/thymeleaf-cve-2026-40478-ssti-bypass-java-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/thymeleaf-cve-2026-40478-ssti-bypass-java-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Thymeleaf]]></category>
            <category><![CDATA[CVE-2026-40478]]></category>
            <category><![CDATA[SSTI]]></category>
            <category><![CDATA[Java]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[template injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 18 Apr 2026 12:07:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NIST Drops NVD Enrichment for Most CVEs After 263% Surge]]></title>
            <description><![CDATA[NIST will only enrich CVEs in CISA KEV, federal software, or critical infrastructure. Pre-March 2026 backlog moved to 'Not Scheduled.' Here's what security teams need to know.]]></description>
            <link>https://www.probablypwned.com/article/nist-nvd-cve-enrichment-prioritization-changes-april-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nist-nvd-cve-enrichment-prioritization-changes-april-2026</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[NIST]]></category>
            <category><![CDATA[NVD]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[vulnerability management]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[patch prioritization]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 18 Apr 2026 12:06:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiSandbox Auth Bypass and RCE Flaws Score CVSS 9.1]]></title>
            <description><![CDATA[Fortinet patches two critical FortiSandbox vulnerabilities allowing unauthenticated attackers to bypass authentication and execute code. Upgrade to 4.4.9 or 5.0.6 immediately.]]></description>
            <link>https://www.probablypwned.com/article/fortisandbox-cve-2026-39813-39808-critical-auth-bypass-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortisandbox-cve-2026-39813-39808-critical-auth-bypass-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiSandbox]]></category>
            <category><![CDATA[CVE-2026-39813]]></category>
            <category><![CDATA[CVE-2026-39808]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 18 Apr 2026 12:05:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RedSun: Second Windows Defender Zero-Day Drops in Two Weeks]]></title>
            <description><![CDATA[Frustrated researcher 'Chaotic Eclipse' releases RedSun, another Windows Defender privilege escalation exploit granting SYSTEM access. Microsoft has not yet patched this second zero-day.]]></description>
            <link>https://www.probablypwned.com/article/redsun-windows-defender-zero-day-chaotic-eclipse-system-privileges</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/redsun-windows-defender-zero-day-chaotic-eclipse-system-privileges</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Windows Defender]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[RedSun]]></category>
            <category><![CDATA[Chaotic Eclipse]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 17 Apr 2026 12:06:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ZionSiphon Malware Targets Israeli Water Treatment Systems]]></title>
            <description><![CDATA[Darktrace researchers expose ZionSiphon, OT malware designed to sabotage chlorine levels and pressure controls at Israeli desalination plants. A coding error currently prevents activation.]]></description>
            <link>https://www.probablypwned.com/article/zionsiphon-ot-malware-water-treatment-desalination-israel</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zionsiphon-ot-malware-water-treatment-desalination-israel</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ZionSiphon]]></category>
            <category><![CDATA[OT]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[water treatment]]></category>
            <category><![CDATA[Israel]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 17 Apr 2026 12:05:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UAC-0247 Targets Ukrainian Hospitals With Data-Theft Malware]]></title>
            <description><![CDATA[CERT-UA warns of ongoing campaign hitting Ukrainian clinics and government agencies with AGINGFLY backdoor. Attackers steal browser credentials, WhatsApp data, and deploy cryptominers.]]></description>
            <link>https://www.probablypwned.com/article/uac-0247-ukraine-hospitals-agingfly-malware-data-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uac-0247-ukraine-hospitals-agingfly-malware-data-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UAC-0247]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[AGINGFLY]]></category>
            <category><![CDATA[CERT-UA]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 17 Apr 2026 12:05:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3M Accounts]]></title>
            <description><![CDATA[International law enforcement operation takes down 53 DDoS-for-hire domains and exposes 3 million criminal user accounts. 21 countries participate in coordinated crackdown.]]></description>
            <link>https://www.probablypwned.com/article/operation-poweroff-ddos-takedown-53-domains-3-million-accounts</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-poweroff-ddos-takedown-53-domains-3-million-accounts</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[Europol]]></category>
            <category><![CDATA[Operation PowerOFF]]></category>
            <category><![CDATA[booter services]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 17 Apr 2026 12:04:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Nginx-UI Auth Bypass Under Active Exploit — 2,600 Servers at Risk]]></title>
            <description><![CDATA[CVE-2026-33032 lets attackers take full control of nginx-ui servers without credentials. Threat actors are exploiting it now. Upgrade to 2.3.4 immediately.]]></description>
            <link>https://www.probablypwned.com/article/nginx-ui-cve-2026-33032-mcpwn-auth-bypass-active-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nginx-ui-cve-2026-33032-mcpwn-auth-bypass-active-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-33032]]></category>
            <category><![CDATA[nginx-ui]]></category>
            <category><![CDATA[MCP]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[Pluto Security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 16 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Deploys Blockchain-Based ChainShell via Russian MaaS]]></title>
            <description><![CDATA[Iranian APT MuddyWater adopts Russian TAG-150 malware-as-a-service platform to deploy ChainShell RAT against Israeli targets. C2 addresses resolved via Ethereum smart contracts evade takedowns.]]></description>
            <link>https://www.probablypwned.com/article/muddywater-chainshell-russian-maas-ethereum-c2-israel</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/muddywater-chainshell-russian-maas-ethereum-c2-israel</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[ChainShell]]></category>
            <category><![CDATA[blockchain]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 16 Apr 2026 12:07:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NWHStealer Spreads via Fake Proton VPN Sites and Gaming Mods]]></title>
            <description><![CDATA[Multiple campaigns distribute NWHStealer infostealer through counterfeit Proton VPN installers, gaming modifications, and YouTube-promoted downloads. Targets browser data and 25+ crypto wallets.]]></description>
            <link>https://www.probablypwned.com/article/nwhstealer-fake-proton-vpn-gaming-mods-crypto-wallets</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nwhstealer-fake-proton-vpn-gaming-mods-crypto-wallets</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[NWHStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Proton VPN]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[gaming mods]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 16 Apr 2026 12:06:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Booking.com Breach Exposes Guest Reservation Data]]></title>
            <description><![CDATA[Booking.com confirms hackers accessed customer reservation data including names, emails, phone numbers, and booking details. Company resets PINs but won't disclose breach scope.]]></description>
            <link>https://www.probablypwned.com/article/booking-com-data-breach-reservation-data-phishing-risk</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/booking-com-data-breach-reservation-data-phishing-risk</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Booking.com]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[travel]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[personal data]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 16 Apr 2026 12:05:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[108 Chrome Extensions Steal OAuth Tokens and Telegram Sessions]]></title>
            <description><![CDATA[Security researchers expose 108 malicious Chrome extensions operating under five fake publishers, stealing Google OAuth tokens, Telegram sessions, and injecting ads. Over 20,000 users affected.]]></description>
            <link>https://www.probablypwned.com/article/chrome-extensions-108-malicious-oauth-telegram-session-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-extensions-108-malicious-oauth-telegram-session-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[session hijacking]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 16 Apr 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea's UNC5342 Hides Malware in Blockchain Smart Contracts]]></title>
            <description><![CDATA[Google researchers expose EtherHiding technique storing malware payloads in Ethereum and BNB smart contracts. First nation-state adoption of unkillable blockchain C2 infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/unc5342-etherhiding-blockchain-smart-contract-c2-north-korea</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unc5342-etherhiding-blockchain-smart-contract-c2-north-korea</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UNC5342]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[EtherHiding]]></category>
            <category><![CDATA[blockchain]]></category>
            <category><![CDATA[smart contracts]]></category>
            <category><![CDATA[JadeSnow]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 15 Apr 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Omnistealer: North Korean Malware Hides C2 in Blockchain]]></title>
            <description><![CDATA[eSentire researchers expose Omnistealer, a North Korean infostealer storing payloads in blockchain transactions. 300,000 credentials compromised across government and defense sectors.]]></description>
            <link>https://www.probablypwned.com/article/omnistealer-north-korea-blockchain-malware-300000-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/omnistealer-north-korea-blockchain-malware-300000-credentials</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Omnistealer]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[Lazarus Group]]></category>
            <category><![CDATA[blockchain]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 15 Apr 2026 12:09:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pushpaganda: AI-Generated Fake News Hijacks Google Discover]]></title>
            <description><![CDATA[HUMAN Security exposes Pushpaganda campaign using AI content to poison Google Discover feeds, generating 240 million fraudulent ad requests through scareware and fake news.]]></description>
            <link>https://www.probablypwned.com/article/pushpaganda-ai-ad-fraud-google-discover-240-million-scareware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pushpaganda-ai-ad-fraud-google-discover-240-million-scareware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[ad fraud]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[Google Discover]]></category>
            <category><![CDATA[scareware]]></category>
            <category><![CDATA[Pushpaganda]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 15 Apr 2026 12:07:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Basic-Fit Breach Exposes Bank Details for 1M Gym Members]]></title>
            <description><![CDATA[Dutch fitness chain Basic-Fit confirms hackers accessed bank account details, addresses, and personal data for up to 1 million members across six European countries.]]></description>
            <link>https://www.probablypwned.com/article/basic-fit-data-breach-1-million-members-bank-details-europe</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/basic-fit-data-breach-1-million-members-bank-details-europe</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Basic-Fit]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Europe]]></category>
            <category><![CDATA[financial data]]></category>
            <category><![CDATA[fitness]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 15 Apr 2026 12:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches 167 Flaws, SharePoint Zero-Day Under Attack]]></title>
            <description><![CDATA[Microsoft's April 2026 Patch Tuesday fixes 167 vulnerabilities including CVE-2026-32201, an actively exploited SharePoint zero-day. Eight critical RCE flaws patched.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-patch-tuesday-april-2026-167-cves-sharepoint-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-patch-tuesday-april-2026-167-cves-sharepoint-zero-day</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[SharePoint]]></category>
            <category><![CDATA[CVE-2026-32201]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 15 Apr 2026 12:05:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Ledger Live on App Store Drains $9.5M in One Week]]></title>
            <description><![CDATA[A fraudulent Ledger Live app distributed through Apple's Mac App Store stole $9.5M from 50+ victims who entered seed phrases. ZachXBT traced funds to KuCoin.]]></description>
            <link>https://www.probablypwned.com/article/fake-ledger-live-app-store-9-5m-crypto-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fake-ledger-live-app-store-9-5m-crypto-theft</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[Ledger]]></category>
            <category><![CDATA[seed phrase theft]]></category>
            <category><![CDATA[App Store security]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 14 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Seizes W3LL Phishing Kit, Developer Arrested in Indonesia]]></title>
            <description><![CDATA[Joint FBI-Indonesian operation dismantles W3LL phishing platform behind $20M in fraud attempts. Developer arrested after 25,000+ stolen accounts sold since 2019.]]></description>
            <link>https://www.probablypwned.com/article/fbi-w3ll-phishing-takedown-indonesia-20-million-fraud</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-w3ll-phishing-takedown-indonesia-20-million-fraud</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[W3LL]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[phishing-as-a-service]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[BEC]]></category>
            <category><![CDATA[law enforcement]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 13 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Totolink Router Flaw Allows Unauthenticated RCE (CVE-2026-6140)]]></title>
            <description><![CDATA[Critical CVSS 9.8 command injection vulnerability in Totolink A7100RU routers enables unauthenticated remote code execution. Public exploit available, no patch released.]]></description>
            <link>https://www.probablypwned.com/article/totolink-a7100ru-cve-2026-6140-command-injection-cvss-9-8</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/totolink-a7100ru-cve-2026-6140-command-injection-cvss-9-8</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Totolink]]></category>
            <category><![CDATA[CVE-2026-6140]]></category>
            <category><![CDATA[router]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[IoT]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 13 Apr 2026 12:07:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI: Cybercrime Losses Hit $20.9B in 2025, Up 26%]]></title>
            <description><![CDATA[FBI IC3 2025 report reveals record $20.9 billion in cybercrime losses. Investment fraud tops $8.6B, cryptocurrency scams reach $11.4B, and ransomware losses surge 259%.]]></description>
            <link>https://www.probablypwned.com/article/fbi-ic3-2025-report-20-billion-cybercrime-losses</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-ic3-2025-report-20-billion-cybercrime-losses</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[IC3]]></category>
            <category><![CDATA[cybercrime]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[BEC]]></category>
            <category><![CDATA[statistics]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 13 Apr 2026 12:06:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UNC6783 Targets BPOs to Breach Adobe, Dozens of Enterprises]]></title>
            <description><![CDATA[Google warns of UNC6783 threat actor using Okta and Zendesk phishing to breach BPO providers, stealing 13M Adobe support tickets and bug bounty data. FIDO2 keys recommended.]]></description>
            <link>https://www.probablypwned.com/article/unc6783-mr-raccoon-bpo-targeting-adobe-zendesk-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unc6783-mr-raccoon-bpo-targeting-adobe-zendesk-breach</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UNC6783]]></category>
            <category><![CDATA[BPO]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Okta]]></category>
            <category><![CDATA[Zendesk]]></category>
            <category><![CDATA[Adobe]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 13 Apr 2026 12:06:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Breaches Rockstar Games via Anodot Token Theft]]></title>
            <description><![CDATA[GTA 6 developer Rockstar Games confirms third-party breach after ShinyHunters stole Snowflake credentials through Anodot. Ransom deadline set for April 14.]]></description>
            <link>https://www.probablypwned.com/article/rockstar-games-shinyhunters-breach-anodot-snowflake-gta</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/rockstar-games-shinyhunters-breach-anodot-snowflake-gta</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Rockstar Games]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Snowflake]]></category>
            <category><![CDATA[Anodot]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[GTA 6]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 12 Apr 2026 12:08:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome 146 Ships Device-Bound Sessions to Kill Cookie Theft]]></title>
            <description><![CDATA[Google's DBSC ties authentication cookies to hardware TPM chips, making stolen sessions worthless. Chrome 146 for Windows now protects against infostealer attacks.]]></description>
            <link>https://www.probablypwned.com/article/chrome-146-dbsc-device-bound-session-credentials-cookie-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-146-dbsc-device-bound-session-credentials-cookie-theft</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[DBSC]]></category>
            <category><![CDATA[Device Bound Session Credentials]]></category>
            <category><![CDATA[cookie theft]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[TPM]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sun, 12 Apr 2026 12:07:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Storm-2755 Steals Canadian Paychecks via SEO Poisoning]]></title>
            <description><![CDATA[Microsoft tracks Storm-2755 'Payroll Pirate' using poisoned search results and AiTM phishing to hijack Canadian employee direct deposits. HR systems compromised.]]></description>
            <link>https://www.probablypwned.com/article/storm-2755-payroll-pirate-canadian-employee-salary-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/storm-2755-payroll-pirate-canadian-employee-salary-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Storm-2755]]></category>
            <category><![CDATA[Payroll Pirate]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <category><![CDATA[AiTM]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 12 Apr 2026 12:07:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Adobe Patches Acrobat Zero-Day Under Active Attack Since December]]></title>
            <description><![CDATA[CVE-2026-34621 is a prototype pollution flaw in Adobe Acrobat Reader with a CVSS 8.6 score. Active exploitation began in December 2025. Update immediately.]]></description>
            <link>https://www.probablypwned.com/article/adobe-acrobat-cve-2026-34621-prototype-pollution-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/adobe-acrobat-cve-2026-34621-prototype-pollution-zero-day</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Adobe]]></category>
            <category><![CDATA[CVE-2026-34621]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Acrobat Reader]]></category>
            <category><![CDATA[prototype pollution]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 12 Apr 2026 12:06:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Operation Atlantic Freezes $12M, Identifies 20K Crypto Victims]]></title>
            <description><![CDATA[US, UK, and Canadian law enforcement froze $12 million in stolen crypto and identified 20,000 victims of approval phishing scams in week-long crackdown.]]></description>
            <link>https://www.probablypwned.com/article/operation-atlantic-45m-crypto-fraud-12m-frozen-20000-victims</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-atlantic-45m-crypto-fraud-12m-frozen-20000-victims</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Operation Atlantic]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[approval phishing]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[pig butchering]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 11 Apr 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EngageSDK Flaw Exposed 30M Crypto Wallet Users on Android]]></title>
            <description><![CDATA[Microsoft found an intent redirection vulnerability in EngageLab's Android SDK affecting 50M+ app installs. Crypto wallets with 30M users were at risk.]]></description>
            <link>https://www.probablypwned.com/article/engagesdk-android-intent-redirection-50m-users-crypto-wallets</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/engagesdk-android-intent-redirection-50m-users-crypto-wallets</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[SDK vulnerability]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[intent redirection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 11 Apr 2026 12:07:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Atomic Stealer Pivots to Script Editor After Apple Blocks Terminal]]></title>
            <description><![CDATA[ClickFix attackers bypass macOS 26.4 Terminal paste scanning by using applescript:// URLs to launch Script Editor. Same payload, new delivery vector.]]></description>
            <link>https://www.probablypwned.com/article/atomic-stealer-script-editor-clickfix-macos-terminal-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/atomic-stealer-script-editor-clickfix-macos-terminal-bypass</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Atomic Stealer]]></category>
            <category><![CDATA[AMOS]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 11 Apr 2026 12:06:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ChipSoft Ransomware Hits 70% of Dutch Hospital Systems]]></title>
            <description><![CDATA[Ransomware attack on ChipSoft forces 11 Dutch hospitals offline. The vendor manages patient records for most of the Netherlands. Attacker unknown.]]></description>
            <link>https://www.probablypwned.com/article/chipsoft-ransomware-dutch-hospitals-patient-records-11-facilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chipsoft-ransomware-dutch-hospitals-patient-records-11-facilities</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[ChipSoft]]></category>
            <category><![CDATA[Netherlands]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 11 Apr 2026 12:05:39 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Marimo RCE Exploited 10 Hours After Disclosure—CISA Adds to KEV]]></title>
            <description><![CDATA[CVE-2026-39987 in Marimo Python notebooks allows unauthenticated RCE via terminal WebSocket. Attackers weaponized it within hours. Patch to 0.23.0 now.]]></description>
            <link>https://www.probablypwned.com/article/marimo-cve-2026-39987-rce-exploited-10-hours-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/marimo-cve-2026-39987-rce-exploited-10-hours-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-39987]]></category>
            <category><![CDATA[Marimo]]></category>
            <category><![CDATA[Python]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 11 Apr 2026 12:04:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CPUID Hijacked: CPU-Z, HWMonitor Downloads Served Malware]]></title>
            <description><![CDATA[Attackers compromised CPUID's website API for six hours, redirecting CPU-Z and HWMonitor downloads to trojanized installers that steal browser credentials using advanced evasion techniques.]]></description>
            <link>https://www.probablypwned.com/article/cpuid-supply-chain-attack-cpu-z-hwmonitor-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cpuid-supply-chain-attack-cpu-z-hwmonitor-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[CPUID]]></category>
            <category><![CDATA[CPU-Z]]></category>
            <category><![CDATA[HWMonitor]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mercor Breach Exposes 4TB of AI Training Data After LiteLLM Attack]]></title>
            <description><![CDATA[AI startup Mercor confirms breach via LiteLLM supply chain attack. Lapsus$ claims 4TB stolen including candidate data, source code, and API keys. Meta pauses contracts.]]></description>
            <link>https://www.probablypwned.com/article/mercor-data-breach-4tb-litellm-supply-chain-lapsus</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mercor-data-breach-4tb-litellm-supply-chain-lapsus</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Mercor]]></category>
            <category><![CDATA[LiteLLM]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[Lapsus$]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 12:06:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Breach Anodot, Steal Data From Snowflake Customers]]></title>
            <description><![CDATA[ShinyHunters compromised SaaS analytics provider Anodot, using stolen authentication tokens to access and exfiltrate data from dozens of Snowflake customers.]]></description>
            <link>https://www.probablypwned.com/article/anodot-breach-shinyhunters-snowflake-customers-token-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/anodot-breach-shinyhunters-snowflake-customers-token-theft</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Anodot]]></category>
            <category><![CDATA[Snowflake]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SaaS]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 12:05:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Deploys PRISMEX Malware Against Ukraine and NATO Allies]]></title>
            <description><![CDATA[Russian GRU's APT28 uses new PRISMEX malware suite with steganography and COM hijacking to target Ukraine defense and NATO logistics. Includes wiper capability.]]></description>
            <link>https://www.probablypwned.com/article/apt28-prismex-malware-ukraine-nato-steganography-sabotage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-prismex-malware-ukraine-nato-steganography-sabotage</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[PRISMEX]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[NATO]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 12:05:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Disrupts APT28's FrostArmada Router Hijacking Campaign]]></title>
            <description><![CDATA[FBI-led Operation Masquerade dismantled Russia's GRU-linked FrostArmada, which compromised 18,000+ routers to steal Microsoft 365 credentials via DNS hijacking.]]></description>
            <link>https://www.probablypwned.com/article/apt28-frostarmada-dns-hijacking-18000-routers-disrupted</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-frostarmada-dns-hijacking-18000-routers-disrupted</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[FrostArmada]]></category>
            <category><![CDATA[DNS hijacking]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[FBI]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 10 Apr 2026 12:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Smart Slider Hijacked: 900K WordPress Sites Get Backdoored]]></title>
            <description><![CDATA[Attackers compromised Nextend's update infrastructure to push a malicious Smart Slider 3 Pro version with four layers of backdoors. Here's who's affected and how to recover.]]></description>
            <link>https://www.probablypwned.com/article/smart-slider-supply-chain-attack-900k-wordpress-backdoors</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smart-slider-supply-chain-attack-900k-wordpress-backdoors</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[Joomla]]></category>
            <category><![CDATA[Smart Slider]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 14:32:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LAPD Records Exposed in City Attorney Breach: 337K Files Leaked]]></title>
            <description><![CDATA[World Leaks gang dumps 7TB of sensitive police data including personnel files and Internal Affairs investigations after breaching LA City Attorney's Office.]]></description>
            <link>https://www.probablypwned.com/article/lapd-data-breach-337000-files-world-leaks-city-attorney-hack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lapd-data-breach-337000-files-world-leaks-city-attorney-hack</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[LAPD]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[World Leaks]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[government breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:07:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Bitcoin Depot Discloses $3.6M Bitcoin Theft in SEC Filing]]></title>
            <description><![CDATA[Attackers stole 50.9 BTC from company wallets after obtaining settlement account credentials. Second security incident for the crypto ATM operator since 2023.]]></description>
            <link>https://www.probablypwned.com/article/bitcoin-depot-hack-3-6-million-btc-stolen-sec-8k-filing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bitcoin-depot-hack-3-6-million-btc-stolen-sec-8k-filing</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Bitcoin Depot]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SEC filing]]></category>
            <category><![CDATA[wallet theft]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:07:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Movable Type RCE Lets Attackers Execute Arbitrary Perl Code]]></title>
            <description><![CDATA[CVE-2026-25776 (CVSS 9.8) enables remote code execution through Movable Type's Listing Framework. Affects versions 6.0+. Patches available for MT 9, 8.8, 8.0.]]></description>
            <link>https://www.probablypwned.com/article/movable-type-cve-2026-25776-perl-code-injection-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/movable-type-cve-2026-25776-perl-code-injection-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-25776]]></category>
            <category><![CDATA[Movable Type]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Perl]]></category>
            <category><![CDATA[CMS]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:06:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Spreads 1,700 Malicious Packages Across npm, PyPI, Go, Rust]]></title>
            <description><![CDATA[Contagious Interview campaign escalates with trojanized developer tools across five ecosystems. Packages impersonate logging utilities and steal credentials.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-contagious-interview-1700-malicious-packages-npm-pypi-go-rust</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-contagious-interview-1700-malicious-packages-npm-pypi-go-rust</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[Contagious Interview]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:06:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Second PraisonAI Sandbox Escape in a Week Scores CVSS 9.9]]></title>
            <description><![CDATA[CVE-2026-39888 bypasses PraisonAI's Python sandbox via exception frame traversal. Attackers chain __traceback__ attributes to reach exec(). Patch to 1.5.115.]]></description>
            <link>https://www.probablypwned.com/article/praisonai-cve-2026-39888-sandbox-escape-exception-frame-traversal</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/praisonai-cve-2026-39888-sandbox-escape-exception-frame-traversal</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-39888]]></category>
            <category><![CDATA[PraisonAI]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:05:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Anthropic Restricts Claude Mythos Over Vulnerability-Finding Power]]></title>
            <description><![CDATA[Project Glasswing partners Amazon, Microsoft, Cisco to hunt zero-days with an AI model too dangerous for public release. Thousands of flaws already found.]]></description>
            <link>https://www.probablypwned.com/article/anthropic-project-glasswing-claude-mythos-vulnerability-hunting</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/anthropic-project-glasswing-claude-mythos-vulnerability-hunting</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[Claude Mythos]]></category>
            <category><![CDATA[Project Glasswing]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[vulnerability research]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 09 Apr 2026 12:04:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[13-Year-Old ActiveMQ Bug Found by Claude AI Enables RCE]]></title>
            <description><![CDATA[CVE-2026-34197 exposes Apache ActiveMQ to remote code execution via the Jolokia API. Horizon3 researcher used Claude to uncover the flaw in under 10 minutes. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/activemq-cve-2026-34197-rce-jolokia-claude-ai-discovery</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/activemq-cve-2026-34197-rce-jolokia-claude-ai-discovery</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache ActiveMQ]]></category>
            <category><![CDATA[CVE-2026-34197]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Jolokia]]></category>
            <category><![CDATA[AI security research]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 08 Apr 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ComfyUI Servers Hijacked for Monero Mining and Proxy Botnet]]></title>
            <description><![CDATA[Over 1,000 exposed ComfyUI instances targeted by cryptomining campaign. Attackers exploit custom nodes for RCE, deploy XMRig and Hysteria V2 botnet with persistence.]]></description>
            <link>https://www.probablypwned.com/article/comfyui-cryptominer-botnet-1000-servers-compromised</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/comfyui-cryptominer-botnet-1000-servers-compromised</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ComfyUI]]></category>
            <category><![CDATA[cryptominer]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[XMRig]]></category>
            <category><![CDATA[stable diffusion]]></category>
            <category><![CDATA[AI infrastructure]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 08 Apr 2026 12:05:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI, CISA Warn Iran Is Attacking US Water and Energy PLCs]]></title>
            <description><![CDATA[Joint advisory AA26-097A details Iranian APT targeting Rockwell Allen-Bradley controllers across critical infrastructure. Attacks caused operational disruptions since March 2026.]]></description>
            <link>https://www.probablypwned.com/article/cisa-aa26-097a-iran-plc-attacks-water-energy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-aa26-097a-iran-plc-attacks-water-energy</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[PLC]]></category>
            <category><![CDATA[Rockwell Automation]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[CyberAv3ngers]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 08 Apr 2026 12:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Docker Auth Bypass Gives Attackers Full Host Access]]></title>
            <description><![CDATA[CVE-2026-34040 lets attackers bypass Docker authorization plugins with a single padded HTTP request. CVSS 8.8 flaw patched in Engine 29.3.1.]]></description>
            <link>https://www.probablypwned.com/article/docker-cve-2026-34040-authz-bypass-host-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/docker-cve-2026-34040-authz-bypass-host-access</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[CVE-2026-34040]]></category>
            <category><![CDATA[container security]]></category>
            <category><![CDATA[authorization bypass]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 08 Apr 2026 12:04:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran-Linked Hackers Spray 300+ Israeli M365 Tenants]]></title>
            <description><![CDATA[Check Point tracks an Iran-nexus campaign targeting Microsoft 365 accounts across 300+ Israeli organizations and 25+ UAE entities. Attackers use Tor exit nodes and Israeli VPNs to evade detection.]]></description>
            <link>https://www.probablypwned.com/article/iran-password-spraying-microsoft-365-israel-uae-300-orgs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-password-spraying-microsoft-365-israel-uae-300-orgs</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[password spraying]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[Israel]]></category>
            <category><![CDATA[cloud security]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:52:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Storm-1175 Deploys Medusa Ransomware Within 24 Hours of Access]]></title>
            <description><![CDATA[Microsoft links China-based Storm-1175 to high-velocity Medusa ransomware attacks exploiting zero-day vulnerabilities. Healthcare, education, and finance sectors hit across Australia, UK, and US.]]></description>
            <link>https://www.probablypwned.com/article/storm-1175-medusa-ransomware-zero-day-china-24-hours</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/storm-1175-medusa-ransomware-zero-day-china-24-hours</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Storm-1175]]></category>
            <category><![CDATA[Medusa]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:51:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[36 Fake Strapi Plugins Deploy Redis RCE and Credential Stealers]]></title>
            <description><![CDATA[Coordinated npm supply chain attack deploys 36 malicious packages masquerading as Strapi CMS plugins. Attackers target cryptocurrency platforms with Redis exploitation, credential harvesting, and persistent backdoors.]]></description>
            <link>https://www.probablypwned.com/article/malicious-strapi-npm-packages-redis-postgresql-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/malicious-strapi-npm-packages-redis-postgresql-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Strapi]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:49:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Flowise AI Builder RCE Hits CVSS 10 — 12,000 Servers Exposed]]></title>
            <description><![CDATA[Critical code injection vulnerability CVE-2025-59528 in Flowise AI agent builder scores maximum CVSS 10.0 and is under active exploitation. Over 12,000 instances are publicly accessible.]]></description>
            <link>https://www.probablypwned.com/article/flowise-ai-cve-2025-59528-cvss-10-rce-12000-instances</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/flowise-ai-cve-2025-59528-cvss-10-rce-12000-instances</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Flowise]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVE-2025-59528]]></category>
            <category><![CDATA[code injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:48:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BlueHammer: Researcher Leaks Unpatched Windows Zero-Day Exploit]]></title>
            <description><![CDATA[Security researcher releases working proof-of-concept for BlueHammer, an unpatched Windows Defender privilege escalation flaw enabling SYSTEM access via TOCTOU and path confusion vulnerabilities.]]></description>
            <link>https://www.probablypwned.com/article/bluehammer-windows-defender-zero-day-lpe-exploit-leak</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bluehammer-windows-defender-zero-day-lpe-exploit-leak</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Windows Defender]]></category>
            <category><![CDATA[exploit]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:46:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GPUBreach Exploits GDDR6 Rowhammer for Full System Takeover]]></title>
            <description><![CDATA[University of Toronto researchers demonstrate GPUBreach, a GPU rowhammer attack that bypasses IOMMU protections to achieve root access on systems with NVIDIA GPUs. Consumer GPUs remain unmitigated.]]></description>
            <link>https://www.probablypwned.com/article/gpubreach-gpu-rowhammer-gddr6-privilege-escalation-nvidia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gpubreach-gpu-rowhammer-gddr6-privilege-escalation-nvidia</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[GPU security]]></category>
            <category><![CDATA[rowhammer]]></category>
            <category><![CDATA[NVIDIA]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[hardware vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 07 Apr 2026 12:45:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Feds to Patch FortiClient EMS Flaw by Thursday]]></title>
            <description><![CDATA[CISA adds CVE-2026-35616 to KEV catalog with April 9 deadline for federal agencies. Nearly 2,000 FortiClient EMS instances remain exposed as exploitation continues.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-forticlient-ems-cve-2026-35616-federal-deadline-april-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-forticlient-ems-cve-2026-35616-federal-deadline-april-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiClient EMS]]></category>
            <category><![CDATA[CVE-2026-35616]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[federal mandate]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 16:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ImageMagick Zero-Days Enable RCE on Linux, WordPress via Image Upload]]></title>
            <description><![CDATA[AI-discovered vulnerabilities bypass all security policies including 'secure' mode. Most servers won't receive fixes until 2027 without manual intervention.]]></description>
            <link>https://www.probablypwned.com/article/imagemagick-zero-day-rce-linux-wordpress-magic-byte-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/imagemagick-zero-day-rce-linux-wordpress-magic-byte-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ImageMagick]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[image processing]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 12:06:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Group-Office Deserialization Bug Enables Server Takeover (CVSS 9.9)]]></title>
            <description><![CDATA[CVE-2026-34838 lets authenticated attackers achieve RCE on Group-Office CRM servers via insecure deserialization. Upgrade to patched versions immediately.]]></description>
            <link>https://www.probablypwned.com/article/group-office-cve-2026-34838-deserialization-rce-cvss-9-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/group-office-cve-2026-34838-deserialization-rce-cvss-9-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Group-Office]]></category>
            <category><![CDATA[CVE-2026-34838]]></category>
            <category><![CDATA[deserialization]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CRM]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 12:05:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Progress ShareFile Flaws Chain to Pre-Auth RCE on 30,000 Servers]]></title>
            <description><![CDATA[CVE-2026-2699 and CVE-2026-2701 combine to let unauthenticated attackers take over ShareFile Storage Zone Controllers. Patches available since March 10.]]></description>
            <link>https://www.probablypwned.com/article/progress-sharefile-cve-2026-2699-2701-pre-auth-rce-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/progress-sharefile-cve-2026-2699-2701-pre-auth-rce-chain</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Progress]]></category>
            <category><![CDATA[ShareFile]]></category>
            <category><![CDATA[CVE-2026-2699]]></category>
            <category><![CDATA[CVE-2026-2701]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[pre-auth]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 12:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Patches Dual 9.8 CVSS Flaws in IMC and SSM On-Prem]]></title>
            <description><![CDATA[CVE-2026-20093 and CVE-2026-20160 let unauthenticated attackers take full control of Cisco UCS servers and licensing infrastructure. No workarounds exist.]]></description>
            <link>https://www.probablypwned.com/article/cisco-imc-ssm-cve-2026-20093-20160-critical-auth-bypass-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-imc-ssm-cve-2026-20093-20160-critical-auth-bypass-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20093]]></category>
            <category><![CDATA[CVE-2026-20160]]></category>
            <category><![CDATA[IMC]]></category>
            <category><![CDATA[SSM]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 06 Apr 2026 12:04:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiClient EMS Zero-Day Under Active Exploit — Patch Now]]></title>
            <description><![CDATA[CVE-2026-35616 lets attackers bypass API authentication in FortiClient EMS 7.4.5-7.4.6 for unauthenticated RCE. Exploitation began March 31. Emergency hotfixes available.]]></description>
            <link>https://www.probablypwned.com/article/forticlient-ems-cve-2026-35616-zero-day-api-bypass-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/forticlient-ems-cve-2026-35616-zero-day-api-bypass-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiClient EMS]]></category>
            <category><![CDATA[CVE-2026-35616]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[API bypass]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Casbaneiro Banking Trojan Spreads via Dynamic PDF Phishing]]></title>
            <description><![CDATA[Brazilian threat actor Augmented Marauder targets Latin America and Europe with Casbaneiro banking trojan, using dynamically generated court summons PDFs and Horabot for worm-like propagation.]]></description>
            <link>https://www.probablypwned.com/article/casbaneiro-banking-trojan-latin-america-horabot-phishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/casbaneiro-banking-trojan-latin-america-horabot-phishing</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Casbaneiro]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[Latin America]]></category>
            <category><![CDATA[Horabot]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Brazil]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:07:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Warns of WhatsApp-Delivered VBS Malware Campaign]]></title>
            <description><![CDATA[Microsoft Defender Experts identify multi-stage malware campaign using WhatsApp messages to deliver VBS scripts that bypass UAC and establish persistent Windows backdoors.]]></description>
            <link>https://www.probablypwned.com/article/whatsapp-vbs-malware-microsoft-warning-uac-bypass-windows</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/whatsapp-vbs-malware-microsoft-warning-uac-bypass-windows</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[VBS malware]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[UAC bypass]]></category>
            <category><![CDATA[Windows malware]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hims & Hers Discloses Breach After Zendesk System Compromise]]></title>
            <description><![CDATA[Telehealth company Hims & Hers reveals data breach affecting customer support tickets. ShinyHunters gang exploited Okta SSO to access Zendesk platform.]]></description>
            <link>https://www.probablypwned.com/article/hims-hers-data-breach-zendesk-okta-shinyhunters</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hims-hers-data-breach-zendesk-okta-shinyhunters</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Hims & Hers]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Zendesk]]></category>
            <category><![CDATA[Okta]]></category>
            <category><![CDATA[healthcare]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:06:04 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[KadNap Botnet Hijacks 14,000+ ASUS Routers for Proxy Network]]></title>
            <description><![CDATA[Security researchers expose KadNap malware targeting ASUS routers to build a criminal proxy network. 60% of infected devices located in the US, linked to Doppelganger service.]]></description>
            <link>https://www.probablypwned.com/article/kadnap-botnet-asus-routers-14000-devices-proxy-network</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kadnap-botnet-asus-routers-14000-devices-proxy-network</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[ASUS]]></category>
            <category><![CDATA[router malware]]></category>
            <category><![CDATA[proxy network]]></category>
            <category><![CDATA[KadNap]]></category>
            <category><![CDATA[IoT security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SparkCat Crypto Stealer Returns to iOS and Android App Stores]]></title>
            <description><![CDATA[Kaspersky discovers new SparkCat malware variants on Apple App Store and Google Play that use OCR to steal cryptocurrency wallet recovery phrases from photo galleries.]]></description>
            <link>https://www.probablypwned.com/article/sparkcat-malware-app-store-google-play-crypto-ocr-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sparkcat-malware-app-store-google-play-crypto-ocr-stealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[SparkCat]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[mobile malware]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 05 Apr 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Sinobi Ransomware Hits 215 Victims in Six Months]]></title>
            <description><![CDATA[Sinobi, a suspected Lynx/INC rebrand, has grown from 40 victims to 215 since September 2025. The RaaS operation targets US midmarket companies with hybrid Curve25519/AES encryption.]]></description>
            <link>https://www.probablypwned.com/article/sinobi-ransomware-lynx-rebrand-215-victims-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sinobi-ransomware-lynx-rebrand-215-victims-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Sinobi]]></category>
            <category><![CDATA[RaaS]]></category>
            <category><![CDATA[Lynx]]></category>
            <category><![CDATA[INC ransomware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:05:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Phantom Taurus Deploys Net-Star Backdoors Across Africa]]></title>
            <description><![CDATA[Unit 42 exposes Phantom Taurus, a Chinese APT targeting embassies and foreign ministries with fileless NET-STAR malware. The group resurfaces within hours after discovery.]]></description>
            <link>https://www.probablypwned.com/article/phantom-taurus-net-star-china-apt-africa-middle-east</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/phantom-taurus-net-star-china-apt-africa-middle-east</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Phantom Taurus]]></category>
            <category><![CDATA[Net-Star]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:04:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Behind $285M Drift Protocol Heist]]></title>
            <description><![CDATA[Solana's Drift Protocol lost $285 million in 2026's largest DeFi hack. TRM Labs attributes the attack to North Korean actors who exploited oracle manipulation and pre-signed transactions.]]></description>
            <link>https://www.probablypwned.com/article/drift-protocol-285-million-hack-north-korea-defi</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/drift-protocol-285-million-hack-north-korea-defi</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[DeFi]]></category>
            <category><![CDATA[Solana]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Drift Protocol]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:04:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Claude Code Repos Push Vidar Infostealer on GitHub]]></title>
            <description><![CDATA[Threat actors weaponized Anthropic's accidental source code leak to distribute Vidar malware through trojanized GitHub repos. Here's how the attack works.]]></description>
            <link>https://www.probablypwned.com/article/claude-code-leak-vidar-infostealer-github-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/claude-code-leak-vidar-infostealer-github-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[Claude Code]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:03:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PraisonAI Sandbox Bypass Scores Perfect CVSS 10]]></title>
            <description><![CDATA[CVE-2026-34938 lets attackers escape PraisonAI's three-layer Python sandbox to execute arbitrary OS commands. CVSS 10 — patch to version 1.5.90 immediately.]]></description>
            <link>https://www.probablypwned.com/article/praisonai-cve-2026-34938-sandbox-bypass-rce-cvss-10</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/praisonai-cve-2026-34938-sandbox-bypass-rce-cvss-10</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-34938]]></category>
            <category><![CDATA[PraisonAI]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 04 Apr 2026 12:03:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Hits German Left Party Amid Hybrid War Fears]]></title>
            <description><![CDATA[Die Linke confirms Qilin stole internal data and employee info from party headquarters. Officials suggest attack may be politically motivated hybrid warfare.]]></description>
            <link>https://www.probablypwned.com/article/qilin-ransomware-die-linke-german-political-party-hybrid-warfare</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/qilin-ransomware-die-linke-german-political-party-hybrid-warfare</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Germany]]></category>
            <category><![CDATA[Die Linke]]></category>
            <category><![CDATA[political parties]]></category>
            <category><![CDATA[hybrid warfare]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NoVoice Rootkit Infected 2.3M Android Devices via Play]]></title>
            <description><![CDATA[McAfee discovered NoVoice malware hiding in 50+ Google Play apps, using 22 exploits to root devices and clone WhatsApp sessions. Factory reset won't remove it.]]></description>
            <link>https://www.probablypwned.com/article/novoice-android-rootkit-google-play-2-3-million-devices</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/novoice-android-rootkit-google-play-2-3-million-devices</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[NoVoice]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[rootkit]]></category>
            <category><![CDATA[Google Play]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[mobile malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 12:05:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1607252650355-f7fd0460ccdb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Uses GitHub as C2 in South Korea Attacks]]></title>
            <description><![CDATA[FortiGuard Labs exposes DPRK campaign using LNK files and GitHub repositories for command-and-control against South Korean targets. 22 evasion techniques identified.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-github-c2-lnk-south-korea-fortigate</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-github-c2-lnk-south-korea-fortigate</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[DPRK]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[South Korea]]></category>
            <category><![CDATA[LNK]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 12:04:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Storm Infostealer Decrypts Credentials Server-Side]]></title>
            <description><![CDATA[New Storm infostealer bypasses Chrome's App-Bound Encryption by shipping encrypted credentials to attacker infrastructure for decryption. Endpoint tools can't detect it.]]></description>
            <link>https://www.probablypwned.com/article/storm-infostealer-server-side-decryption-browser-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/storm-infostealer-server-side-decryption-browser-credentials</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Storm]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[MaaS]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 12:03:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Azure Kubernetes CVE-2026-33105 Hits CVSS 10.0]]></title>
            <description><![CDATA[Microsoft Azure Kubernetes Service has a critical auth bypass (CVE-2026-33105) with a perfect CVSS 10.0 score. Unauthenticated attackers can escalate to cluster admin—patch now.]]></description>
            <link>https://www.probablypwned.com/article/azure-kubernetes-cve-2026-33105-cvss-10-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/azure-kubernetes-cve-2026-33105-cvss-10-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-33105]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[Kubernetes]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 03 Apr 2026 12:02:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrystalX RAT Flips Screens While Emptying Crypto Wallets]]></title>
            <description><![CDATA[Kaspersky exposes CrystalX RAT, a new malware-as-a-service combining stealer, RAT, and prankware. It rotates screens, swaps mouse buttons, and drains crypto via clipboard hijacking.]]></description>
            <link>https://www.probablypwned.com/article/crystalx-rat-maas-stealer-prankware-kaspersky</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crystalx-rat-maas-stealer-prankware-kaspersky</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[CrystalX RAT]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[cryptoclipping]]></category>
            <category><![CDATA[prankware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Stolen Credentials Hit Dark Web Markets Within 48 Hours]]></title>
            <description><![CDATA[New research maps the infostealer lifecycle from infection to dark web sale. Microsoft Entra ID appears in 79% of 2.05 million credential logs analyzed in 2026.]]></description>
            <link>https://www.probablypwned.com/article/infostealer-48-hour-dark-web-enterprise-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infostealer-48-hour-dark-web-enterprise-credentials</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[dark web]]></category>
            <category><![CDATA[Microsoft Entra ID]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:08:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hasbro Confirms Cyberattack, Warns of Weeks-Long Recovery]]></title>
            <description><![CDATA[Toy giant Hasbro filed an SEC 8-K disclosing unauthorized network access discovered March 28. Systems remain offline with recovery expected to take weeks.]]></description>
            <link>https://www.probablypwned.com/article/hasbro-cyberattack-sec-filing-weeks-recovery</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hasbro-cyberattack-sec-filing-weeks-recovery</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Hasbro]]></category>
            <category><![CDATA[SEC filing]]></category>
            <category><![CDATA[cyberattack]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:07:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1579389083078-4e7018379f7e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Italy's Largest Bank Fined $36M After Employee Snooped for Years]]></title>
            <description><![CDATA[Intesa Sanpaolo hit with $36 million GDPR fine after a single employee accessed 3,573 customer accounts undetected for over two years, including politicians.]]></description>
            <link>https://www.probablypwned.com/article/intesa-sanpaolo-gdpr-fine-31-million-insider-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/intesa-sanpaolo-gdpr-fine-31-million-insider-access</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[GDPR]]></category>
            <category><![CDATA[Intesa Sanpaolo]]></category>
            <category><![CDATA[insider threat]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Italy]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:05:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hackers Impersonate Ukraine's CERT to Push AGEWHEEZE RAT]]></title>
            <description><![CDATA[Threat actor UAC-0255 sent 1 million phishing emails posing as CERT-UA to distribute the AGEWHEEZE remote access trojan targeting Ukrainian organizations.]]></description>
            <link>https://www.probablypwned.com/article/uac-0255-agewheeze-cert-ua-impersonation-million-emails</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uac-0255-agewheeze-cert-ua-impersonation-million-emails</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UAC-0255]]></category>
            <category><![CDATA[AGEWHEEZE]]></category>
            <category><![CDATA[CERT-UA]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[phishing]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:04:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587620962725-abab7fe55159?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DeepLoad Malware Uses AI-Generated Code to Evade Detection]]></title>
            <description><![CDATA[New DeepLoad malware combines ClickFix delivery with AI-generated obfuscation to bypass security scanners. WMI persistence survives remediation for days.]]></description>
            <link>https://www.probablypwned.com/article/deepload-malware-clickfix-ai-evasion-wmi-persistence</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/deepload-malware-clickfix-ai-evasion-wmi-persistence</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[DeepLoad]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[WMI persistence]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 02 Apr 2026 12:03:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AuraStealer Spreads Via TikTok Videos Posing as Software Tutorials]]></title>
            <description><![CDATA[Russian-linked AuraStealer infostealer operates 48 C2 domains, steals crypto wallets and 2FA tokens, and spreads through fake software activation videos on TikTok.]]></description>
            <link>https://www.probablypwned.com/article/aurastealer-infostealer-48-c2-domains-tiktok-distribution</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aurastealer-infostealer-48-c2-domains-tiktok-distribution</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AuraStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[TikTok]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:06:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vertex AI Flaw Turns Enterprise AI Agents Into Data Thieves]]></title>
            <description><![CDATA[Unit 42 exposes how excessive default permissions in Google Cloud's Vertex AI let attackers weaponize AI agents to steal data from customer environments.]]></description>
            <link>https://www.probablypwned.com/article/vertex-ai-double-agent-gcp-data-exfiltration-unit42</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vertex-ai-double-agent-gcp-data-exfiltration-unit42</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Google Cloud]]></category>
            <category><![CDATA[Vertex AI]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[data exfiltration]]></category>
            <category><![CDATA[Unit 42]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:05:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese APT Hijacked TrueConf Updates to Backdoor Governments]]></title>
            <description><![CDATA[Operation TrueChaos exploited CVE-2026-3502 in TrueConf video conferencing to deploy Havoc malware across Southeast Asian government networks.]]></description>
            <link>https://www.probablypwned.com/article/operation-truechaos-trueconf-zero-day-southeast-asia-apt</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/operation-truechaos-trueconf-zero-day-southeast-asia-apt</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[TrueConf]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[CVE-2026-3502]]></category>
            <category><![CDATA[Havoc]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:04:53 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Patches Fourth Chrome Zero-Day of 2026]]></title>
            <description><![CDATA[CVE-2026-5281 exploited in the wild targets Dawn WebGPU implementation. Google rushes emergency patch as Chrome zero-days accelerate in 2026.]]></description>
            <link>https://www.probablypwned.com/article/chrome-cve-2026-5281-fourth-zero-day-dawn-webgpu</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-cve-2026-5281-fourth-zero-day-dawn-webgpu</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-5281]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[WebGPU]]></category>
            <category><![CDATA[Google]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Telnetd Flaw Lets Attackers Get Root Before Login Prompt]]></title>
            <description><![CDATA[CVE-2026-32746 (CVSS 9.8) in GNU InetUtils telnetd enables unauthenticated root RCE via buffer overflow. FreeBSD, NetBSD, Citrix NetScaler affected.]]></description>
            <link>https://www.probablypwned.com/article/telnetd-cve-2026-32746-cvss-9-8-unauthenticated-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/telnetd-cve-2026-32746-cvss-9-8-unauthenticated-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-32746]]></category>
            <category><![CDATA[telnetd]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Citrix NetScaler]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 01 Apr 2026 12:03:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Axios npm Hijack Drops Cross-Platform RAT on 100M+ Installs]]></title>
            <description><![CDATA[Attackers compromised the Axios npm package to deploy a cross-platform RAT targeting Windows, macOS, and Linux. Here's what happened and what you need to do.]]></description>
            <link>https://www.probablypwned.com/article/axios-npm-supply-chain-rat-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/axios-npm-supply-chain-rat-march-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[axios]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Telegram Disputes Critical Zero-Click Sticker RCE Claim]]></title>
            <description><![CDATA[Trend Micro ZDI disclosed a CVSS 9.8 flaw enabling device takeover via animated stickers. Telegram says the vulnerability doesn't exist. No patch until July 2026.]]></description>
            <link>https://www.probablypwned.com/article/telegram-zero-click-sticker-zdi-can-30207-disputed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/telegram-zero-click-sticker-zdi-can-30207-disputed</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[zero-click]]></category>
            <category><![CDATA[ZDI-CAN-30207]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[animated stickers]]></category>
            <category><![CDATA[mobile security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:06:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611606063065-ee7946f0787a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ChatGPT Bug Let Malicious Prompts Exfiltrate Data via DNS]]></title>
            <description><![CDATA[Check Point Research disclosed a ChatGPT vulnerability that abused DNS tunneling to silently steal conversation data. OpenAI patched the flaw on February 20, 2026.]]></description>
            <link>https://www.probablypwned.com/article/chatgpt-dns-tunneling-data-exfiltration-checkpoint</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chatgpt-dns-tunneling-data-exfiltration-checkpoint</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[DNS tunneling]]></category>
            <category><![CDATA[data exfiltration]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[prompt injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:06:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Exploiting FortiClient EMS SQLi Flaw in the Wild]]></title>
            <description><![CDATA[CVE-2026-21643 exploitation began March 26, six weeks after Fortinet's patch. Around 1,000 internet-exposed EMS instances remain vulnerable to unauthenticated RCE.]]></description>
            <link>https://www.probablypwned.com/article/forticlient-ems-cve-2026-21643-active-exploitation-march</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/forticlient-ems-cve-2026-21643-active-exploitation-march</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiClient EMS]]></category>
            <category><![CDATA[CVE-2026-21643]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[active exploitation]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:05:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Merge Node Flaw Exposes 615K Instances to RCE]]></title>
            <description><![CDATA[CVE-2026-33660 (CVSS 9.4) lets authenticated users escape n8n's AlaSQL sandbox via the Merge node. Over 615,000 public instances potentially vulnerable.]]></description>
            <link>https://www.probablypwned.com/article/n8n-merge-node-cve-2026-33660-alasql-sandbox-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-merge-node-cve-2026-33660-alasql-sandbox-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-33660]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[AlaSQL]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Citrix NetScaler Patches by April 2 After KEV Addition]]></title>
            <description><![CDATA[CVE-2026-3055 now actively exploited. CISA adds the CVSS 9.3 memory leak to KEV catalog, giving federal agencies until April 2 to patch SAML IdP configurations.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-citrix-netscaler-cve-2026-3055-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-citrix-netscaler-cve-2026-3055-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Citrix]]></category>
            <category><![CDATA[NetScaler]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[CVE-2026-3055]]></category>
            <category><![CDATA[active exploitation]]></category>
            <category><![CDATA[SAML]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 31 Mar 2026 12:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FCC Bans Import of Foreign-Made Consumer Routers Over Supply Chain Risks]]></title>
            <description><![CDATA[All new overseas-manufactured routers prohibited from U.S. market after Volt Typhoon and Salt Typhoon exploited compromised devices. Existing routers unaffected.]]></description>
            <link>https://www.probablypwned.com/article/fcc-bans-foreign-routers-volt-typhoon-supply-chain-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fcc-bans-foreign-routers-volt-typhoon-supply-chain-security</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[FCC]]></category>
            <category><![CDATA[router ban]]></category>
            <category><![CDATA[supply chain security]]></category>
            <category><![CDATA[Volt Typhoon]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 30 Mar 2026 12:06:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lloyds App Glitch Exposed 450K Customers' Transactions to Other Users]]></title>
            <description><![CDATA[API defect in Lloyds, Halifax, and Bank of Scotland apps let users view strangers' transactions including account numbers and NI numbers. Bank paying compensation.]]></description>
            <link>https://www.probablypwned.com/article/lloyds-bank-app-glitch-450000-customers-transactions-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lloyds-bank-app-glitch-450000-customers-transactions-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Lloyds Bank]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[banking app]]></category>
            <category><![CDATA[API vulnerability]]></category>
            <category><![CDATA[UK banking]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 30 Mar 2026 12:05:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenClaw Bootstrap Replay Bug Enables Admin Takeover (CVE-2026-32987)]]></title>
            <description><![CDATA[Critical CVSS 9.8 flaw in OpenClaw AI agent platform lets attackers replay setup codes for privilege escalation. Patch to version 2026.3.13 immediately.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-cve-2026-32987-bootstrap-replay-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-cve-2026-32987-bootstrap-replay-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-32987]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[AI agents]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 30 Mar 2026 12:05:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Red Menshen Plants BPFDoor Sleeper Cells in Global Telecom Networks]]></title>
            <description><![CDATA[China-linked APT embeds kernel-level backdoors in telecom infrastructure across Middle East and Asia. Rapid7 finds stealthy implants evading detection for years.]]></description>
            <link>https://www.probablypwned.com/article/red-menshen-bpfdoor-telecom-espionage-sleeper-cells</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/red-menshen-bpfdoor-telecom-espionage-sleeper-cells</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Red Menshen]]></category>
            <category><![CDATA[BPFDoor]]></category>
            <category><![CDATA[telecom espionage]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[Linux backdoor]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 30 Mar 2026 12:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[800K Sites at Risk from Smart Slider 3 File Read Flaw]]></title>
            <description><![CDATA[CVE-2026-3098 lets subscribers read wp-config.php and any server file. Amelia Booking Pro also patched for admin password reset bug. Update these WordPress plugins now.]]></description>
            <link>https://www.probablypwned.com/article/smart-slider-amelia-wordpress-plugins-urgent-march-2026-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smart-slider-amelia-wordpress-plugins-urgent-march-2026-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-3098]]></category>
            <category><![CDATA[Smart Slider 3]]></category>
            <category><![CDATA[Amelia]]></category>
            <category><![CDATA[plugin vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 29 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pro-Ukraine Group Bearlyfy Deploys Custom GenieLocker Ransomware]]></title>
            <description><![CDATA[Bearlyfy has hit 70+ Russian companies since January 2025, now deploying custom GenieLocker ransomware. The group blends financial extortion with politically motivated sabotage.]]></description>
            <link>https://www.probablypwned.com/article/bearlyfy-genielocker-ransomware-70-russian-companies-ukraine</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bearlyfy-genielocker-ransomware-70-russian-companies-ukraine</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Bearlyfy]]></category>
            <category><![CDATA[GenieLocker]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[threat actor]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 29 Mar 2026 12:05:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[F5 BIG-IP Flaw Upgraded to RCE After Active Exploitation Confirmed]]></title>
            <description><![CDATA[CISA added CVE-2025-53521 to its KEV catalog after F5 reclassified the BIG-IP APM vulnerability from DoS to remote code execution. CVSS 9.8—federal deadline is March 30.]]></description>
            <link>https://www.probablypwned.com/article/f5-big-ip-apm-cve-2025-53521-cisa-kev-rce-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/f5-big-ip-apm-cve-2025-53521-cisa-kev-rce-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[F5]]></category>
            <category><![CDATA[BIG-IP]]></category>
            <category><![CDATA[CVE-2025-53521]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 29 Mar 2026 12:04:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TeamPCP Hijacks Telnyx PyPI Package to Deploy WAV-Hidden Stealer]]></title>
            <description><![CDATA[TeamPCP compromised the popular telnyx Python SDK on PyPI, hiding credential-stealing malware inside WAV audio files. Versions 4.87.1 and 4.87.2 affected—downgrade immediately.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-telnyx-pypi-supply-chain-wav-steganography</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-telnyx-pypi-supply-chain-wav-steganography</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[steganography]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 29 Mar 2026 12:04:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vidar Infostealer Spreads via Hacked WordPress Sites]]></title>
            <description><![CDATA[Malwarebytes researchers detected a Vidar infostealer campaign using fake CAPTCHA pages on compromised WordPress sites. ClickFix technique tricks users into running malicious PowerShell.]]></description>
            <link>https://www.probablypwned.com/article/vidar-infostealer-wordpress-fake-captcha-clickfix-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vidar-infostealer-wordpress-fake-captcha-clickfix-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[fake CAPTCHA]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 28 Mar 2026 12:05:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[European Commission Confirms AWS Cloud Breach]]></title>
            <description><![CDATA[Hackers compromised the European Commission's Amazon cloud infrastructure, claiming to steal 350GB of data including employee databases. Investigation ongoing.]]></description>
            <link>https://www.probablypwned.com/article/european-commission-aws-breach-350gb-data-stolen-cloud</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/european-commission-aws-breach-350gb-data-stolen-cloud</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[European Commission]]></category>
            <category><![CDATA[AWS]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Europa.eu]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 28 Mar 2026 12:04:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LangChain Flaws Expose Files, Secrets, and Databases]]></title>
            <description><![CDATA[Three vulnerabilities in LangChain and LangGraph expose filesystems, environment secrets, and conversation histories. CVE-2026-34070 enables path traversal. Patches available now.]]></description>
            <link>https://www.probablypwned.com/article/langchain-langgraph-cve-2026-34070-path-traversal-sql-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langchain-langgraph-cve-2026-34070-path-traversal-sql-injection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[LangChain]]></category>
            <category><![CDATA[LangGraph]]></category>
            <category><![CDATA[CVE-2026-34070]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[path traversal]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 28 Mar 2026 12:03:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake VS Code Security Alerts Flood GitHub to Spread Malware]]></title>
            <description><![CDATA[Attackers are posting thousands of fake Visual Studio Code vulnerability alerts in GitHub Discussions, using fabricated CVEs and urgent language to trick developers into downloading malware.]]></description>
            <link>https://www.probablypwned.com/article/github-phishing-fake-vscode-alerts-malware-socket</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/github-phishing-fake-vscode-alerts-malware-socket</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[Visual Studio Code]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Infiniti Stealer: macOS Malware Uses ClickFix and Nuitka Compilation]]></title>
            <description><![CDATA[A new macOS infostealer combines ClickFix social engineering with Nuitka-compiled Python to evade detection. First documented campaign pairing these techniques.]]></description>
            <link>https://www.probablypwned.com/article/infiniti-stealer-macos-clickfix-python-nuitka-infostealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infiniti-stealer-macos-clickfix-python-nuitka-infostealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Nuitka]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:11:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RedLine Infostealer Developer Faces 50 Years After US Extradition]]></title>
            <description><![CDATA[Armenian national Hambardzum Minasyan extradited to face charges for developing RedLine malware infrastructure. Follows 2024 international takedown operation.]]></description>
            <link>https://www.probablypwned.com/article/redline-infostealer-developer-extradited-hambardzum-minasyan-50-years</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/redline-infostealer-developer-extradited-hambardzum-minasyan-50-years</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[RedLine]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[extradition]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:09:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce]]></title>
            <description><![CDATA[A new payment skimmer uses WebRTC data channels instead of HTTP to exfiltrate stolen card data, bypassing Content Security Policy controls on Magento stores.]]></description>
            <link>https://www.probablypwned.com/article/webrtc-payment-skimmer-csp-bypass-magento-ecommerce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/webrtc-payment-skimmer-csp-bypass-magento-ecommerce</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[payment skimmer]]></category>
            <category><![CDATA[WebRTC]]></category>
            <category><![CDATA[Magento]]></category>
            <category><![CDATA[e-commerce]]></category>
            <category><![CDATA[CSP bypass]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:08:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ajax Amsterdam Breach Exposed 300K Fan Accounts to Ticket Theft]]></title>
            <description><![CDATA[An API vulnerability in AFC Ajax systems let attackers access fan data and transfer 42,000+ season tickets. Club patched after journalists demonstrated the flaw.]]></description>
            <link>https://www.probablypwned.com/article/ajax-amsterdam-breach-300000-fans-ticket-hijacking-api-flaw</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ajax-amsterdam-breach-300000-fans-ticket-hijacking-api-flaw</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Ajax Amsterdam]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[API security]]></category>
            <category><![CDATA[sports]]></category>
            <category><![CDATA[ticket fraud]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ubiquiti UniFi Flaw Scores CVSS 10—Patch Before Full Takeover]]></title>
            <description><![CDATA[CVE-2026-22557 lets unauthenticated attackers traverse paths and hijack UniFi Network accounts. CVSS 10.0 severity demands immediate patching to 10.1.89.]]></description>
            <link>https://www.probablypwned.com/article/ubiquiti-unifi-cve-2026-22557-cvss-10-path-traversal-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ubiquiti-unifi-cve-2026-22557-cvss-10-path-traversal-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ubiquiti]]></category>
            <category><![CDATA[CVE-2026-22557]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 27 Mar 2026 12:05:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UK Sanctions Xinbi Marketplace Over $19B in Scam Laundering]]></title>
            <description><![CDATA[Britain becomes the first country to sanction Xinbi, a Telegram-based crypto marketplace that processed $19.9 billion for pig butchering scams and North Korean hackers.]]></description>
            <link>https://www.probablypwned.com/article/uk-sanctions-xinbi-telegram-marketplace-19-billion-pig-butchering</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uk-sanctions-xinbi-telegram-marketplace-19-billion-pig-butchering</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Xinbi]]></category>
            <category><![CDATA[UK sanctions]]></category>
            <category><![CDATA[pig butchering]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[money laundering]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Device Code Phishing Hits 340+ Microsoft 365 Orgs in 5 Countries]]></title>
            <description><![CDATA[EvilTokens phishing platform targets Microsoft 365 identities across US, Canada, Australia, New Zealand, and Germany. OAuth abuse bypasses MFA to steal access tokens.]]></description>
            <link>https://www.probablypwned.com/article/eviltokens-device-code-phishing-340-microsoft-365-oauth-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/eviltokens-device-code-phishing-340-microsoft-365-oauth-bypass</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Microsoft 365]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[device code phishing]]></category>
            <category><![CDATA[EvilTokens]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[phishing-as-a-service]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:07:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russian Access Broker Gets 81 Months for Yanluowang Attacks]]></title>
            <description><![CDATA[Aleksei Volkov sentenced to nearly 7 years for selling network access to ransomware gangs. Facilitated dozens of attacks causing over $9 million in losses to US organizations.]]></description>
            <link>https://www.probablypwned.com/article/aleksei-volkov-sentenced-81-months-yanluowang-ransomware-broker</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aleksei-volkov-sentenced-81-months-yanluowang-ransomware-broker</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Yanluowang]]></category>
            <category><![CDATA[initial access broker]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[sentencing]]></category>
            <category><![CDATA[cybercrime]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:06:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Copyright Phishing Delivers PureLog Stealer to Healthcare, Gov]]></title>
            <description><![CDATA[Fake copyright infringement notices target healthcare and government organizations in Germany and Canada with fileless PureLog Stealer malware. Campaign uses language-matched lures.]]></description>
            <link>https://www.probablypwned.com/article/purelog-stealer-copyright-phishing-healthcare-government-germany</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/purelog-stealer-copyright-phishing-healthcare-government-germany</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PureLog Stealer]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[copyright]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[Germany]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:06:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TP-Link Archer Routers Vulnerable to Unauthenticated Takeover]]></title>
            <description><![CDATA[Critical CVE-2025-15517 allows attackers to bypass authentication on TP-Link Archer NX routers, upload malicious firmware, and modify configurations without credentials.]]></description>
            <link>https://www.probablypwned.com/article/tp-link-archer-nx-cve-2025-15517-auth-bypass-firmware-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tp-link-archer-nx-cve-2025-15517-auth-bypass-firmware-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[TP-Link]]></category>
            <category><![CDATA[router]]></category>
            <category><![CDATA[CVE-2025-15517]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[firmware]]></category>
            <category><![CDATA[IoT]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:05:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Torg Grabber Steals from 728 Crypto Wallets via ClickFix]]></title>
            <description><![CDATA[New Torg Grabber infostealer targets 728 cryptocurrency wallet extensions and 103 password managers. Spreads via ClickFix clipboard hijacking with Cloudflare-based exfiltration.]]></description>
            <link>https://www.probablypwned.com/article/torg-grabber-infostealer-728-crypto-wallets-clickfix</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/torg-grabber-infostealer-728-crypto-wallets-clickfix</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Torg Grabber]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[browser extensions]]></category>
            <category><![CDATA[wallet theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 26 Mar 2026 12:04:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TeamPCP Hijacks Checkmarx KICS Using Stolen Trivy Tokens]]></title>
            <description><![CDATA[Stolen CI credentials from Trivy breach enabled TeamPCP to compromise Checkmarx KICS GitHub Actions, poisoning all 35 version tags with credential-stealing malware in four-hour window.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-checkmarx-kics-github-action-trivy-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-checkmarx-kics-github-action-trivy-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[Checkmarx]]></category>
            <category><![CDATA[KICS]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 25 Mar 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Extorts Infinite Campus After Salesforce Breach]]></title>
            <description><![CDATA[K-12 student information system provider Infinite Campus discloses breach affecting school staff data. ShinyHunters issued March 25 ransom deadline after claiming to steal Salesforce records.]]></description>
            <link>https://www.probablypwned.com/article/infinite-campus-shinyhunters-breach-11-million-students</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infinite-campus-shinyhunters-breach-11-million-students</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Infinite Campus]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[Salesforce]]></category>
            <category><![CDATA[extortion]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 25 Mar 2026 12:05:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TeamPCP Poisons LiteLLM Package With Three-Stage Backdoor]]></title>
            <description><![CDATA[Malicious LiteLLM versions 1.82.7 and 1.82.8 deployed credential harvester, Kubernetes lateral movement tools, and persistent backdoor. Package sees 3 million daily downloads.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-litellm-pypi-supply-chain-credential-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-litellm-pypi-supply-chain-credential-stealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[LiteLLM]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 25 Mar 2026 12:04:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PTC Windchill CVSS 10 RCE Bug Prompts German Police Response]]></title>
            <description><![CDATA[Critical deserialization flaw CVE-2026-4681 in PTC Windchill and FlexPLM threatens manufacturing sector. German federal police dispatched to warn companies of imminent exploitation.]]></description>
            <link>https://www.probablypwned.com/article/ptc-windchill-flexplm-cve-2026-4681-cvss-10-imminent-threat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ptc-windchill-flexplm-cve-2026-4681-cvss-10-imminent-threat</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-4681]]></category>
            <category><![CDATA[PTC Windchill]]></category>
            <category><![CDATA[FlexPLM]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[deserialization]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 25 Mar 2026 12:03:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Fixes Month-Long Outlook Gmail Sync Bug]]></title>
            <description><![CDATA[Classic Outlook users can finally sync Gmail again after Microsoft resolves OAuth token issue that blocked email synchronization since February 26. Here's what happened and how to restore access.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-fixes-classic-outlook-gmail-sync-bug-oauth</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-fixes-classic-outlook-gmail-sync-bug-oauth</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Outlook]]></category>
            <category><![CDATA[Gmail]]></category>
            <category><![CDATA[OAuth]]></category>
            <category><![CDATA[email-sync]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Europol and Microsoft Dismantle Tycoon 2FA Phishing Empire]]></title>
            <description><![CDATA[Global coalition seizes 330 domains powering Tycoon 2FA, a phishing-as-a-service platform that bypassed MFA to compromise 96,000 victims across 500,000 organizations.]]></description>
            <link>https://www.probablypwned.com/article/tycoon-2fa-takedown-europol-microsoft-330-domains</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tycoon-2fa-takedown-europol-microsoft-330-domains</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Tycoon 2FA]]></category>
            <category><![CDATA[Europol]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[law enforcement]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:07:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Crunchyroll Breach Exposes 6.8 Million Users via Malware]]></title>
            <description><![CDATA[Hackers infected a contractor's device to steal Okta credentials, then pivoted to Crunchyroll's Zendesk. Support ticket data for 6.8 million subscribers extracted.]]></description>
            <link>https://www.probablypwned.com/article/crunchyroll-breach-6-8-million-zendesk-contractor-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crunchyroll-breach-6-8-million-zendesk-contractor-malware</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Crunchyroll]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Zendesk]]></category>
            <category><![CDATA[Okta]]></category>
            <category><![CDATA[third-party vendor]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:06:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Four Critical n8n Flaws Enable Unauthenticated RCE]]></title>
            <description><![CDATA[n8n patches CVE-2026-27577, CVE-2026-27493, and two more sandbox escapes. One flaw allows unauthenticated attackers to execute commands via public form endpoints.]]></description>
            <link>https://www.probablypwned.com/article/n8n-march-2026-four-critical-cves-sandbox-form-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-march-2026-four-critical-cves-sandbox-form-injection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-27577]]></category>
            <category><![CDATA[CVE-2026-27493]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:06:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Citrix NetScaler Memory Leak Exposes SAML SSO Secrets]]></title>
            <description><![CDATA[CVE-2026-3055 (CVSS 9.3) lets unauthenticated attackers read sensitive data from NetScaler memory. Affects appliances configured as SAML Identity Providers—patch now.]]></description>
            <link>https://www.probablypwned.com/article/citrix-netscaler-cve-2026-3055-saml-memory-leak</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/citrix-netscaler-cve-2026-3055-saml-memory-leak</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Citrix]]></category>
            <category><![CDATA[NetScaler]]></category>
            <category><![CDATA[CVE-2026-3055]]></category>
            <category><![CDATA[SAML]]></category>
            <category><![CDATA[memory leak]]></category>
            <category><![CDATA[out-of-bounds read]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:05:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Quest KACE SMA CVSS 10.0 Flaw Exploited in the Wild]]></title>
            <description><![CDATA[Attackers exploiting CVE-2025-32975 authentication bypass in Quest KACE to hijack admin accounts and deploy credential harvesters. Patched in May 2025—many remain exposed.]]></description>
            <link>https://www.probablypwned.com/article/quest-kace-sma-cve-2025-32975-cvss-10-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/quest-kace-sma-cve-2025-32975-cvss-10-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Quest KACE]]></category>
            <category><![CDATA[CVE-2025-32975]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[active exploitation]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 24 Mar 2026 12:04:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CanisterWorm Adds Iran-Targeting Kubernetes Wiper]]></title>
            <description><![CDATA[TeamPCP's supply chain attack expands with a Kubernetes wiper that detects Iranian systems via timezone and locale, wiping clusters while backdooring everyone else.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-canisterworm-kubernetes-wiper-iran-docker-hub</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-canisterworm-kubernetes-wiper-iran-docker-hub</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[CanisterWorm]]></category>
            <category><![CDATA[Kubernetes]]></category>
            <category><![CDATA[wiper]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Docker Hub]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iranian APT Deploys Fake RedAlert App to Surveil Israeli Users]]></title>
            <description><![CDATA[Unit 42 uncovers phishing campaign distributing trojanized Israeli civil defense app. Malicious APK harvests location data, contacts, and messages from Android devices amid regional tensions.]]></description>
            <link>https://www.probablypwned.com/article/iran-redalert-android-malware-israel-surveillance-unit42</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-redalert-android-malware-israel-surveillance-unit42</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Android malware]]></category>
            <category><![CDATA[RedAlert]]></category>
            <category><![CDATA[surveillance]]></category>
            <category><![CDATA[Israel]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 12:13:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AVideo RCE Chain Gives Attackers Full Server Access Without Auth]]></title>
            <description><![CDATA[Three vulnerabilities in AVideo's CloneSite plugin chain together for unauthenticated remote code execution. CVE-2026-33478 has no patch available as attackers can extract admin credentials and inject OS commands.]]></description>
            <link>https://www.probablypwned.com/article/avideo-cve-2026-33478-unauthenticated-rce-chain-unpatched</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/avideo-cve-2026-33478-unauthenticated-rce-chain-unpatched</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AVideo]]></category>
            <category><![CDATA[CVE-2026-33478]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[unpatched]]></category>
            <category><![CDATA[video platform]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 12:10:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ubuntu Desktop Flaw Lets Local Users Escalate to Root]]></title>
            <description><![CDATA[CVE-2026-3888 exploits timing race between snap-confine and systemd-tmpfiles to grant root access on Ubuntu Desktop 24.04+. Qualys researchers demonstrate full privilege escalation.]]></description>
            <link>https://www.probablypwned.com/article/ubuntu-cve-2026-3888-snap-confine-root-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ubuntu-cve-2026-3888-snap-confine-root-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ubuntu]]></category>
            <category><![CDATA[CVE-2026-3888]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[snap-confine]]></category>
            <category><![CDATA[systemd]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 12:08:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Navia Benefit Solutions Breach Exposes 2.7 Million SSNs]]></title>
            <description><![CDATA[Workplace benefits administrator Navia discloses data breach affecting 2.7 million individuals. Social Security numbers, health plan data, and personal information stolen during December-January intrusion.]]></description>
            <link>https://www.probablypwned.com/article/navia-benefit-solutions-breach-2-7-million-ssn-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/navia-benefit-solutions-breach-2-7-million-ssn-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Navia]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SSN exposure]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[COBRA]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 23 Mar 2026 12:06:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VoidStealer Bypasses Chrome ABE Using Debugger Trick]]></title>
            <description><![CDATA[VoidStealer v2.0 becomes the first infostealer to extract Chrome's v20_master_key using hardware breakpoints. No injection or privilege escalation required.]]></description>
            <link>https://www.probablypwned.com/article/voidstealer-chrome-master-key-debugger-abe-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/voidstealer-chrome-master-key-debugger-abe-bypass</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VoidStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[Application-Bound Encryption]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 22 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet Patches 11 Flaws in FortiManager, FortiAnalyzer, FortiSandbox]]></title>
            <description><![CDATA[Fortinet's March 2026 security advisory addresses 11 vulnerabilities including auth bypass, SQL injection, and buffer overflow flaws affecting enterprise management products.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-march-2026-eleven-cve-patch-fortimanager-fortianalyzer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-march-2026-eleven-cve-patch-fortimanager-fortianalyzer</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiManager]]></category>
            <category><![CDATA[FortiAnalyzer]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[patch]]></category>
            <category><![CDATA[SQL injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 22 Mar 2026 12:06:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Trivy Scanner Breach Spawns CanisterWorm Across 47 npm Packages]]></title>
            <description><![CDATA[TeamPCP threat actors hijacked Aqua Security's Trivy vulnerability scanner, compromising 75 GitHub Action tags and spreading credential-stealing malware to 47 npm packages via blockchain C2.]]></description>
            <link>https://www.probablypwned.com/article/trivy-supply-chain-teampcp-canisterworm-npm-github-actions</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trivy-supply-chain-teampcp-canisterworm-npm-github-actions</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Trivy]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[CanisterWorm]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 22 Mar 2026 12:05:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Warns Russian Hackers Compromised Thousands of Signal, WhatsApp Accounts]]></title>
            <description><![CDATA[FBI and CISA alert reveals Russian intelligence operatives have hijacked thousands of Signal and WhatsApp accounts belonging to US officials, military, and journalists through phishing attacks.]]></description>
            <link>https://www.probablypwned.com/article/fbi-cisa-russian-intelligence-signal-whatsapp-phishing-thousands</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-cisa-russian-intelligence-signal-whatsapp-phishing-thousands</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Signal]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Star Blizzard]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 22 Mar 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PolyShell Flaw Exposes All Magento Stores to RCE Attacks]]></title>
            <description><![CDATA[Unrestricted file upload in Magento and Adobe Commerce REST API allows unauthenticated attackers to upload executable files. No isolated patch available for production versions.]]></description>
            <link>https://www.probablypwned.com/article/polyshell-magento-adobe-commerce-unauthenticated-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/polyshell-magento-adobe-commerce-unauthenticated-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Magento]]></category>
            <category><![CDATA[Adobe Commerce]]></category>
            <category><![CDATA[PolyShell]]></category>
            <category><![CDATA[file upload]]></category>
            <category><![CDATA[ecommerce security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:06:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Apple, Craft CMS, Laravel Bugs to KEV Catalog]]></title>
            <description><![CDATA[Five vulnerabilities under active exploitation added to CISA's KEV catalog. Federal agencies must patch by April 3, 2026. Includes three Apple kernel flaws and Laravel RCE.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-apple-craftcms-laravel-livewire-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-apple-craftcms-laravel-livewire-march-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[Craft CMS]]></category>
            <category><![CDATA[Laravel Livewire]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:06:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Speagle Malware Hijacks Cobra DocGuard to Hunt Missile Data]]></title>
            <description><![CDATA[New infostealer parasitizes legitimate document security software, exfiltrating data through trusted server infrastructure. Targets include Dongfeng-27 ballistic missile documents.]]></description>
            <link>https://www.probablypwned.com/article/speagle-malware-cobra-docguard-chinese-missile-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/speagle-malware-cobra-docguard-chinese-missile-espionage</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Speagle]]></category>
            <category><![CDATA[Cobra DocGuard]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Runningcrab]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:05:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DOJ Disrupts 3M-Device Botnets Behind 31 Tbps DDoS Attacks]]></title>
            <description><![CDATA[International operation seizes C2 infrastructure for AISURU, Kimwolf, JackSkid, and Mossad botnets. Peak attacks hit 31.4 Tbps, targeting DOD systems and critical infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/doj-iot-botnet-aisuru-kimwolf-31-tbps-ddos-takedown</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/doj-iot-botnet-aisuru-kimwolf-31-tbps-ddos-takedown</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[IoT security]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[DOJ]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:04:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Langflow RCE Exploited Within 20 Hours of Disclosure]]></title>
            <description><![CDATA[CVE-2026-33017 (CVSS 9.3) lets attackers execute arbitrary Python code on Langflow AI pipelines without authentication. Exploitation began before any PoC existed.]]></description>
            <link>https://www.probablypwned.com/article/langflow-cve-2026-33017-critical-rce-20-hour-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langflow-cve-2026-33017-critical-rce-20-hour-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-33017]]></category>
            <category><![CDATA[Langflow]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 21 Mar 2026 12:04:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Oracle Ships Emergency Patch for Critical Identity Manager RCE]]></title>
            <description><![CDATA[CVE-2026-21992 scores CVSS 9.8 and allows unauthenticated remote code execution on Oracle Identity Manager and Web Services Manager. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/oracle-identity-manager-cve-2026-21992-emergency-patch-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-identity-manager-cve-2026-21992-emergency-patch-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[CVE-2026-21992]]></category>
            <category><![CDATA[Identity Manager]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[out-of-band patch]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 20 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Baydöner Breach Exposes 3.7M Records With Plaintext Passwords]]></title>
            <description><![CDATA[Turkish restaurant chain Baydöner confirms breach affecting 3.7 million customers. Data includes 622,000 plaintext passwords and 42,000 national IDs now circulating on forums.]]></description>
            <link>https://www.probablypwned.com/article/baydoner-turkey-data-breach-3-7-million-plaintext-passwords</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/baydoner-turkey-data-breach-3-7-million-plaintext-passwords</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[Baydöner]]></category>
            <category><![CDATA[Turkey]]></category>
            <category><![CDATA[plaintext-passwords]]></category>
            <category><![CDATA[credential-exposure]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 20 Mar 2026 12:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Excel XSS Bug Weaponizes Copilot for Zero-Click Data Theft]]></title>
            <description><![CDATA[CVE-2026-26144 allows attackers to silently exfiltrate sensitive data through Microsoft Copilot Agent without user interaction. Patch now or disable Copilot.]]></description>
            <link>https://www.probablypwned.com/article/cve-2026-26144-excel-copilot-zero-click-data-exfiltration</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cve-2026-26144-excel-copilot-zero-click-data-exfiltration</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-26144]]></category>
            <category><![CDATA[Microsoft Excel]]></category>
            <category><![CDATA[Copilot]]></category>
            <category><![CDATA[zero-click]]></category>
            <category><![CDATA[data-exfiltration]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 20 Mar 2026 12:04:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GlassWorm Supply Chain Attack Surges to 433 Compromised Components]]></title>
            <description><![CDATA[GlassWorm campaign expands across Open VSX, npm, and GitHub with invisible Unicode payloads and Solana-based C2. Developers urged to audit dependencies immediately.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-supply-chain-433-extensions-npm-github-openvsx</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-supply-chain-433-extensions-npm-github-openvsx</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply-chain-attack]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[Visual Studio Code]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[developer-security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 20 Mar 2026 12:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Honeywell BMS Controllers Ship With No Authentication by Design]]></title>
            <description><![CDATA[CVE-2026-3611 exposes Honeywell IQ4x building management controllers with CVSS 10 severity. Default configuration allows anyone to create admin accounts.]]></description>
            <link>https://www.probablypwned.com/article/honeywell-iq4x-bms-cve-2026-3611-cvss-10-no-authentication</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/honeywell-iq4x-bms-cve-2026-3611-cvss-10-no-authentication</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Honeywell]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[SCADA]]></category>
            <category><![CDATA[CVE-2026-3611]]></category>
            <category><![CDATA[building management]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:07:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT36 Floods Indian Government Networks With AI-Generated Malware]]></title>
            <description><![CDATA[Pakistan-linked APT36 uses LLM coding tools to mass-produce malware variants in Nim, Zig, and Crystal, targeting Indian government and embassies.]]></description>
            <link>https://www.probablypwned.com/article/apt36-transparent-tribe-vibeware-ai-malware-india</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt36-transparent-tribe-vibeware-ai-malware-india</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT36]]></category>
            <category><![CDATA[Transparent Tribe]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[India]]></category>
            <category><![CDATA[Pakistan]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:06:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517433367423-c7e5b0f35086?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VMware Aria Operations RCE Flaw Added to CISA KEV Catalog]]></title>
            <description><![CDATA[CISA confirms active exploitation of VMware Aria Operations CVE-2026-22719, a command injection flaw enabling unauthenticated RCE. Patch by March 24.]]></description>
            <link>https://www.probablypwned.com/article/vmware-aria-operations-cve-2026-22719-cisa-kev-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vmware-aria-operations-cve-2026-22719-cisa-kev-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[VMware]]></category>
            <category><![CDATA[Aria Operations]]></category>
            <category><![CDATA[CVE-2026-22719]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[command injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:05:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DarkSword Exploit Chain Hits iPhones Running iOS 18.4 to 18.7]]></title>
            <description><![CDATA[Multiple threat actors deploy DarkSword, a six-CVE iOS exploit chain stealing crypto wallets, credentials, and messages from millions of vulnerable iPhones.]]></description>
            <link>https://www.probablypwned.com/article/darksword-ios-exploit-chain-iphone-infostealer-unc6353</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/darksword-ios-exploit-chain-iphone-infostealer-unc6353</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[iPhone]]></category>
            <category><![CDATA[exploit chain]]></category>
            <category><![CDATA[DarkSword]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[UNC6353]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:04:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SharePoint RCE Flaw CVE-2026-20963 Under Active Exploitation]]></title>
            <description><![CDATA[CISA added Microsoft SharePoint CVE-2026-20963 to the KEV catalog after confirming active exploitation. Federal agencies must patch by March 21.]]></description>
            <link>https://www.probablypwned.com/article/sharepoint-cve-2026-20963-cisa-kev-deserialization-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sharepoint-cve-2026-20963-cisa-kev-deserialization-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[SharePoint]]></category>
            <category><![CDATA[CVE-2026-20963]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:04:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Interlock Ransomware Exploited Cisco FMC Flaw 36 Days Before Disclosure]]></title>
            <description><![CDATA[Interlock ransomware operators weaponized Cisco Secure Firewall Management Center CVE-2026-20131 as a zero-day since January 26, gaining root access to enterprise networks.]]></description>
            <link>https://www.probablypwned.com/article/interlock-ransomware-cisco-fmc-cve-2026-20131-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/interlock-ransomware-cisco-fmc-cve-2026-20131-zero-day</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-20131]]></category>
            <category><![CDATA[Interlock]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 19 Mar 2026 12:03:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1624969862644-791f3dc98927?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Data Broker Infutor Breach Exposes 676 Million Consumer Records]]></title>
            <description><![CDATA[Infutor data breach reportedly exposes 676 million consumer records including Social Security numbers. Misconfigured Elasticsearch database blamed for the exposure.]]></description>
            <link>https://www.probablypwned.com/article/infutor-data-breach-676-million-records-ssn-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infutor-data-breach-676-million-records-ssn-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Infutor]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[data broker]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[Elasticsearch]]></category>
            <category><![CDATA[consumer data]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:07:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EU Sanctions Chinese and Iranian Firms Over 65K Compromised Devices]]></title>
            <description><![CDATA[The EU sanctioned Integrity Technology Group, Anxun Information Technology, and Emennet Pasargad for cyberattacks against member states including the Paris Olympics.]]></description>
            <link>https://www.probablypwned.com/article/eu-sanctions-china-iran-integrity-technology-emennet-pasargad</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/eu-sanctions-china-iran-integrity-technology-emennet-pasargad</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[EU sanctions]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[Integrity Technology]]></category>
            <category><![CDATA[Emennet Pasargad]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:06:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Custom Fonts Let Attackers Hide Commands from AI Assistants]]></title>
            <description><![CDATA[LayerX researchers found that custom font rendering can hide malicious prompts from ChatGPT, Claude, Gemini, and other AI assistants while displaying them to users.]]></description>
            <link>https://www.probablypwned.com/article/font-rendering-attack-poisons-ai-assistants-layerx</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/font-rendering-attack-poisons-ai-assistants-layerx</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[Claude]]></category>
            <category><![CDATA[font rendering]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:05:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LeakNet Ransomware Ditches IABs for ClickFix and Deno]]></title>
            <description><![CDATA[LeakNet ransomware now uses ClickFix social engineering via hacked websites and a Deno-based in-memory loader to evade detection. Here's how the attack chain works.]]></description>
            <link>https://www.probablypwned.com/article/leaknet-ransomware-clickfix-deno-in-memory-loader</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/leaknet-ransomware-clickfix-deno-in-memory-loader</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[LeakNet]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Deno]]></category>
            <category><![CDATA[in-memory malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:04:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GNU telnetd Flaw Grants Root Access Before Login Prompt]]></title>
            <description><![CDATA[CVE-2026-32746 in GNU InetUtils telnetd allows unauthenticated root RCE via buffer overflow. CVSS 9.8, no patch available, over 200K servers exposed.]]></description>
            <link>https://www.probablypwned.com/article/gnu-inetutils-telnetd-cve-2026-32746-rce-unpatched</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gnu-inetutils-telnetd-cve-2026-32746-rce-unpatched</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-32746]]></category>
            <category><![CDATA[GNU InetUtils]]></category>
            <category><![CDATA[telnetd]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 18 Mar 2026 12:03:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[No Malware Needed: Stryker Attackers Weaponized Intune]]></title>
            <description><![CDATA[Iran-linked hackers wiped tens of thousands of Stryker devices using Microsoft Intune's remote wipe feature. Here's what security teams should learn.]]></description>
            <link>https://www.probablypwned.com/article/stryker-wiper-attack-no-malware-intune-mdm-lessons</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stryker-wiper-attack-no-malware-intune-mdm-lessons</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Microsoft Intune]]></category>
            <category><![CDATA[MDM security]]></category>
            <category><![CDATA[Stryker]]></category>
            <category><![CDATA[Handala]]></category>
            <category><![CDATA[wiper attack]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russia-Linked DRILLAPP Backdoor Weaponizes Edge Browser Debugging]]></title>
            <description><![CDATA[New JavaScript backdoor targets Ukrainian entities using Microsoft Edge's debugging features for stealth. S2 Grupo links campaign to Laundry Bear threat group.]]></description>
            <link>https://www.probablypwned.com/article/drillapp-backdoor-ukraine-edge-browser-debugging-russia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/drillapp-backdoor-ukraine-edge-browser-debugging-russia</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DRILLAPP]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Laundry Bear]]></category>
            <category><![CDATA[Microsoft Edge]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:09:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Claims 1 Petabyte Theft from Telus Digital, Demands $65M]]></title>
            <description><![CDATA[Canadian BPO giant confirms breach after ShinyHunters claims massive data theft including call recordings, source code, and FBI background checks. Ransom ignored.]]></description>
            <link>https://www.probablypwned.com/article/telus-digital-shinyhunters-breach-1-petabyte-65m-ransom</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/telus-digital-shinyhunters-breach-1-petabyte-65m-ransom</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Telus Digital]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[BPO]]></category>
            <category><![CDATA[ransom]]></category>
            <category><![CDATA[Canada]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:08:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Companies House UK Flaw Exposed 5 Million Firms to Data Theft]]></title>
            <description><![CDATA[British government registry's WebFiling vulnerability let logged-in users access other companies' dashboards since October 2025. Unauthorized filings were possible.]]></description>
            <link>https://www.probablypwned.com/article/companies-house-uk-webfiling-flaw-5-million-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/companies-house-uk-webfiling-flaw-5-million-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Companies House]]></category>
            <category><![CDATA[UK]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[WebFiling]]></category>
            <category><![CDATA[data exposure]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:08:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MacSync Stealer Spreads via Fake AI Tool Installers in ClickFix Wave]]></title>
            <description><![CDATA[Three ClickFix campaigns target macOS users with MacSync infostealer disguised as ChatGPT and AI coding tools. Latest variant adds in-memory execution to evade detection.]]></description>
            <link>https://www.probablypwned.com/article/macsync-infostealer-clickfix-ai-tools-fake-chatgpt</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/macsync-infostealer-clickfix-ai-tools-fake-chatgpt</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[MacSync]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[malvertising]]></category>
            <category><![CDATA[AI tools]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:07:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Konni APT Hijacks KakaoTalk to Spread EndRAT Across Contacts]]></title>
            <description><![CDATA[North Korean threat group Konni weaponizes KakaoTalk messaging app after compromising victims via spear-phishing. EndRAT, RftRAT deployed in multi-stage campaign.]]></description>
            <link>https://www.probablypwned.com/article/konni-apt-kakaotalk-endrat-north-korea-spear-phishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/konni-apt-kakaotalk-endrat-north-korea-spear-phishing</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Konni]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[KakaoTalk]]></category>
            <category><![CDATA[EndRAT]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[spear-phishing]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 17 Mar 2026 12:06:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Wing FTP Server RCE Flaw Still Exploited Eight Months After Patch]]></title>
            <description><![CDATA[CISA renews warnings about CVE-2025-47812, a CVSS 10.0 vulnerability in Wing FTP Server that grants attackers root/SYSTEM access. Over 8,000 servers remain exposed.]]></description>
            <link>https://www.probablypwned.com/article/wing-ftp-server-cve-2025-47812-cisa-kev-10000-servers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wing-ftp-server-cve-2025-47812-cisa-kev-10000-servers</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Wing FTP]]></category>
            <category><![CDATA[CVE-2025-47812]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[file transfer]]></category>
            <category><![CDATA[remote code execution]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Claims 400 Companies Breached via Salesforce Aura Flaw]]></title>
            <description><![CDATA[Threat group ShinyHunters exploits misconfigured Salesforce Experience Cloud sites, stealing data from 100+ organizations including 921K records from Aura.com.]]></description>
            <link>https://www.probablypwned.com/article/shinyhunters-salesforce-aura-breach-921k-records-400-companies</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shinyhunters-salesforce-aura-breach-921k-records-400-companies</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Salesforce]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Aura.com]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 12:08:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[250+ WordPress Sites Compromised to Deliver Infostealers via ClickFix]]></title>
            <description><![CDATA[Global campaign hijacks WordPress sites in 12 countries to serve fake Cloudflare CAPTCHAs that deploy Vidar, VodkaStealer, and other credential theft malware.]]></description>
            <link>https://www.probablypwned.com/article/wordpress-clickfix-campaign-250-sites-vidar-vodka-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wordpress-clickfix-campaign-250-sites-vidar-vodka-stealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[VodkaStealer]]></category>
            <category><![CDATA[web compromise]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 12:07:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AuraStealer Spreads via TikTok ClickFix Scams, Targets 110+ Browsers]]></title>
            <description><![CDATA[Russian-linked AuraStealer infostealer uses TikTok videos and 48 C2 domains to steal credentials. ABE bypass defeats Chrome's cookie encryption.]]></description>
            <link>https://www.probablypwned.com/article/aurastealer-infostealer-tiktok-clickfix-48-c2-domains</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aurastealer-infostealer-tiktok-clickfix-48-c2-domains</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AuraStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[TikTok]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 12:07:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[HPE AOS-CX Switches Vulnerable to Admin Password Reset (CVSS 9.8)]]></title>
            <description><![CDATA[CVE-2026-23813 allows unauthenticated attackers to reset admin passwords on HPE Aruba AOS-CX switches. No exploitation seen yet, but patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/hpe-aruba-aos-cx-cve-2026-23813-admin-password-reset</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hpe-aruba-aos-cx-cve-2026-23813-admin-password-reset</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[HPE]]></category>
            <category><![CDATA[Aruba]]></category>
            <category><![CDATA[CVE-2026-23813]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 16 Mar 2026 12:06:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Betterleaks: Gitleaks Creator Launches Faster Secrets Scanner]]></title>
            <description><![CDATA[Zach Rice, creator of Gitleaks, releases Betterleaks with BPE tokenization achieving 98.6% recall vs entropy's 70.4%. Drop-in replacement now available.]]></description>
            <link>https://www.probablypwned.com/article/betterleaks-gitleaks-secrets-scanner-zach-rice-aikido</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/betterleaks-gitleaks-secrets-scanner-zach-rice-aikido</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[secrets-scanning]]></category>
            <category><![CDATA[open-source]]></category>
            <category><![CDATA[gitleaks]]></category>
            <category><![CDATA[betterleaks]]></category>
            <category><![CDATA[devsecops]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese APT Targets Qatar Within Hours of Middle East Escalation]]></title>
            <description><![CDATA[Camaro Dragon weaponized missile strike lure documents to deploy PlugX backdoor against Qatari targets, exploiting Operation Epic Fury tensions for access.]]></description>
            <link>https://www.probablypwned.com/article/china-nexus-plugx-qatar-middle-east-conflict-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/china-nexus-plugx-qatar-middle-east-conflict-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Camaro Dragon]]></category>
            <category><![CDATA[PlugX]]></category>
            <category><![CDATA[Qatar]]></category>
            <category><![CDATA[Middle East]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:06:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT37 Deploys Five New Tools to Breach Air-Gapped Networks]]></title>
            <description><![CDATA[North Korean APT37's Ruby Jumper campaign uses RESTLEAF, THUMBSBD, and FOOTWINE malware to exfiltrate data from isolated systems via USB drives.]]></description>
            <link>https://www.probablypwned.com/article/apt37-ruby-jumper-air-gapped-systems-restleaf-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt37-ruby-jumper-air-gapped-systems-restleaf-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT37]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[air-gapped networks]]></category>
            <category><![CDATA[RESTLEAF]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:05:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korean Hackers Pose as Recruiters to Backdoor Developers]]></title>
            <description><![CDATA[Contagious Interview campaign weaponizes fake job interviews to deploy OtterCookie and FlexibleFerret malware. Targets crypto and AI developers for credentials.]]></description>
            <link>https://www.probablypwned.com/article/contagious-interview-north-korea-developer-job-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/contagious-interview-north-korea-developer-job-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[Contagious Interview]]></category>
            <category><![CDATA[developer security]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:04:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[A0Backdoor Hits Finance and Healthcare via Teams Impersonation]]></title>
            <description><![CDATA[Storm-1811 actors flood inboxes with spam, then call via Microsoft Teams posing as IT support. Quick Assist grants access for A0Backdoor deployment.]]></description>
            <link>https://www.probablypwned.com/article/a0backdoor-microsoft-teams-phishing-finance-healthcare</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/a0backdoor-microsoft-teams-phishing-finance-healthcare</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[A0Backdoor]]></category>
            <category><![CDATA[Microsoft Teams]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[Storm-1811]]></category>
            <category><![CDATA[finance]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:03:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GlassWorm Escalates: 72 Malicious VSCode Extensions Steal Credentials]]></title>
            <description><![CDATA[GlassWorm supply chain attack spreads via 72 Open VSX extensions using invisible Unicode obfuscation. Targets crypto wallets, API tokens, and CI/CD pipelines.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-vscode-extensions-72-malicious-supply-chain-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-vscode-extensions-72-malicious-supply-chain-attack</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[VSCode]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[developer security]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 15 Mar 2026 12:03:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AppsFlyer SDK Hijacked to Steal Crypto via Supply Chain Attack]]></title>
            <description><![CDATA[Attackers compromised AppsFlyer's domain registrar to inject crypto-stealing JavaScript into their Web SDK. The malware swaps wallet addresses for Bitcoin, Ethereum, Solana, and more.]]></description>
            <link>https://www.probablypwned.com/article/appsflyer-sdk-supply-chain-crypto-clipper-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/appsflyer-sdk-supply-chain-crypto-clipper-attack</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AppsFlyer]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[clipper malware]]></category>
            <category><![CDATA[JavaScript]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Starbucks Breach Exposes SSNs of 889 Employees via Phishing]]></title>
            <description><![CDATA[Attackers compromised 889 Starbucks Partner Central accounts using fake login portals, exposing employee names, Social Security numbers, and bank details.]]></description>
            <link>https://www.probablypwned.com/article/starbucks-partner-central-breach-889-employees-ssn-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/starbucks-partner-central-breach-889-employees-ssn-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Starbucks]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[employee data]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:07:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Storm-2561 Spreads Trojanized VPN Clients via SEO Poisoning]]></title>
            <description><![CDATA[Microsoft exposes Storm-2561 campaign using SEO manipulation to distribute fake Cisco, Fortinet, and Ivanti VPN clients that steal enterprise credentials.]]></description>
            <link>https://www.probablypwned.com/article/storm-2561-fake-vpn-clients-seo-poisoning-credential-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/storm-2561-fake-vpn-clients-seo-poisoning-credential-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Storm-2561]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:06:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[INTERPOL Operation Synergia III: 94 Arrests, 45K IPs Taken Down]]></title>
            <description><![CDATA[Global law enforcement operation spanning 72 countries arrests 94 cybercriminals and dismantles 45,000 malicious IPs tied to phishing, ransomware, and fraud networks.]]></description>
            <link>https://www.probablypwned.com/article/interpol-operation-synergia-iii-94-arrests-45000-ips-takedown</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/interpol-operation-synergia-iii-94-arrests-45000-ips-takedown</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[INTERPOL]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[cybercrime]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[takedown]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:05:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrackArmor: 9 AppArmor Flaws Expose 12.6M Linux Servers to Root]]></title>
            <description><![CDATA[Qualys discloses nine confused deputy vulnerabilities in Linux AppArmor that enable local privilege escalation to root. Ubuntu, Debian, and SUSE affected since 2017.]]></description>
            <link>https://www.probablypwned.com/article/crackarmor-apparmor-nine-flaws-12-million-linux-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crackarmor-apparmor-nine-flaws-12-million-linux-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[AppArmor]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[Qualys]]></category>
            <category><![CDATA[kernel]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:04:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Zero-Days CVE-2026-3909, CVE-2026-3910 Hit CISA KEV]]></title>
            <description><![CDATA[Google patches two actively exploited Chrome zero-days affecting Skia graphics and V8 JavaScript engine. CISA adds both to KEV catalog with March 27 deadline.]]></description>
            <link>https://www.probablypwned.com/article/chrome-zero-days-cve-2026-3909-3910-skia-v8-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-zero-days-cve-2026-3909-3910-skia-v8-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[V8]]></category>
            <category><![CDATA[Skia]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 14 Mar 2026 12:03:39 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI-Generated Slopoly Backdoor Powers Interlock Ransomware Attacks]]></title>
            <description><![CDATA[IBM X-Force discovers Hive0163 using LLM-generated Slopoly malware in Interlock ransomware attacks, marking a shift in how threat actors weaponize AI to accelerate malware development.]]></description>
            <link>https://www.probablypwned.com/article/slopoly-ai-generated-malware-interlock-ransomware-hive0163</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/slopoly-ai-generated-malware-interlock-ransomware-hive0163</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[AI-generated malware]]></category>
            <category><![CDATA[Interlock]]></category>
            <category><![CDATA[Hive0163]]></category>
            <category><![CDATA[ClickFix]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Salt Typhoon Affiliate Hits Telecoms in 30+ Countries With TernDoor]]></title>
            <description><![CDATA[China-linked UAT-9244 deploys TernDoor backdoor and peer-to-peer implants against telecom infrastructure across South America, North America, and Europe.]]></description>
            <link>https://www.probablypwned.com/article/uat-9244-salt-typhoon-terndoor-telecom-30-countries</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-9244-salt-typhoon-terndoor-telecom-30-countries</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Salt Typhoon]]></category>
            <category><![CDATA[UAT-9244]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[telecom]]></category>
            <category><![CDATA[TernDoor]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 12:06:53 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BeatBanker Malware Drains Brazilian Phones for Crypto and Creds]]></title>
            <description><![CDATA[New Android trojan BeatBanker mines Monero while stealing banking credentials. Spreads via fake Starlink and government apps in Brazil.]]></description>
            <link>https://www.probablypwned.com/article/beatbanker-android-malware-brazil-crypto-mining-banking</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/beatbanker-android-malware-brazil-crypto-mining-banking</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[BeatBanker]]></category>
            <category><![CDATA[Android malware]]></category>
            <category><![CDATA[cryptocurrency mining]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[Brazil]]></category>
            <category><![CDATA[BTMOB]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 12:06:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MicroStealer Evades Detection With Electron-to-Java Payload Chain]]></title>
            <description><![CDATA[New infostealer MicroStealer uses NSIS, Electron, and Java in a layered delivery chain that bypasses most security tools. Targets browser credentials and crypto wallets.]]></description>
            <link>https://www.probablypwned.com/article/microstealer-infostealer-electron-java-delivery-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microstealer-infostealer-electron-java-delivery-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[MicroStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Discord]]></category>
            <category><![CDATA[malware analysis]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 12:05:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Membership Plugin Flaw Lets Anyone Become Admin]]></title>
            <description><![CDATA[CVE-2026-1492 in User Registration & Membership plugin enables unauthenticated admin account creation. CVSS 9.8—over 100,000 sites at risk.]]></description>
            <link>https://www.probablypwned.com/article/cve-2026-1492-wordpress-membership-plugin-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cve-2026-1492-wordpress-membership-plugin-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-1492]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[plugin vulnerability]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 13 Mar 2026 12:04:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Veeam Patches Five Critical RCE Flaws in Backup & Replication]]></title>
            <description><![CDATA[Veeam releases emergency patches for five critical RCE vulnerabilities (CVSS 9.9) affecting Backup & Replication. Domain users can fully compromise backup servers.]]></description>
            <link>https://www.probablypwned.com/article/veeam-critical-rce-vulnerabilities-cvss-9-9-backup-servers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/veeam-critical-rce-vulnerabilities-cvss-9-9-backup-servers</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Veeam]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[backup security]]></category>
            <category><![CDATA[CVE-2026-21666]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 12 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Handala Wipes 200,000 Stryker Devices Using Microsoft Intune]]></title>
            <description><![CDATA[Iranian-linked hacktivists claim devastating attack on medical device maker Stryker, weaponizing Intune's remote wipe capability to erase systems in 79 countries.]]></description>
            <link>https://www.probablypwned.com/article/stryker-handala-wiper-200000-devices-intune-iran</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stryker-handala-wiper-200000-devices-intune-iran</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Handala]]></category>
            <category><![CDATA[Stryker]]></category>
            <category><![CDATA[wiper malware]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[Microsoft Intune]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 12 Mar 2026 12:06:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Deploys Dindoor Backdoor Against US Bank, Airport]]></title>
            <description><![CDATA[Iranian APT group breaches US critical infrastructure using novel Dindoor malware built on Deno runtime. Symantec links campaign to MOIS.]]></description>
            <link>https://www.probablypwned.com/article/muddywater-dindoor-backdoor-us-bank-airport-mois</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/muddywater-dindoor-backdoor-us-bank-airport-mois</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[Dindoor]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 12 Mar 2026 12:05:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds n8n RCE Flaw to KEV as 24,700 Instances Sit Exposed]]></title>
            <description><![CDATA[CVE-2025-68613 allows authenticated attackers to execute arbitrary code on n8n workflow servers. CISA gives federal agencies until March 25 to patch.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-n8n-cve-2025-68613-expression-injection-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-n8n-cve-2025-68613-expression-injection-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2025-68613]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 12 Mar 2026 12:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FIN6 Sends Fake Resumes to Recruiters to Deploy BlackSanta EDR Killer]]></title>
            <description><![CDATA[FIN6's year-long HR phishing campaign delivers BlackSanta, a tool that kills EDR and antivirus software before dropping final malware payloads. Recruiters are the target.]]></description>
            <link>https://www.probablypwned.com/article/fin6-hr-recruiter-malware-blacksanta-edr-killer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fin6-hr-recruiter-malware-blacksanta-edr-killer</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FIN6]]></category>
            <category><![CDATA[BlackSanta]]></category>
            <category><![CDATA[EDR killer]]></category>
            <category><![CDATA[HR phishing]]></category>
            <category><![CDATA[resume malware]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:35:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Five Malicious Rust Crates Posed as Time Utilities to Steal .env Files]]></title>
            <description><![CDATA[Researchers discovered five packages on crates.io masquerading as time utilities while exfiltrating developer credentials and API keys to attacker infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/malicious-rust-crates-time-utilities-env-file-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/malicious-rust-crates-time-utilities-env-file-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Rust]]></category>
            <category><![CDATA[crates.io]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[developer security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:28:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[KadNap Malware Hijacks 14,000 Routers for Underground Proxy Network]]></title>
            <description><![CDATA[New KadNap botnet targets Asus routers using peer-to-peer Kademlia protocol for stealth C2. Over 60% of infections in the US, linked to Faceless proxy service.]]></description>
            <link>https://www.probablypwned.com/article/kadnap-malware-14000-asus-routers-proxy-botnet</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kadnap-malware-14000-asus-routers-proxy-botnet</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[KadNap]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[Asus]]></category>
            <category><![CDATA[router malware]]></category>
            <category><![CDATA[proxy network]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:20:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ivanti EPM Auth Bypass Now Under Active Exploitation, CISA Warns]]></title>
            <description><![CDATA[CVE-2026-1603 allows unauthenticated attackers to steal credential vaults from Ivanti Endpoint Manager. CISA added it to KEV catalog after exploitation detected.]]></description>
            <link>https://www.probablypwned.com/article/ivanti-epm-cve-2026-1603-auth-bypass-cisa-kev-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ivanti-epm-cve-2026-1603-auth-bypass-cisa-kev-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CVE-2026-1603]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:12:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches 83 Flaws in March 2026, Two Zero-Days Disclosed]]></title>
            <description><![CDATA[Microsoft's March 2026 Patch Tuesday addresses 83 vulnerabilities including two publicly disclosed zero-days in SQL Server and .NET. Eight flaws rated Critical.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-march-2026-patch-tuesday-83-cves-two-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-march-2026-patch-tuesday-83-cves-two-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-21262]]></category>
            <category><![CDATA[CVE-2026-26127]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 11 Mar 2026 12:05:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Enables Windows Hotpatch Updates by Default in May]]></title>
            <description><![CDATA[Windows Autopatch will deliver rebootless security updates automatically for eligible devices starting May 2026. IT admins can opt out beginning April 1.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-windows-autopatch-hotpatch-default-may-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-windows-autopatch-hotpatch-default-may-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Windows 11]]></category>
            <category><![CDATA[Autopatch]]></category>
            <category><![CDATA[hotpatch]]></category>
            <category><![CDATA[security updates]]></category>
            <category><![CDATA[enterprise]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ericsson US Discloses Breach After Vendor Hack Exposes SSNs]]></title>
            <description><![CDATA[Ericsson's U.S. subsidiary confirms data theft affecting employees and customers after attackers compromised a service provider. SSNs, medical info, and financial details exposed.]]></description>
            <link>https://www.probablypwned.com/article/ericsson-us-vendor-data-breach-ssn-employee-customer-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ericsson-us-vendor-data-breach-ssn-employee-customer-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Ericsson]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[vendor breach]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[third-party risk]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 12:07:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TriZetto Breach Exposes 3.4 Million Healthcare Records]]></title>
            <description><![CDATA[Cognizant subsidiary TriZetto Provider Solutions confirms breach affecting 3.4 million patients. SSNs, Medicare IDs, and health data exposed after attackers went undetected for nearly a year.]]></description>
            <link>https://www.probablypwned.com/article/trizetto-cognizant-data-breach-3-4-million-healthcare-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trizetto-cognizant-data-breach-3-4-million-healthcare-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[TriZetto]]></category>
            <category><![CDATA[Cognizant]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[HIPAA]]></category>
            <category><![CDATA[PHI]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 12:06:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Velvet Tempest Deploys CastleRAT via ClickFix Attacks]]></title>
            <description><![CDATA[Ransomware affiliate Velvet Tempest uses ClickFix social engineering to deploy DonutLoader and CastleRAT in 12-day intrusion linked to Termite ransomware staging.]]></description>
            <link>https://www.probablypwned.com/article/velvet-tempest-clickfix-donutloader-castlerat-termite-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/velvet-tempest-clickfix-donutloader-castlerat-termite-ransomware</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Velvet Tempest]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[CastleRAT]]></category>
            <category><![CDATA[DonutLoader]]></category>
            <category><![CDATA[Termite]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 12:06:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Uses BEARDSHELL and COVENANT to Spy on Ukraine]]></title>
            <description><![CDATA[Russian GRU-linked APT28 deploys BEARDSHELL and COVENANT implants for long-term surveillance of Ukrainian military personnel. ESET research reveals cloud storage abuse for C2.]]></description>
            <link>https://www.probablypwned.com/article/apt28-beardshell-covenant-ukraine-military-surveillance</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-beardshell-covenant-ukraine-military-surveillance</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[BEARDSHELL]]></category>
            <category><![CDATA[COVENANT]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 10 Mar 2026 12:05:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI Assistants Are Rewriting the Defensive Security Playbook]]></title>
            <description><![CDATA[Autonomous AI agents expand attack surfaces faster than defenders can adapt. The economics make adoption inevitable—here's how security teams are responding.]]></description>
            <link>https://www.probablypwned.com/article/ai-assistants-defensive-security-attack-surface-expansion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-assistants-defensive-security-attack-surface-expansion</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[autonomous agents]]></category>
            <category><![CDATA[SOC automation]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[attack surface]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 16:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Silver Dragon Uses Google Drive as C2 in Government Attacks]]></title>
            <description><![CDATA[APT41-linked threat group deploys GearDoor backdoor via Google Drive for covert command-and-control. Check Point tracks campaigns across Europe and Southeast Asia.]]></description>
            <link>https://www.probablypwned.com/article/silver-dragon-apt41-geardoor-bamboloader-google-drive-c2</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/silver-dragon-apt41-geardoor-bamboloader-google-drive-c2</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Silver Dragon]]></category>
            <category><![CDATA[APT41]]></category>
            <category><![CDATA[GearDoor]]></category>
            <category><![CDATA[BamboLoader]]></category>
            <category><![CDATA[China]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 12:08:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VOID#GEIST Delivers XWorm and AsyncRAT via Fileless Injection]]></title>
            <description><![CDATA[Multi-stage malware campaign uses Python loaders and Early Bird APC injection to deploy encrypted RATs. TryCloudflare tunnels mask C2 infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/void-geist-malware-xworm-asyncrat-xenorat-fileless-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/void-geist-malware-xworm-asyncrat-xenorat-fileless-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VOID#GEIST]]></category>
            <category><![CDATA[XWorm]]></category>
            <category><![CDATA[AsyncRAT]]></category>
            <category><![CDATA[Xeno RAT]]></category>
            <category><![CDATA[fileless malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 12:06:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Atop EHG2408 Industrial Switch RCE Hits CVSS 9.3]]></title>
            <description><![CDATA[CVE-2026-3823 allows unauthenticated attackers to execute code on Atop Technologies industrial switches. Firmware 3.36 patches the critical buffer overflow.]]></description>
            <link>https://www.probablypwned.com/article/atop-ehg2408-switch-cve-2026-3823-rce-industrial-networks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/atop-ehg2408-switch-cve-2026-3823-rce-industrial-networks</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Atop Technologies]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[CVE-2026-3823]]></category>
            <category><![CDATA[industrial switch]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 12:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Delta Electronics COMMGR2 Flaws Score CVSS 9.8]]></title>
            <description><![CDATA[Two critical vulnerabilities in Delta Electronics COMMGR2 enable remote code execution without authentication. ICS operators should patch to v2.11.1 immediately.]]></description>
            <link>https://www.probablypwned.com/article/delta-electronics-commgr2-cve-2026-3630-3631-buffer-overflow</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/delta-electronics-commgr2-cve-2026-3630-3631-buffer-overflow</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Delta Electronics]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[CVE-2026-3630]]></category>
            <category><![CDATA[CVE-2026-3631]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 09 Mar 2026 12:04:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[White House Unveils 2026 Cybersecurity Strategy Prioritizing Offense]]></title>
            <description><![CDATA[New National Cybersecurity Strategy emphasizes offensive operations, deregulation, and emerging tech superiority. Six pillars outline federal cyber priorities through 2029.]]></description>
            <link>https://www.probablypwned.com/article/us-national-cybersecurity-strategy-2026-six-pillars-offense</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/us-national-cybersecurity-strategy-2026-six-pillars-offense</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[National Cybersecurity Strategy]]></category>
            <category><![CDATA[US policy]]></category>
            <category><![CDATA[offensive cyber]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[regulation]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sun, 08 Mar 2026 12:08:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SloppyLemming Espionage Campaign Targets South Asian Governments]]></title>
            <description><![CDATA[India-linked APT deploys BurrowShell backdoor and Rust-based RAT against Pakistan nuclear agencies, Bangladesh banks, and Sri Lankan government. 112 C2 domains identified.]]></description>
            <link>https://www.probablypwned.com/article/sloppylemming-apt-pakistan-bangladesh-burrowshell-rust-rat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sloppylemming-apt-pakistan-bangladesh-burrowshell-rust-rat</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[SloppyLemming]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Pakistan]]></category>
            <category><![CDATA[Bangladesh]]></category>
            <category><![CDATA[BurrowShell]]></category>
            <category><![CDATA[India]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 08 Mar 2026 12:07:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Caddy Server Flaw Lets Users Impersonate Admins]]></title>
            <description><![CDATA[CVE-2026-30851 in Caddy's forward_auth module enables identity injection and privilege escalation. Any valid user can impersonate administrators. Update to 2.11.2.]]></description>
            <link>https://www.probablypwned.com/article/caddy-cve-2026-30851-forward-auth-header-injection-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/caddy-cve-2026-30851-forward-auth-header-injection-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-30851]]></category>
            <category><![CDATA[Caddy]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[header injection]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 08 Mar 2026 12:06:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WeKnora AI Framework Hit with Twin CVSS 9.9 RCE Flaws]]></title>
            <description><![CDATA[Critical command injection and SQL bypass vulnerabilities in Tencent's WeKnora LLM framework allow unauthenticated RCE. Patch to versions 0.2.10 and 0.2.12 now.]]></description>
            <link>https://www.probablypwned.com/article/weknora-cve-2026-30860-30861-ai-framework-rce-cvss-9-9</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/weknora-cve-2026-30860-30861-ai-framework-rce-cvss-9-9</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-30860]]></category>
            <category><![CDATA[CVE-2026-30861]]></category>
            <category><![CDATA[WeKnora]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[LLM]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 08 Mar 2026 12:05:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran-Linked Dust Specter APT Deploys AI-Assisted Malware Against Iraq]]></title>
            <description><![CDATA[Zscaler uncovers Dust Specter campaign targeting Iraqi government officials with novel SPLITDROP and GHOSTFORM malware. Evidence suggests AI-assisted development.]]></description>
            <link>https://www.probablypwned.com/article/dust-specter-iran-apt-iraq-splitdrop-ghostform-ai-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dust-specter-iran-apt-iraq-splitdrop-ghostform-ai-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[Iraq]]></category>
            <category><![CDATA[Dust Specter]]></category>
            <category><![CDATA[SPLITDROP]]></category>
            <category><![CDATA[GHOSTFORM]]></category>
            <category><![CDATA[AI malware]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:17:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Flaws CVE-2026-20122 and 20128 Under Active Attack]]></title>
            <description><![CDATA[Cisco confirms active exploitation of two more SD-WAN Manager vulnerabilities. Attackers deploying web shells through arbitrary file overwrite and credential exposure flaws.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20122-20128-web-shell-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20122-20128-web-shell-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <category><![CDATA[CVE-2026-20122]]></category>
            <category><![CDATA[CVE-2026-20128]]></category>
            <category><![CDATA[web shell]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:13:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Investigating Hack of Wiretap Surveillance System]]></title>
            <description><![CDATA[The FBI confirms a sophisticated cyberattack targeted its internal wiretap and FISA warrant management system. Investigation ongoing with CISA and NSA involvement.]]></description>
            <link>https://www.probablypwned.com/article/fbi-surveillance-system-hack-wiretap-fisa-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-surveillance-system-hack-wiretap-fisa-march-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[surveillance]]></category>
            <category><![CDATA[wiretap]]></category>
            <category><![CDATA[FISA]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[government breach]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:08:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Manager Flaws Actively Exploited for Web Shells]]></title>
            <description><![CDATA[Cisco confirmed CVE-2026-20122 and CVE-2026-20128 in Catalyst SD-WAN Manager are under active exploitation, with attackers deploying web shells globally.]]></description>
            <link>https://www.probablypwned.com/article/cisco-catalyst-sd-wan-cve-2026-20122-20128-web-shell-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-catalyst-sd-wan-cve-2026-20122-20128-web-shell-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <category><![CDATA[CVE-2026-20122]]></category>
            <category><![CDATA[CVE-2026-20128]]></category>
            <category><![CDATA[web shell]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:06:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Wikipedia Hit by Self-Propagating JavaScript Worm]]></title>
            <description><![CDATA[A dormant JavaScript worm activated during a security review vandalized 4,000 Wikipedia pages in 23 minutes. Here's what happened and why it matters.]]></description>
            <link>https://www.probablypwned.com/article/wikipedia-javascript-worm-4000-pages-wikimedia-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wikipedia-javascript-worm-4000-pages-wikimedia-march-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Wikipedia]]></category>
            <category><![CDATA[JavaScript]]></category>
            <category><![CDATA[worm]]></category>
            <category><![CDATA[Wikimedia]]></category>
            <category><![CDATA[self-propagating malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Wikipedia Hit by Self-Propagating JavaScript Worm]]></title>
            <description><![CDATA[A dormant JavaScript worm activated during a Wikimedia security review modified 4,000 pages and infected 85 user scripts in 23 minutes before containment.]]></description>
            <link>https://www.probablypwned.com/article/wikipedia-javascript-worm-user-script-incident-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wikipedia-javascript-worm-user-script-incident-march-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Wikipedia]]></category>
            <category><![CDATA[JavaScript]]></category>
            <category><![CDATA[worm]]></category>
            <category><![CDATA[Wikimedia]]></category>
            <category><![CDATA[user scripts]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 07 Mar 2026 13:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dutch Paint Giant AkzoNobel Hit by Anubis Ransomware]]></title>
            <description><![CDATA[Anubis gang claims 170GB of data including passport scans and client agreements from AkzoNobel's US operations. Company says breach contained.]]></description>
            <link>https://www.probablypwned.com/article/akzonobel-anubis-ransomware-170gb-data-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/akzonobel-anubis-ransomware-170gb-data-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[AkzoNobel]]></category>
            <category><![CDATA[Anubis ransomware]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[manufacturing]]></category>
            <category><![CDATA[RaaS]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 06 Mar 2026 13:06:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Coruna iOS Exploit Kit: 23 Attacks From Spies to Criminals]]></title>
            <description><![CDATA[Government-grade iPhone exploits targeting iOS 13-17.2.1 now wielded by Russian spies and Chinese criminals. Lockdown Mode stops it cold.]]></description>
            <link>https://www.probablypwned.com/article/coruna-ios-exploit-kit-23-exploits-us-government-tools</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/coruna-ios-exploit-kit-23-exploits-us-government-tools</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Coruna]]></category>
            <category><![CDATA[iOS exploits]]></category>
            <category><![CDATA[spyware]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[Apple]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 06 Mar 2026 13:05:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Hikvision and Rockwell CVSS 9.8 Flaws to KEV Catalog]]></title>
            <description><![CDATA[Federal agencies must patch CVE-2017-7921 and CVE-2021-22681 by March 26. Hikvision cameras face active exploitation; Rockwell PLCs at risk.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-hikvision-rockwell-cvss-9-8-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-hikvision-rockwell-cvss-9-8-march-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[Hikvision]]></category>
            <category><![CDATA[Rockwell Automation]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[CVE-2017-7921]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 06 Mar 2026 13:05:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FreeScout Zero-Click RCE Lets Hackers Hijack Servers via Email]]></title>
            <description><![CDATA[CVE-2026-28289 allows unauthenticated attackers to achieve full server compromise by sending a single crafted email. CVSS 10.0—patch to 1.8.207 now.]]></description>
            <link>https://www.probablypwned.com/article/freescout-cve-2026-28289-zero-click-rce-email-cvss-10</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/freescout-cve-2026-28289-zero-click-rce-email-cvss-10</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[FreeScout]]></category>
            <category><![CDATA[CVE-2026-28289]]></category>
            <category><![CDATA[zero-click]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 06 Mar 2026 13:04:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Use Bing AI Search to Distribute GhostSocks Malware]]></title>
            <description><![CDATA[Malicious GitHub repositories exploiting Bing AI search results to distribute infostealers and GhostSocks proxy malware. Fake OpenClaw installers turn victims into residential proxies.]]></description>
            <link>https://www.probablypwned.com/article/bing-ai-ghostsocks-malware-fake-openclaw-github-repos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bing-ai-ghostsocks-malware-fake-openclaw-github-repos</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Bing AI]]></category>
            <category><![CDATA[GhostSocks]]></category>
            <category><![CDATA[GitHub]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[residential proxy]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 05 Mar 2026 13:07:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[HungerRush POS Extortion: Threat Actor Mass-Mails Restaurant Customers]]></title>
            <description><![CDATA[Attacker leverages infostealer-compromised credentials to extort restaurant POS provider HungerRush, sending threatening emails directly to customers demanding response.]]></description>
            <link>https://www.probablypwned.com/article/hungerrush-pos-extortion-infostealer-restaurant-customers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hungerrush-pos-extortion-infostealer-restaurant-customers</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[HungerRush]]></category>
            <category><![CDATA[POS]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[restaurant]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 05 Mar 2026 13:06:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LastPass Warns of Phishing Campaign Targeting Master Passwords]]></title>
            <description><![CDATA[Active phishing campaign uses spoofed email chains to trick LastPass users into revealing master passwords. Attackers generate thousands of URL variants leading to fake SSO pages.]]></description>
            <link>https://www.probablypwned.com/article/lastpass-phishing-campaign-master-password-theft-march-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lastpass-phishing-campaign-master-password-theft-march-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[LastPass]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[password manager]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 05 Mar 2026 13:05:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious Laravel Packages on Packagist Deploy Cross-Platform RAT]]></title>
            <description><![CDATA[Supply chain attack targets PHP developers via fake Laravel utilities containing encrypted RAT payload. The malware gains full access to database credentials and API keys.]]></description>
            <link>https://www.probablypwned.com/article/packagist-laravel-rat-supply-chain-attack-nhattuanbl</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/packagist-laravel-rat-supply-chain-attack-nhattuanbl</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[PHP]]></category>
            <category><![CDATA[Laravel]]></category>
            <category><![CDATA[Packagist]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[developer security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 05 Mar 2026 13:05:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco FMC RADIUS Flaw Scores CVSS 10 for Pre-Auth RCE]]></title>
            <description><![CDATA[CVE-2025-20265 in Cisco Secure Firewall Management Center allows unauthenticated attackers to execute commands as root via RADIUS authentication. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/cisco-fmc-cve-2025-20265-radius-rce-cvss-10</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-fmc-cve-2025-20265-radius-rce-cvss-10</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2025-20265]]></category>
            <category><![CDATA[RADIUS]]></category>
            <category><![CDATA[remote code execution]]></category>
            <category><![CDATA[firewall management]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 04 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran's Electronic Operations Room Coordinates RipperSec and 60 Hacktivist Groups]]></title>
            <description><![CDATA[Unit 42 details how Iran's Electronic Operations Room coordinated RipperSec and 60+ hacktivist groups claiming 150+ incidents in 72 hours during Operation Epic Fury.]]></description>
            <link>https://www.probablypwned.com/article/iran-electronic-operations-room-unit-42-hacktivist-surge</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-electronic-operations-room-unit-42-hacktivist-surge</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[hacktivism]]></category>
            <category><![CDATA[Unit 42]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[cyber warfare]]></category>
            <category><![CDATA[Middle East]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 04 Mar 2026 13:04:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AuraStealer Expands to 48 C2 Domains Filling Lumma Void]]></title>
            <description><![CDATA[Russian-speaking developers behind AuraStealer infostealer scale infrastructure to 48 command-and-control domains, targeting 110+ browsers and 250+ extensions.]]></description>
            <link>https://www.probablypwned.com/article/aurastealer-infostealer-48-c2-domains-lumma-successor</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aurastealer-infostealer-48-c2-domains-lumma-successor</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AuraStealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[C2 infrastructure]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 04 Mar 2026 13:03:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LexisNexis Breach Exposes Government and Law Firm Data]]></title>
            <description><![CDATA[FulcrumSec threat actor exploits React2Shell vulnerability to breach LexisNexis AWS infrastructure, leaking 2GB of customer data including .gov email addresses and federal employee records.]]></description>
            <link>https://www.probablypwned.com/article/lexisnexis-fulcrumsec-react2shell-aws-breach-gov-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lexisnexis-fulcrumsec-react2shell-aws-breach-gov-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[LexisNexis]]></category>
            <category><![CDATA[FulcrumSec]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[CVE-2025-55182]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[AWS]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korean StegaBin Campaign Hides C2 in Pastebin Essays]]></title>
            <description><![CDATA[Security researchers uncover 26 malicious npm packages using steganography to hide command infrastructure in computer science essays. Famous Chollima cluster targets developers with RAT.]]></description>
            <link>https://www.probablypwned.com/article/stegabin-north-korea-npm-pastebin-steganography-rat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stegabin-north-korea-npm-pastebin-steganography-rat</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[Famous Chollima]]></category>
            <category><![CDATA[StegaBin]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 13:04:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Eclipse OpenMQ Ships With Critical Default Admin Credentials]]></title>
            <description><![CDATA[CVE-2026-22886 exposes Eclipse OpenMQ to remote takeover via default admin/admin credentials. CVSS 9.8 critical vulnerability requires immediate attention from Java messaging users.]]></description>
            <link>https://www.probablypwned.com/article/openmq-cve-2026-22886-default-credentials-cvss-9-8</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openmq-cve-2026-22886-default-credentials-cvss-9-8</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenMQ]]></category>
            <category><![CDATA[Eclipse]]></category>
            <category><![CDATA[default credentials]]></category>
            <category><![CDATA[CVE-2026-22886]]></category>
            <category><![CDATA[Java]]></category>
            <category><![CDATA[message queue]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 13:04:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Linked to MSHTML Zero-Day Exploited Before Patch]]></title>
            <description><![CDATA[Security researchers tie Russia's APT28 to CVE-2026-21513 exploitation using malicious LNK files. The MSHTML zero-day was weaponized weeks before Microsoft's February patch.]]></description>
            <link>https://www.probablypwned.com/article/apt28-mshtml-zero-day-cve-2026-21513-russia-attribution</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-mshtml-zero-day-cve-2026-21513-russia-attribution</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[MSHTML]]></category>
            <category><![CDATA[CVE-2026-21513]]></category>
            <category><![CDATA[Fancy Bear]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 13:03:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Android March Patch Fixes Qualcomm Zero-Day Under Attack]]></title>
            <description><![CDATA[Google's March 2026 Android security update patches 129 vulnerabilities including CVE-2026-21385, a Qualcomm graphics flaw affecting 234 chipsets under active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/android-march-2026-qualcomm-zero-day-cve-2026-21385</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/android-march-2026-qualcomm-zero-day-cve-2026-21385</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[Qualcomm]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-21385]]></category>
            <category><![CDATA[mobile security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 03 Mar 2026 13:02:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Two Cybersecurity Pros Face 20 Years for ALPHV Ransomware Role]]></title>
            <description><![CDATA[Ryan Goldberg and Kevin Martin pleaded guilty to deploying ALPHV BlackCat ransomware while working in incident response and negotiation roles. Sentencing set for March 12.]]></description>
            <link>https://www.probablypwned.com/article/alphv-blackcat-cybersecurity-pros-guilty-plea-20-years</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/alphv-blackcat-cybersecurity-pros-guilty-plea-20-years</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[ALPHV]]></category>
            <category><![CDATA[BlackCat]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[insider threat]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[cybercrime]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 02 Mar 2026 13:07:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DDoS Attacks Now a Permanent Threat, Link11 Report Finds]]></title>
            <description><![CDATA[Link11's European Cyber Report 2026 reveals DDoS attacks increased 75% with systems under fire 88% of the year. Follow-up attacks surged 80% as attackers adopt persistence tactics.]]></description>
            <link>https://www.probablypwned.com/article/link11-european-ddos-report-2026-permanent-threat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/link11-european-ddos-report-2026-permanent-threat</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Link11]]></category>
            <category><![CDATA[Europe]]></category>
            <category><![CDATA[cybersecurity report]]></category>
            <category><![CDATA[threat trends]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 02 Mar 2026 13:06:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Disrupts UNC2814 GRIDTIDE Campaign Targeting 53 Orgs]]></title>
            <description><![CDATA[China-linked UNC2814 breached 53 organizations across 42 countries using GRIDTIDE malware that abuses Google Sheets for C2. Google terminates attacker infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/unc2814-gridtide-google-sheets-china-espionage-53-breaches</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unc2814-gridtide-google-sheets-china-espionage-53-breaches</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UNC2814]]></category>
            <category><![CDATA[GRIDTIDE]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Google Sheets]]></category>
            <category><![CDATA[cyberespionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 02 Mar 2026 13:05:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[U-Office Force CVE-2026-3422 Enables Unauthenticated RCE]]></title>
            <description><![CDATA[Critical insecure deserialization vulnerability in U-Office Force allows remote attackers to execute arbitrary code without authentication. CVSS 9.8, no patch available yet.]]></description>
            <link>https://www.probablypwned.com/article/u-office-force-cve-2026-3422-insecure-deserialization-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/u-office-force-cve-2026-3422-insecure-deserialization-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-3422]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[deserialization]]></category>
            <category><![CDATA[U-Office Force]]></category>
            <category><![CDATA[e-Excellence]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 02 Mar 2026 13:04:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Samsung Halts Texas TV Data Collection Without Consent]]></title>
            <description><![CDATA[Texas AG Ken Paxton secures settlement forcing Samsung to stop ACR surveillance of Texans' viewing habits without express consent. Four other TV makers still facing lawsuits.]]></description>
            <link>https://www.probablypwned.com/article/samsung-texas-acr-data-collection-express-consent-settlement</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/samsung-texas-acr-data-collection-express-consent-settlement</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Samsung]]></category>
            <category><![CDATA[privacy]]></category>
            <category><![CDATA[ACR]]></category>
            <category><![CDATA[Texas]]></category>
            <category><![CDATA[smart TV]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA: RESURGE Malware Can Remain Dormant on Ivanti Devices]]></title>
            <description><![CDATA[Updated CISA analysis reveals RESURGE implant uses advanced evasion techniques and can persist undetected on Ivanti Connect Secure devices until remote activation.]]></description>
            <link>https://www.probablypwned.com/article/cisa-resurge-malware-ivanti-dormant-persistence-update</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-resurge-malware-ivanti-dormant-persistence-update</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[RESURGE]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[CVE-2025-0282]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[rootkit]]></category>
            <category><![CDATA[backdoor]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 13:05:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UnsolicitedBooker APT Targets Central Asian Telecoms]]></title>
            <description><![CDATA[China-aligned threat group deploys LuciDoor and MarsSnake backdoors against telecom providers in Kyrgyzstan and Tajikistan, expanding from prior Saudi operations.]]></description>
            <link>https://www.probablypwned.com/article/unsolicitedbooker-china-apt-lucidoor-marssnake-central-asia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/unsolicitedbooker-china-apt-lucidoor-marssnake-central-asia</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UnsolicitedBooker]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[LuciDoor]]></category>
            <category><![CDATA[MarsSnake]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[telecommunications]]></category>
            <category><![CDATA[Central Asia]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 13:05:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[wpForo Forum Plugin Hit by Six Critical Vulnerabilities]]></title>
            <description><![CDATA[WordPress plugin wpForo 2.4.14 contains unauthenticated SQL injection, PHP object injection, and multiple authorization bypass flaws. Over 80,000 sites at risk.]]></description>
            <link>https://www.probablypwned.com/article/wpforo-forum-multiple-cves-sqli-rce-wordpress-plugin</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wpforo-forum-multiple-cves-sqli-rce-wordpress-plugin</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[wpForo]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[CVE-2026-28562]]></category>
            <category><![CDATA[CVE-2026-1581]]></category>
            <category><![CDATA[plugin vulnerabilities]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 13:04:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Juniper PTX Routers Vulnerable to Unauthenticated Root RCE]]></title>
            <description><![CDATA[Critical CVE-2026-21902 in Junos OS Evolved allows remote attackers to gain root access on PTX routers via exposed anomaly detection service. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/juniper-ptx-cve-2026-21902-root-rce-anomaly-detection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/juniper-ptx-cve-2026-21902-root-rce-anomaly-detection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Juniper]]></category>
            <category><![CDATA[CVE-2026-21902]]></category>
            <category><![CDATA[PTX routers]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[network infrastructure]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 01 Mar 2026 13:03:23 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558346490-a72e53ae2d4f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[QuickLens Chrome Extension Steals Crypto via ClickFix]]></title>
            <description><![CDATA[Malicious QuickLens browser add-on combines Google Lens functionality with ClickFix social engineering to drain cryptocurrency wallets through fake CAPTCHA prompts.]]></description>
            <link>https://www.probablypwned.com/article/quicklens-chrome-extension-clickfix-crypto-wallet-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/quicklens-chrome-extension-clickfix-crypto-wallet-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[QuickLens]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Chrome extension]]></category>
            <category><![CDATA[cryptocurrency theft]]></category>
            <category><![CDATA[StealC]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious OpenClaw Skills Trick AI Agents Into Installing macOS Stealer]]></title>
            <description><![CDATA[Trend Micro finds 2,200+ malicious skills weaponizing AI agents to deploy AMOS. The campaign marks a shift from prompt injection to using AI as a trusted intermediary for malware delivery.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-malicious-skills-amos-macos-stealer-ai-agents</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-malicious-skills-amos-macos-stealer-ai-agents</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[AMOS]]></category>
            <category><![CDATA[macOS stealer]]></category>
            <category><![CDATA[AI agent security]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:07:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Aeternum Botnet Uses Polygon Blockchain as Takedown-Proof C2]]></title>
            <description><![CDATA[New botnet loader stores encrypted commands in smart contracts on Polygon, making traditional infrastructure takedowns ineffective. Operating costs are under $1 for 100+ commands.]]></description>
            <link>https://www.probablypwned.com/article/aeternum-c2-botnet-polygon-blockchain-smart-contracts</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aeternum-c2-botnet-polygon-blockchain-smart-contracts</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Aeternum]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[blockchain C2]]></category>
            <category><![CDATA[Polygon]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:06:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1667984390527-850f63192709?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1667984390527-850f63192709?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious NuGet Package Impersonated Stripe to Steal API Tokens]]></title>
            <description><![CDATA[ReversingLabs caught StripeApi.Net typosquatting the official Stripe library. The package processed payments normally while exfiltrating API keys in the background.]]></description>
            <link>https://www.probablypwned.com/article/stripeapi-net-nuget-typosquat-supply-chain-attack-api-tokens</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stripeapi-net-nuget-typosquat-supply-chain-attack-api-tokens</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain attack]]></category>
            <category><![CDATA[NuGet]]></category>
            <category><![CDATA[typosquatting]]></category>
            <category><![CDATA[Stripe]]></category>
            <category><![CDATA[API token theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:05:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WeGIA Charity Management Platform Exposes Three Critical Flaws]]></title>
            <description><![CDATA[CVE-2026-28408 and related vulnerabilities allow unauthenticated attackers to bypass security, inject data, and execute code on WeGIA servers. Patch to version 3.6.5 immediately.]]></description>
            <link>https://www.probablypwned.com/article/wegia-cve-2026-28408-critical-auth-bypass-charitable-institutions</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wegia-cve-2026-28408-critical-auth-bypass-charitable-institutions</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-28408]]></category>
            <category><![CDATA[WeGIA]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <category><![CDATA[nonprofit security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:04:34 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Centreon Open Tickets Hit by Critical CVSS 9.9 Path Traversal Flaw]]></title>
            <description><![CDATA[CVE-2026-2749 enables unauthenticated attackers to write or delete arbitrary files on Centreon Central Servers. Patches now available for all supported versions.]]></description>
            <link>https://www.probablypwned.com/article/centreon-open-tickets-cve-2026-2749-critical-path-traversal</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/centreon-open-tickets-cve-2026-2749-critical-path-traversal</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-2749]]></category>
            <category><![CDATA[Centreon]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <category><![CDATA[IT monitoring]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 28 Feb 2026 13:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT37 Ruby Jumper Campaign Targets Air-Gapped Networks]]></title>
            <description><![CDATA[North Korean APT37 deploys six new malware tools to breach air-gapped systems using USB drives and cloud C2. Zscaler reveals RESTLEAF, THUMBSBD, and FOOTWINE surveillance capabilities.]]></description>
            <link>https://www.probablypwned.com/article/apt37-ruby-jumper-air-gapped-network-usb-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt37-ruby-jumper-air-gapped-network-usb-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT37]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[air-gapped networks]]></category>
            <category><![CDATA[USB malware]]></category>
            <category><![CDATA[state-sponsored]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Vikunja Auth Flaw Lets Attackers Maintain Access After Password Reset]]></title>
            <description><![CDATA[CVE-2026-27575 combines weak password enforcement with persistent sessions in Vikunja, enabling attackers to retain access even after victims change credentials.]]></description>
            <link>https://www.probablypwned.com/article/vikunja-cve-2026-27575-weak-password-persistent-sessions</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vikunja-cve-2026-27575-weak-password-persistent-sessions</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-27575]]></category>
            <category><![CDATA[Vikunja]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[session management]]></category>
            <category><![CDATA[open source]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 13:06:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dohdoor Backdoor Targets US Healthcare and Education Sectors]]></title>
            <description><![CDATA[Cisco Talos uncovers UAT-10027 deploying Dohdoor malware against American hospitals and schools. The backdoor uses DNS-over-HTTPS to evade detection.]]></description>
            <link>https://www.probablypwned.com/article/uat-10027-dohdoor-backdoor-us-healthcare-education</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-10027-dohdoor-backdoor-us-healthcare-education</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Dohdoor]]></category>
            <category><![CDATA[UAT-10027]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[DNS-over-HTTPS]]></category>
            <category><![CDATA[backdoor]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 13:05:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CVSS 9.4 Flaw Lets Attackers Hijack EV Charging Stations]]></title>
            <description><![CDATA[CVE-2026-20781 exposes OCPP WebSocket endpoints to unauthenticated station impersonation, enabling attackers to manipulate EV charging infrastructure and steal energy.]]></description>
            <link>https://www.probablypwned.com/article/ocpp-websocket-cve-2026-20781-ev-charging-impersonation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ocpp-websocket-cve-2026-20781-ev-charging-impersonation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-20781]]></category>
            <category><![CDATA[OCPP]]></category>
            <category><![CDATA[EV charging]]></category>
            <category><![CDATA[IoT security]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 13:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Xerox FreeFlow Core RCE Flaw Lets Attackers Hijack Print Servers]]></title>
            <description><![CDATA[CVE-2026-2251 is a CVSS 9.8 path traversal vulnerability in Xerox FreeFlow Core that enables unauthenticated remote code execution. Upgrade to version 8.1.0 now.]]></description>
            <link>https://www.probablypwned.com/article/xerox-freeflow-cve-2026-2251-path-traversal-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/xerox-freeflow-cve-2026-2251-path-traversal-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-2251]]></category>
            <category><![CDATA[Xerox]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[print security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 27 Feb 2026 13:03:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Next.js Job Tests Deploy In-Memory Malware via VS Code]]></title>
            <description><![CDATA[Microsoft uncovers developer-targeting campaign using fake coding assessments to deliver JavaScript backdoors through VS Code automation triggers and Vercel-hosted payloads.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-nextjs-fake-job-interview-malware-vscode-trigger</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-nextjs-fake-job-interview-malware-vscode-trigger</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[developer security]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[Contagious Interview]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 26 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LAPSUS$ Supergroup Paying Women $1,000 Per Vishing Call]]></title>
            <description><![CDATA[Scattered Lapsus$ Hunters offers $500-$1,000 to recruit women for IT help desk social engineering attacks. The supergroup combines LAPSUS$, Scattered Spider, and ShinyHunters tactics.]]></description>
            <link>https://www.probablypwned.com/article/scattered-lapsus-hunters-vishing-women-recruitment-it-helpdesk</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/scattered-lapsus-hunters-vishing-women-recruitment-it-helpdesk</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[LAPSUS$]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[SLH]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 26 Feb 2026 13:08:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Claude Code Flaws Let Malicious Repos Steal API Keys, Run Code]]></title>
            <description><![CDATA[Check Point found CVE-2025-59536 and CVE-2026-21852 in Anthropic's Claude Code. Opening a cloned repo could execute code and leak API credentials.]]></description>
            <link>https://www.probablypwned.com/article/claude-code-rce-api-key-exfiltration-hooks-mcp-check-point</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/claude-code-rce-api-key-exfiltration-hooks-mcp-check-point</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Claude Code]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[CVE-2025-59536]]></category>
            <category><![CDATA[CVE-2026-21852]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 26 Feb 2026 13:06:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenLIT GitHub Actions Flaw Exposes API Keys, Cloud Credentials]]></title>
            <description><![CDATA[CVE-2026-27941 (CVSS 9.9) lets attackers execute code via pull requests to OpenLIT, stealing GITHUB_TOKEN and cloud secrets. Patch to 1.37.1 now.]]></description>
            <link>https://www.probablypwned.com/article/openlit-cve-2026-27941-github-actions-critical-rce-secrets</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openlit-cve-2026-27941-github-actions-critical-rce-secrets</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-27941]]></category>
            <category><![CDATA[GitHub Actions]]></category>
            <category><![CDATA[OpenLIT]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[CI/CD security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 26 Feb 2026 13:04:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco SD-WAN Zero-Day Exploited Since 2023 Prompts CISA Alert]]></title>
            <description><![CDATA[CVE-2026-20127 gives attackers full admin access to Cisco SD-WAN infrastructure. CISA emergency directive requires federal patches by Feb 27.]]></description>
            <link>https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20127-zero-day-uat-8616</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-sd-wan-cve-2026-20127-zero-day-uat-8616</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <category><![CDATA[CVE-2026-20127]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[UAT-8616]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Copilot Bug Exposed Confidential Emails for Weeks]]></title>
            <description><![CDATA[Microsoft confirms Copilot bug bypassed DLP policies, reading confidential emails without authorization. European Parliament blocked Copilot over concerns.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-copilot-dlp-bypass-confidential-emails-cw1226324</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-copilot-dlp-bypass-confidential-emails-cw1226324</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Copilot]]></category>
            <category><![CDATA[DLP]]></category>
            <category><![CDATA[data leak]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 13:09:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Matanbuchus 3.0 Loader Delivers AstarionRAT in Hands-On Intrusion]]></title>
            <description><![CDATA[Huntress responds to ClickFix intrusion deploying Matanbuchus 3.0 and custom AstarionRAT. Attackers achieved lateral movement within 40 minutes.]]></description>
            <link>https://www.probablypwned.com/article/matanbuchus-3-astarionrat-clickfix-hands-on-keyboard-intrusion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/matanbuchus-3-astarionrat-clickfix-hands-on-keyboard-intrusion</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Matanbuchus]]></category>
            <category><![CDATA[AstarionRAT]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 13:08:17 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Anthropic Accuses Chinese AI Labs of Industrial-Scale Model Theft]]></title>
            <description><![CDATA[Anthropic alleges DeepSeek, Moonshot AI, and MiniMax used 24,000 fake accounts to extract Claude capabilities through 16 million distillation queries.]]></description>
            <link>https://www.probablypwned.com/article/anthropic-accuses-deepseek-moonshot-minimax-distillation-16m-queries</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/anthropic-accuses-deepseek-moonshot-minimax-distillation-16m-queries</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[DeepSeek]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[model distillation]]></category>
            <category><![CDATA[China]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 13:06:38 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135703-1787eea5ce01?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds FileZen CVE-2026-25108 to KEV After Active Exploitation]]></title>
            <description><![CDATA[CISA flags FileZen command injection flaw (CVE-2026-25108, CVSS 8.7) as actively exploited. Federal agencies must patch by March 17, 2026.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-filezen-cve-2026-25108-command-injection-soliton</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-filezen-cve-2026-25108-command-injection-soliton</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-25108]]></category>
            <category><![CDATA[FileZen]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[Soliton Systems]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 25 Feb 2026 13:05:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SolarWinds Patches Four Critical Serv-U Flaws With Root Access]]></title>
            <description><![CDATA[Serv-U 15.5.4 fixes four CVSS 9.1 bugs including type confusion and access control flaws. Admin access required, but file transfer platforms remain high-value targets.]]></description>
            <link>https://www.probablypwned.com/article/solarwinds-serv-u-15-5-4-four-critical-rce-vulnerabilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/solarwinds-serv-u-15-5-4-four-critical-rce-vulnerabilities</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[Serv-U]]></category>
            <category><![CDATA[CVE-2025-40538]]></category>
            <category><![CDATA[CVE-2025-40539]]></category>
            <category><![CDATA[file transfer]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 18:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PayPal Breach Exposed SSNs for Six Months Before Detection]]></title>
            <description><![CDATA[A coding error in PayPal Working Capital exposed customer SSNs and business data since July 2025. Unauthorized transactions detected on some affected accounts.]]></description>
            <link>https://www.probablypwned.com/article/paypal-working-capital-breach-ssn-six-months-exposure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/paypal-working-capital-breach-ssn-six-months-exposure</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[PayPal]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[fintech]]></category>
            <category><![CDATA[Working Capital]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 13:06:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chip Testing Giant Advantest Confirms Ransomware Attack]]></title>
            <description><![CDATA[Japanese semiconductor test equipment maker Advantest hit by ransomware on Feb 15. Investigation ongoing as company assesses potential data exposure.]]></description>
            <link>https://www.probablypwned.com/article/advantest-ransomware-semiconductor-testing-february-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/advantest-ransomware-semiconductor-testing-february-2026</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Advantest]]></category>
            <category><![CDATA[semiconductor]]></category>
            <category><![CDATA[Japan]]></category>
            <category><![CDATA[manufacturing]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 13:06:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Weaponize ClawHub Comments to Deliver Infostealers]]></title>
            <description><![CDATA[Threat actors bypass ClawHub security by hiding Base64 payloads in fake troubleshooting comments. Atomic Stealer delivered to unsuspecting OpenClaw users.]]></description>
            <link>https://www.probablypwned.com/article/clawhub-malicious-comments-atomic-stealer-base64-payload</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clawhub-malicious-comments-atomic-stealer-base64-payload</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ClawHub]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[Atomic Stealer]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[AI agent]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 13:05:49 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Serv-U Type Confusion Bug Enables Privileged Code Execution]]></title>
            <description><![CDATA[CVE-2025-40540 is a critical type confusion vulnerability in SolarWinds Serv-U with CVSS 9.1. Attackers with admin access can execute arbitrary code.]]></description>
            <link>https://www.probablypwned.com/article/serv-u-cve-2025-40540-critical-type-confusion-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/serv-u-cve-2025-40540-critical-type-confusion-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-40540]]></category>
            <category><![CDATA[Serv-U]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[type confusion]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 24 Feb 2026 13:05:20 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cloudflare's 6-Hour Outage Traced to API Query Bug]]></title>
            <description><![CDATA[Cloudflare's February 20 outage withdrew 25% of BYOIP customer prefixes after API query misinterpretation. 1,100 prefixes went offline for over six hours.]]></description>
            <link>https://www.probablypwned.com/article/cloudflare-byoip-outage-six-hours-api-bug-february-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cloudflare-byoip-outage-six-hours-api-bug-february-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cloudflare]]></category>
            <category><![CDATA[outage]]></category>
            <category><![CDATA[BYOIP]]></category>
            <category><![CDATA[BGP]]></category>
            <category><![CDATA[infrastructure]]></category>
            <category><![CDATA[incident response]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 23 Feb 2026 13:05:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Demands $1.5M From Wynn Resorts Over Stolen Data]]></title>
            <description><![CDATA[ShinyHunters claims 800,000+ Wynn Resorts employee records including SSNs, salaries, and personal details. Group demands 22 Bitcoin by February 23, exploited Oracle PeopleSoft.]]></description>
            <link>https://www.probablypwned.com/article/shinyhunters-wynn-resorts-800k-employee-records-oracle-peoplesoft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shinyhunters-wynn-resorts-800k-employee-records-oracle-peoplesoft</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[Wynn Resorts]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Oracle PeopleSoft]]></category>
            <category><![CDATA[employee data]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 23 Feb 2026 13:04:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Australian Court Files Exposed via Third-Party Offshoring Breach]]></title>
            <description><![CDATA[VIQ Solutions confirms sensitive Australian court data including domestic violence and national security cases accessed by unauthorized Indian subcontractor e24 Technologies.]]></description>
            <link>https://www.probablypwned.com/article/viq-solutions-australian-court-data-breach-e24-technologies</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/viq-solutions-australian-court-data-breach-e24-technologies</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Australia]]></category>
            <category><![CDATA[VIQ Solutions]]></category>
            <category><![CDATA[court records]]></category>
            <category><![CDATA[third-party risk]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 23 Feb 2026 13:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1586281380349-632531db7ed4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Deploys GhostFetch and Telegram-Based Backdoors]]></title>
            <description><![CDATA[Iranian APT MuddyWater launches Operation Olalampo against MENA organizations, deploying four new malware families including GhostFetch and CHAR, a Rust backdoor controlled via Telegram.]]></description>
            <link>https://www.probablypwned.com/article/muddywater-operation-olalampo-ghostfetch-mena-telegram</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/muddywater-operation-olalampo-ghostfetch-mena-telegram</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[GhostFetch]]></category>
            <category><![CDATA[Telegram malware]]></category>
            <category><![CDATA[MENA]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 23 Feb 2026 13:03:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Arkanix Stealer: AI-Assisted MaaS Infostealer Folds Fast]]></title>
            <description><![CDATA[Kaspersky exposes Arkanix Stealer, a Python and C++ infostealer likely built with LLM assistance. After two months of targeting crypto wallets and VPNs, the operation vanished.]]></description>
            <link>https://www.probablypwned.com/article/arkanix-stealer-ai-assisted-maas-infostealer-shutdown</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/arkanix-stealer-ai-assisted-maas-infostealer-shutdown</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[AI-generated malware]]></category>
            <category><![CDATA[MaaS]]></category>
            <category><![CDATA[cryptocurrency theft]]></category>
            <category><![CDATA[Kaspersky]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[France's National Bank Database Breached, 1.2M Accounts Exposed]]></title>
            <description><![CDATA[Attacker impersonating civil servant accessed French FICOBA registry containing 300M+ bank account records. 1.2 million accounts compromised in late January attack.]]></description>
            <link>https://www.probablypwned.com/article/france-ficoba-bank-database-breach-1-2-million-accounts</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/france-ficoba-bank-database-breach-1-2-million-accounts</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[France]]></category>
            <category><![CDATA[FICOBA]]></category>
            <category><![CDATA[government breach]]></category>
            <category><![CDATA[banking data]]></category>
            <category><![CDATA[identity theft]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 13:07:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Massiv Android Trojan Spreads via Fake IPTV Apps]]></title>
            <description><![CDATA[Banking trojan disguised as IPTV streaming apps targets users in Portugal and Greece, enabling device takeover and credential theft through overlay attacks.]]></description>
            <link>https://www.probablypwned.com/article/massiv-android-trojan-iptv-apps-banking-fraud</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/massiv-android-trojan-iptv-apps-banking-fraud</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Android malware]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[IPTV]]></category>
            <category><![CDATA[Massiv]]></category>
            <category><![CDATA[mobile security]]></category>
            <category><![CDATA[overlay attacks]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 13:06:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CRESCENTHARVEST RAT Targets Iranian Protest Supporters]]></title>
            <description><![CDATA[New espionage campaign uses protest-themed lures and Chrome DLL side-loading to deploy RAT malware against Iranian diaspora, activists, and journalists.]]></description>
            <link>https://www.probablypwned.com/article/crescentharvest-iran-protest-espionage-chrome-dll-sideload</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crescentharvest-iran-protest-espionage-chrome-dll-sideload</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <category><![CDATA[CRESCENTHARVEST]]></category>
            <category><![CDATA[Chrome abuse]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 13:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI-Assisted Attacker Compromises 600+ FortiGate Firewalls]]></title>
            <description><![CDATA[Amazon threat intelligence exposes Russian-speaking actor using generative AI to breach 600+ FortiGate devices across 55 countries. Attack used ARXON tool with DeepSeek and Claude.]]></description>
            <link>https://www.probablypwned.com/article/ai-assisted-threat-actor-fortigate-600-devices-arxon</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-assisted-threat-actor-fortigate-600-devices-arxon</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[FortiGate]]></category>
            <category><![CDATA[AI attacks]]></category>
            <category><![CDATA[credential stuffing]]></category>
            <category><![CDATA[ARXON]]></category>
            <category><![CDATA[Amazon threat intel]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 22 Feb 2026 13:04:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mississippi's Largest Hospital System Closes All Clinics After Ransomware Attack]]></title>
            <description><![CDATA[University of Mississippi Medical Center shuts 35 clinics statewide after ransomware attack disables Epic EHR access. FBI investigating as doctors resort to pen and paper for patient care.]]></description>
            <link>https://www.probablypwned.com/article/ummc-mississippi-ransomware-attack-clinics-closed-fbi</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ummc-mississippi-ransomware-attack-clinics-closed-fbi</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[UMMC]]></category>
            <category><![CDATA[Mississippi]]></category>
            <category><![CDATA[FBI]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 21 Feb 2026 13:06:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PromptSpy: First Android Malware Using Gemini AI at Runtime]]></title>
            <description><![CDATA[ESET discovers PromptSpy, the first Android malware weaponizing Google's Gemini AI to maintain persistence by analyzing UI and generating real-time tap instructions to stay pinned in recent apps.]]></description>
            <link>https://www.probablypwned.com/article/promptspy-android-malware-gemini-ai-persistence</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/promptspy-android-malware-gemini-ai-persistence</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[Gemini]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[PromptSpy]]></category>
            <category><![CDATA[ESET]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 21 Feb 2026 13:05:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ClickFix Campaign Deploys MIMICRAT Through Compromised BIN Sites]]></title>
            <description><![CDATA[Elastic Security Labs uncovers ClickFix campaign abusing compromised bincheck.io to deliver MIMICRAT, a custom C++ RAT with SOCKS5 tunneling and token impersonation capabilities.]]></description>
            <link>https://www.probablypwned.com/article/clickfix-mimicrat-compromised-sites-elastic-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clickfix-mimicrat-compromised-sites-elastic-security</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[MIMICRAT]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 21 Feb 2026 13:04:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Two Roundcube Flaws to KEV After Active Exploitation]]></title>
            <description><![CDATA[CISA adds CVE-2025-49113 (CVSS 9.9) and CVE-2025-68461 to KEV catalog after attackers weaponized the deserialization flaw within 48 hours. Federal agencies must patch by March 13.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-roundcube-cve-2025-49113-cve-2025-68461-actively-exploited</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-roundcube-cve-2025-49113-cve-2025-68461-actively-exploited</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[Roundcube]]></category>
            <category><![CDATA[CVE-2025-49113]]></category>
            <category><![CDATA[webmail]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 21 Feb 2026 13:03:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hacking AI Platform WormGPT Breached, 19,000 Users Exposed]]></title>
            <description><![CDATA[WormGPT database allegedly leaked on dark web forums, exposing emails, payment data, and subscription details of cybercriminals using the service.]]></description>
            <link>https://www.probablypwned.com/article/wormgpt-data-breach-19000-users-exposed-dark-web</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wormgpt-data-breach-19000-users-exposed-dark-web</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[WormGPT]]></category>
            <category><![CDATA[Data Breach]]></category>
            <category><![CDATA[Dark Web]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[Cybercrime]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 20 Feb 2026 13:07:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Unit 42 Tracks SparkRAT, VShell in BeyondTrust Attacks]]></title>
            <description><![CDATA[Attackers exploiting CVE-2026-1731 deploy cross-platform backdoors across finance, healthcare, and tech. Over 10,600 instances remain exposed.]]></description>
            <link>https://www.probablypwned.com/article/beyondtrust-sparkrat-vshell-unit42-exploitation-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/beyondtrust-sparkrat-vshell-unit42-exploitation-campaign</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[BeyondTrust]]></category>
            <category><![CDATA[SparkRAT]]></category>
            <category><![CDATA[VShell]]></category>
            <category><![CDATA[Unit 42]]></category>
            <category><![CDATA[CVE-2026-1731]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 20 Feb 2026 13:07:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Windows Admin Center Flaw Enables Full Domain Takeover]]></title>
            <description><![CDATA[CVE-2026-26119 lets attackers escalate from standard user to domain admin via improper authentication. Microsoft rates exploitation 'more likely.']]></description>
            <link>https://www.probablypwned.com/article/windows-admin-center-cve-2026-26119-privilege-escalation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/windows-admin-center-cve-2026-26119-privilege-escalation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Windows Admin Center]]></category>
            <category><![CDATA[CVE-2026-26119]]></category>
            <category><![CDATA[Privilege Escalation]]></category>
            <category><![CDATA[Active Directory]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 20 Feb 2026 13:06:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Semantic Kernel RCE Flaw Scores Perfect 10.0 CVSS]]></title>
            <description><![CDATA[CVE-2026-26030 in Microsoft's Semantic Kernel Python SDK enables unauthenticated RCE through InMemoryVectorStore. Upgrade to 1.39.4 immediately.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-semantic-kernel-cve-2026-26030-critical-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-semantic-kernel-cve-2026-26030-critical-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Semantic Kernel]]></category>
            <category><![CDATA[CVE-2026-26030]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[Python]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 20 Feb 2026 13:05:55 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Feds to Patch Dell Flaw Within 3 Days]]></title>
            <description><![CDATA[Federal agencies must patch CVE-2026-22769 by Saturday after CISA confirms Chinese hackers exploited the Dell RecoverPoint vulnerability since 2024.]]></description>
            <link>https://www.probablypwned.com/article/cisa-dell-recoverpoint-cve-2026-22769-3-day-patch-deadline</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-dell-recoverpoint-cve-2026-22769-3-day-patch-deadline</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Dell]]></category>
            <category><![CDATA[CVE-2026-22769]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[patch management]]></category>
            <category><![CDATA[federal agencies]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 19:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Secure AI Factory with NVIDIA: Partner Revenue at Scale]]></title>
            <description><![CDATA[Cisco 360 Partner Program offers new AI specializations and certifications tied to NVIDIA partnership, with $267B in projected partner-delivered AI services by 2030.]]></description>
            <link>https://www.probablypwned.com/article/cisco-secure-ai-factory-nvidia-partner-opportunity-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-secure-ai-factory-nvidia-partner-opportunity-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[NVIDIA]]></category>
            <category><![CDATA[AI infrastructure]]></category>
            <category><![CDATA[partner program]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco AI Security Report: 83% Want Agents, 29% Ready]]></title>
            <description><![CDATA[Cisco's State of AI Security 2026 report reveals a dangerous gap between agentic AI adoption ambitions and enterprise security readiness. Here's what the threat landscape looks like.]]></description>
            <link>https://www.probablypwned.com/article/cisco-state-of-ai-security-2026-report-threat-landscape</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-state-of-ai-security-2026-report-threat-landscape</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[agentic AI]]></category>
            <category><![CDATA[shadow AI]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[MCP]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Inside DynoWiper: Mersenne Twister PRNG and File Destruction]]></title>
            <description><![CDATA[SANS ISC analyzes DynoWiper's internals revealing Mersenne Twister seeding, 16-byte overwrite buffers, and directory exclusions. Technical breakdown of Sandworm's latest wiper.]]></description>
            <link>https://www.probablypwned.com/article/dynowiper-technical-analysis-mersenne-twister-sandworm</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dynowiper-technical-analysis-mersenne-twister-sandworm</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[DynoWiper]]></category>
            <category><![CDATA[Sandworm]]></category>
            <category><![CDATA[wiper malware]]></category>
            <category><![CDATA[malware analysis]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509718443690-d8e2fb3474b7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DDoS Attacks Surge 168% as NoName057 Sets Attack Record]]></title>
            <description><![CDATA[Radware's 2026 threat report reveals network-layer DDoS attacks jumped 168% year-over-year. NoName057 claimed 4,693 attacks, setting a new hacktivist record.]]></description>
            <link>https://www.probablypwned.com/article/radware-ddos-report-2026-168-percent-increase-noname057</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/radware-ddos-report-2026-168-percent-increase-noname057</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Radware]]></category>
            <category><![CDATA[NoName057]]></category>
            <category><![CDATA[Threat Report]]></category>
            <category><![CDATA[Hacktivism]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 13:06:04 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ClickFix Attacks Now Abuse DNS to Evade Security Tools]]></title>
            <description><![CDATA[Microsoft warns of ClickFix variant using nslookup commands to stage malware via DNS traffic. Delivers ModeloRAT through fileless attack chain.]]></description>
            <link>https://www.probablypwned.com/article/clickfix-dns-nslookup-modelorat-microsoft-disclosure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clickfix-dns-nslookup-modelorat-microsoft-disclosure</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[ModeloRAT]]></category>
            <category><![CDATA[DNS Abuse]]></category>
            <category><![CDATA[Social Engineering]]></category>
            <category><![CDATA[Malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 13:05:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Grandstream VoIP Phones Vulnerable to Silent Eavesdropping]]></title>
            <description><![CDATA[CVE-2026-2329 (CVSS 9.3) enables unauthenticated RCE on Grandstream GXP1600 VoIP phones. Attackers can intercept calls, steal credentials. Patch to 1.0.7.81.]]></description>
            <link>https://www.probablypwned.com/article/grandstream-voip-cve-2026-2329-critical-rce-eavesdropping</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/grandstream-voip-cve-2026-2329-critical-rce-eavesdropping</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-2329]]></category>
            <category><![CDATA[VoIP]]></category>
            <category><![CDATA[Grandstream]]></category>
            <category><![CDATA[Buffer Overflow]]></category>
            <category><![CDATA[IoT Security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 13:04:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CleanTalk WordPress Plugin Flaw Exposes 200K Sites to Takeover]]></title>
            <description><![CDATA[Critical CVE-2026-1490 (CVSS 9.8) in CleanTalk anti-spam plugin allows unauthenticated attackers to install malicious plugins via DNS spoofing. Update to 6.72 now.]]></description>
            <link>https://www.probablypwned.com/article/cleantalk-wordpress-cve-2026-1490-critical-auth-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cleantalk-wordpress-cve-2026-1490-critical-auth-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-1490]]></category>
            <category><![CDATA[Plugin Vulnerability]]></category>
            <category><![CDATA[CleanTalk]]></category>
            <category><![CDATA[Authorization Bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 13:03:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GPT-OSS-Safeguard Models Fail Multi-Turn Jailbreak Testing]]></title>
            <description><![CDATA[Cisco AI Defense research finds OpenAI's safeguard models perform worse than standard versions under sustained attack. Multi-turn jailbreaks spike success rates up to 92%.]]></description>
            <link>https://www.probablypwned.com/article/cisco-gpt-oss-safeguard-jailbreak-testing-ai-safety</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-gpt-oss-safeguard-jailbreak-testing-ai-safety</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[jailbreaking]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[GPT-OSS]]></category>
            <category><![CDATA[LLM safety]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 19 Feb 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco DevNet Launches AI Repos Catalog for MCP Servers]]></title>
            <description><![CDATA[New catalog at developer.cisco.com/codeexchange/ai centralizes AI agents and MCP servers for network automation, with built-in testing tools.]]></description>
            <link>https://www.probablypwned.com/article/cisco-devnet-code-exchange-ai-repos-catalog-mcp-agents</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-devnet-code-exchange-ai-repos-catalog-mcp-agents</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[DevNet]]></category>
            <category><![CDATA[MCP]]></category>
            <category><![CDATA[AI agents]]></category>
            <category><![CDATA[network automation]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 19:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dell Zero-Day Exploited by Chinese Hackers Since 2024]]></title>
            <description><![CDATA[Chinese threat group UNC6201 exploited a critical hardcoded credential flaw (CVE-2026-22769) in Dell RecoverPoint for 18 months before disclosure. Patch now.]]></description>
            <link>https://www.probablypwned.com/article/dell-recoverpoint-cve-2026-22769-unc6201-china-apt-zero-day</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dell-recoverpoint-cve-2026-22769-unc6201-china-apt-zero-day</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Dell]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-22769]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[UNC6201]]></category>
            <category><![CDATA[BRICKSTORM]]></category>
            <category><![CDATA[GRIMBOLT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Talos Fuzzes Industrial Gateway, Finds Six DoS Vulnerabilities]]></title>
            <description><![CDATA[Cisco Talos researcher uses 'good enough' emulation to fuzz Socomec DIRIS M-70 energy gateway, discovering CVE-2025-54848 through CVE-2025-55222 in Modbus protocol handling.]]></description>
            <link>https://www.probablypwned.com/article/talos-good-enough-emulation-fuzzing-socomec-modbus-cves</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/talos-good-enough-emulation-fuzzing-socomec-modbus-cves</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[fuzzing]]></category>
            <category><![CDATA[Modbus]]></category>
            <category><![CDATA[CVE-2025-54848]]></category>
            <category><![CDATA[Socomec]]></category>
            <category><![CDATA[industrial-security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft: macOS Infostealers Surge With ClickFix and Python]]></title>
            <description><![CDATA[Microsoft Defender Experts track expanding infostealer campaigns hitting macOS via ClickFix prompts, malicious DMG installers, and Python-based stealers. DigitStealer, MacSync, and AMOS lead the wave.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-macos-infostealers-clickfix-python-cross-platform</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-macos-infostealers-clickfix-python-cross-platform</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[DigitStealer]]></category>
            <category><![CDATA[MacSync]]></category>
            <category><![CDATA[Atomic Stealer]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 13:04:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TeamPCP Worm Turns Cloud Misconfigs Into Cybercrime Platform]]></title>
            <description><![CDATA[Cloud-native worm campaign by TeamPCP has compromised 60,000+ servers by exploiting Docker APIs, Kubernetes, and React2Shell. Flare researchers detail the industrialized operation.]]></description>
            <link>https://www.probablypwned.com/article/teampcp-worm-cloud-infrastructure-react2shell-cryptomining</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/teampcp-worm-cloud-infrastructure-react2shell-cryptomining</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TeamPCP]]></category>
            <category><![CDATA[worm]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[Kubernetes]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[cryptomining]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 13:03:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1667984390527-850f63192709?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1667984390527-850f63192709?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds Four Flaws to KEV, Including 17-Year-Old ActiveX Bug]]></title>
            <description><![CDATA[CISA confirms active exploitation of Chrome CVE-2026-2441, Zimbra SSRF, Windows ActiveX CVE-2008-0015, and ThreatSonar flaws. Federal agencies face March 10 deadline.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-chrome-zimbra-activex-threatsonar-february-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-chrome-zimbra-activex-threatsonar-february-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[Zimbra]]></category>
            <category><![CDATA[ActiveX]]></category>
            <category><![CDATA[CVE-2026-2441]]></category>
            <category><![CDATA[CVE-2008-0015]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 13:02:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SANS Analyst Tracks Malware Using Recycled PNG Payload]]></title>
            <description><![CDATA[Xavier Mertens discovers 846 images reusing the same Base64 steganography technique to deliver .NET malware via Equation Editor exploits. Here's how defenders can hunt for copycats.]]></description>
            <link>https://www.probablypwned.com/article/sans-isc-malware-campaign-tracking-reused-png-payloads</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sans-isc-malware-campaign-tracking-reused-png-payloads</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[SANS]]></category>
            <category><![CDATA[threat hunting]]></category>
            <category><![CDATA[YARA]]></category>
            <category><![CDATA[CVE-2017-11882]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 18 Feb 2026 11:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Moltbook Breach Exposes 1.5 Million AI Agent API Keys]]></title>
            <description><![CDATA[Wiz researchers found Moltbook's Supabase database exposed without authentication, leaking 1.5M API tokens, private messages, and plaintext OpenAI keys.]]></description>
            <link>https://www.probablypwned.com/article/moltbook-exposed-database-1-5-million-ai-agent-api-keys</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/moltbook-exposed-database-1-5-million-ai-agent-api-keys</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Moltbook]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[API keys]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Supabase]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Warns TLS Certificate Changes Could Break mTLS]]></title>
            <description><![CDATA[Public CAs will stop issuing TLS certificates with clientAuth EKU by June 2026. Cisco outlines the impact on CUBE, Expressway, and mTLS deployments.]]></description>
            <link>https://www.probablypwned.com/article/cisco-tls-clientauth-certificate-changes-june-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-tls-clientauth-certificate-changes-june-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[TLS]]></category>
            <category><![CDATA[mTLS]]></category>
            <category><![CDATA[certificates]]></category>
            <category><![CDATA[PKI]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Report Shows 8x Enterprise AI Growth—Networks Are the Bottleneck]]></title>
            <description><![CDATA[OpenAI's State of Enterprise AI shows 8x adoption growth and 320x reasoning usage. Cisco explains why your network architecture probably can't keep up.]]></description>
            <link>https://www.probablypwned.com/article/openai-enterprise-ai-report-cisco-network-infrastructure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-enterprise-ai-report-cisco-network-infrastructure</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[enterprise AI]]></category>
            <category><![CDATA[network infrastructure]]></category>
            <category><![CDATA[AgenticOps]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 15:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Infostealers Now Targeting AI Agent Configurations]]></title>
            <description><![CDATA[Hudson Rock detects Vidar infostealer exfiltrating OpenClaw AI agent files for the first time. Stolen configs include gateway tokens and cryptographic keys.]]></description>
            <link>https://www.probablypwned.com/article/vidar-infostealer-openclaw-ai-agent-configuration-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vidar-infostealer-openclaw-ai-agent-configuration-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[Vidar]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 13:03:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Patches Chrome Zero-Day Under Active Exploitation]]></title>
            <description><![CDATA[CVE-2026-2441 is a high-severity CSS use-after-free in Chrome being exploited in the wild. Update to version 145.0.7632.75 immediately.]]></description>
            <link>https://www.probablypwned.com/article/chrome-zero-day-cve-2026-2441-css-use-after-free-active-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-zero-day-cve-2026-2441-css-use-after-free-active-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-2441]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 13:02:30 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376573-df3480f0c6ff?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MetaMask Users Hit by Phishing Using Fake Security Reports]]></title>
            <description><![CDATA[SANS ISC documents phishing campaign using fabricated incident reports to steal MetaMask wallet credentials. Attackers host phishing pages on AWS S3.]]></description>
            <link>https://www.probablypwned.com/article/metamask-fake-incident-report-phishing-aws-s3</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/metamask-fake-incident-report-phishing-aws-s3</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[MetaMask]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[AWS]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 17 Feb 2026 11:22:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lumma Stealer Abuses Google Groups for C2 in New Campaign]]></title>
            <description><![CDATA[CTM360 exposes 4,000+ malicious Google Groups delivering Lumma Stealer and Ninja Browser malware. Attackers pose as tech support in forums to bypass network detection.]]></description>
            <link>https://www.probablypwned.com/article/lumma-stealer-ninja-browser-google-groups-c2-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lumma-stealer-ninja-browser-google-groups-c2-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Lumma Stealer]]></category>
            <category><![CDATA[Google Groups]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[command and control]]></category>
            <category><![CDATA[Ninja Browser]]></category>
            <category><![CDATA[CTM360]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 18:23:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrashFix Malware Crashes Browsers to Trick Enterprise Users]]></title>
            <description><![CDATA[Microsoft warns of ClickFix variant that deliberately crashes Chrome, then social-engineers victims into running PowerShell. Only domain-joined hosts targeted.]]></description>
            <link>https://www.probablypwned.com/article/crashfix-clickfix-malware-enterprise-browser-crash</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crashfix-clickfix-malware-enterprise-browser-crash</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[CrashFix]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[ModeloRAT]]></category>
            <category><![CDATA[enterprise malware]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 13:03:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Sandbox Escape CVE-2026-25049 Bypasses Prior Fix]]></title>
            <description><![CDATA[New n8n RCE flaw bypasses December patch through type confusion. CVSS 9.4 vulnerability enables unauthenticated command execution via malicious workflows.]]></description>
            <link>https://www.probablypwned.com/article/n8n-cve-2026-25049-sandbox-escape-rce-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-cve-2026-25049-sandbox-escape-rce-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-25049]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[type confusion]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 13:02:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dutch Telecom Odido Breach Exposes 6.2 Million Customers]]></title>
            <description><![CDATA[Odido confirms cyberattack exposed names, IBANs, passport numbers, and personal data of 6.2 million Dutch customers. Services remain operational.]]></description>
            <link>https://www.probablypwned.com/article/odido-netherlands-breach-6-million-customer-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/odido-netherlands-breach-6-million-customer-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Odido]]></category>
            <category><![CDATA[Netherlands]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[telecom]]></category>
            <category><![CDATA[IBAN]]></category>
            <category><![CDATA[GDPR]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 13:02:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apple Patches Zero-Day Used in 'Sophisticated' Attacks]]></title>
            <description><![CDATA[CVE-2026-20700 memory corruption flaw in dyld exploited against targeted individuals. Google TAG credited with discovery. Patch now for iOS, macOS, watchOS.]]></description>
            <link>https://www.probablypwned.com/article/apple-zero-day-cve-2026-20700-dyld-sophisticated-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apple-zero-day-cve-2026-20700-dyld-sophisticated-attacks</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-20700]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[Google TAG]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 15 Feb 2026 13:01:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Valentine's Day Phishing Domains Surge 44% Ahead of Feb 14]]></title>
            <description><![CDATA[Check Point documents 44% spike in fake Valentine's domains with 97.5% unclassified. Four in ten Valentine-themed emails are scams targeting U.S. consumers.]]></description>
            <link>https://www.probablypwned.com/article/valentines-day-phishing-44-percent-domain-surge-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/valentines-day-phishing-44-percent-domain-surge-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Valentine's Day]]></category>
            <category><![CDATA[romance scams]]></category>
            <category><![CDATA[domain abuse]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:41:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious Chrome Extensions Target Meta Business, VK, AI Tools]]></title>
            <description><![CDATA[Researchers expose three Chrome extension campaigns stealing Meta Business Suite exports, VK accounts, and AI chatbot conversations from over 760,000 users.]]></description>
            <link>https://www.probablypwned.com/article/chrome-extension-malware-meta-business-vk-ai-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-extension-malware-meta-business-vk-ai-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[Meta Business]]></category>
            <category><![CDATA[VKontakte]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[infostealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:41:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lazarus Plants Malicious Packages in npm and PyPI Registries]]></title>
            <description><![CDATA[North Korea's Lazarus Group targets blockchain developers with fake recruitment campaign distributing RAT malware through 36 poisoned npm and PyPI packages.]]></description>
            <link>https://www.probablypwned.com/article/lazarus-graphalgo-npm-pypi-supply-chain-blockchain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lazarus-graphalgo-npm-pypi-supply-chain-blockchain</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Lazarus]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[PyPI]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[RAT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:40:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UAT-9921 Deploys VoidLink Against Tech and Finance Sectors]]></title>
            <description><![CDATA[Cisco Talos links previously unknown threat actor UAT-9921 to VoidLink malware campaigns targeting technology and financial services since September 2025.]]></description>
            <link>https://www.probablypwned.com/article/uat-9921-voidlink-tech-finance-campaigns-talos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-9921-voidlink-tech-finance-campaigns-talos</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UAT-9921]]></category>
            <category><![CDATA[VoidLink]]></category>
            <category><![CDATA[Talos]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[cloud]]></category>
            <category><![CDATA[financial services]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:40:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China's UNC3886 Breached All Four Singapore Telcos]]></title>
            <description><![CDATA[Singapore confirms China-linked APT compromised M1, Singtel, StarHub, and SIMBA using zero-day exploits and rootkits. 11-month Operation Cyber Guardian response disclosed.]]></description>
            <link>https://www.probablypwned.com/article/singapore-unc3886-telecom-breach-zero-day-rootkits</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/singapore-unc3886-telecom-breach-zero-day-rootkits</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UNC3886]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Singapore]]></category>
            <category><![CDATA[telecommunications]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[rootkit]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:39:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Single IP Behind 83% of Ivanti EPMM Attacks, Sleepers Found]]></title>
            <description><![CDATA[GreyNoise traces Ivanti EPMM exploitation to bulletproof hosting on PROSPERO network. Defenders find dormant webshells—signs of initial access broker activity.]]></description>
            <link>https://www.probablypwned.com/article/ivanti-epmm-exploitation-bulletproof-hosting-sleeper-shells</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ivanti-epmm-exploitation-bulletproof-hosting-sleeper-shells</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CVE-2026-1281]]></category>
            <category><![CDATA[bulletproof hosting]]></category>
            <category><![CDATA[initial access broker]]></category>
            <category><![CDATA[exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 14 Feb 2026 20:38:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1590859808308-3d2d9c515b1a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1590859808308-3d2d9c515b1a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AI Knowledge Graphs Transform APT Threat Intelligence]]></title>
            <description><![CDATA[SANS researchers demonstrate how open-source AI tools extract actionable relationships from unstructured threat reports, mapping GRU and APT28 TTPs in interactive visualizations.]]></description>
            <link>https://www.probablypwned.com/article/ai-knowledge-graph-generator-apt-threat-intelligence-sans</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ai-knowledge-graph-generator-apt-threat-intelligence-sans</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[knowledge graph]]></category>
            <category><![CDATA[AI threat intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[GRU]]></category>
            <category><![CDATA[SANS ISC]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 13 Feb 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[How to Become a Cybersecurity Analyst: Career Guide]]></title>
            <description><![CDATA[How to become a cybersecurity analyst in 2026. Learn the skills, certifications, education paths, and salary expectations for breaking into this high-demand field.]]></description>
            <link>https://www.probablypwned.com/article/how-to-become-cybersecurity-analyst-career-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/how-to-become-cybersecurity-analyst-career-guide</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[cybersecurity analyst]]></category>
            <category><![CDATA[career guide]]></category>
            <category><![CDATA[Security+]]></category>
            <category><![CDATA[SIEM]]></category>
            <category><![CDATA[certifications]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 13 Feb 2026 01:00:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1497215728101-856f4ea42174?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1497215728101-856f4ea42174?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[State Hackers Weaponize Gemini AI Across Attack Lifecycle]]></title>
            <description><![CDATA[Google's threat intelligence reveals APT groups from China, Iran, North Korea, and Russia using Gemini for recon, malware development, and phishing. Two AI-powered malware families discovered.]]></description>
            <link>https://www.probablypwned.com/article/google-gemini-ai-abuse-nation-state-hackers-honestcue-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-gemini-ai-abuse-nation-state-hackers-honestcue-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Google Gemini]]></category>
            <category><![CDATA[AI abuse]]></category>
            <category><![CDATA[APT42]]></category>
            <category><![CDATA[APT31]]></category>
            <category><![CDATA[nation-state hackers]]></category>
            <category><![CDATA[HonestCue malware]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Snort 3 MIME Flaws Expose Firewalls to DoS and Data Leaks]]></title>
            <description><![CDATA[CVE-2025-20359 and CVE-2025-20360 affect Cisco FTD, Meraki, and open-source Snort 3. No workarounds exist—patches rolling out through February.]]></description>
            <link>https://www.probablypwned.com/article/cisco-snort3-mime-dos-cve-2025-20359-20360</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-snort3-mime-dos-cve-2025-20359-20360</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[Snort 3]]></category>
            <category><![CDATA[CVE-2025-20359]]></category>
            <category><![CDATA[denial of service]]></category>
            <category><![CDATA[firewall security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 15:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563206767-5b18f218e8de?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet Patches Critical SQLi-to-RCE Flaw in FortiClientEMS]]></title>
            <description><![CDATA[CVE-2026-21643 allows unauthenticated attackers to chain SQL injection with command execution in FortiClient EMS. CVSS 9.8 affects version 7.4.4—upgrade to 7.4.5 immediately.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-forticlientems-cve-2026-21643-sql-injection-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-forticlientems-cve-2026-21643-sql-injection-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2026-21643]]></category>
            <category><![CDATA[FortiClientEMS]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:06:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Uses Deepfake Zoom Calls in Crypto Heists]]></title>
            <description><![CDATA[Google Mandiant exposes UNC1069's use of AI-generated deepfake video, compromised executive accounts, and ClickFix attacks to deploy macOS malware against cryptocurrency firms.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-unc1069-deepfake-clickfix-crypto-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-unc1069-deepfake-clickfix-crypto-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[UNC1069]]></category>
            <category><![CDATA[deepfake]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[macOS malware]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:06:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Germany Warns of Signal Phishing Targeting Officials]]></title>
            <description><![CDATA[Germany's BfV and BSI issued a joint advisory warning of state-sponsored phishing campaigns targeting politicians, military officials, and journalists through Signal's device linking feature.]]></description>
            <link>https://www.probablypwned.com/article/germany-signal-phishing-warning-politicians-military</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/germany-signal-phishing-warning-politicians-military</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Signal]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Germany]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[BSI]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:05:32 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BeyondTrust Pre-Auth RCE Exposes 11,000 Systems]]></title>
            <description><![CDATA[CVE-2026-1731 allows unauthenticated remote code execution on BeyondTrust Remote Support and Privileged Remote Access products. CVSS 9.9 vulnerability affects 11,000+ exposed instances.]]></description>
            <link>https://www.probablypwned.com/article/beyondtrust-cve-2026-1731-pre-auth-rce-11000-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/beyondtrust-cve-2026-1731-pre-auth-rce-11000-exposed</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[BeyondTrust]]></category>
            <category><![CDATA[CVE-2026-1731]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[pre-authentication]]></category>
            <category><![CDATA[remote access]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:04:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SSHStalker Botnet Compromises 7,000 Linux Servers via SSH]]></title>
            <description><![CDATA[New Linux botnet SSHStalker infected 7,000 cloud servers using brute-force SSH attacks and 2009-era kernel exploits. Uses IRC for command-and-control while apparently staging for future operations.]]></description>
            <link>https://www.probablypwned.com/article/sshstalker-botnet-7000-linux-servers-irc-c2</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sshstalker-botnet-7000-linux-servers-irc-c2</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[SSHStalker]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[SSH]]></category>
            <category><![CDATA[IRC]]></category>
            <category><![CDATA[cloud security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:04:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Reynolds Ransomware Bundles EDR-Killing Driver Into Payload]]></title>
            <description><![CDATA[New ransomware family Reynolds embeds a vulnerable NsecSoft driver directly into its payload to disable CrowdStrike, Sophos, and other EDR tools before encryption begins.]]></description>
            <link>https://www.probablypwned.com/article/reynolds-ransomware-byovd-edr-killer-embedded</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/reynolds-ransomware-byovd-edr-killer-embedded</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Reynolds]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[BYOVD]]></category>
            <category><![CDATA[EDR]]></category>
            <category><![CDATA[NsecSoft]]></category>
            <category><![CDATA[defense evasion]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:03:35 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches Six Zero-Days in February Patch Tuesday]]></title>
            <description><![CDATA[Microsoft's February 2026 Patch Tuesday fixes 59 flaws including six actively exploited zero-days. CrowdStrike confirmed CVE-2026-21533 was used in attacks targeting US and Canada since December.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-patch-tuesday-february-2026-six-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-patch-tuesday-february-2026-six-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-21510]]></category>
            <category><![CDATA[CVE-2026-21533]]></category>
            <category><![CDATA[Windows]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 13:02:50 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is MFA? Multi-Factor Authentication Explained]]></title>
            <description><![CDATA[What is MFA? Learn how multi-factor authentication works, the three authentication factors, and why FIDO2 passkeys are the future of phishing-resistant security.]]></description>
            <link>https://www.probablypwned.com/article/what-is-mfa-multi-factor-authentication</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-mfa-multi-factor-authentication</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[MFA]]></category>
            <category><![CDATA[multi-factor authentication]]></category>
            <category><![CDATA[FIDO2]]></category>
            <category><![CDATA[passkeys]]></category>
            <category><![CDATA[security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 12 Feb 2026 01:01:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486501-0cf524a07213?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486501-0cf524a07213?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[How to Detect Deepfakes: Signs, Tools, and Protection]]></title>
            <description><![CDATA[Learn how to detect deepfakes with visual clues, audio patterns, and authentication methods. Covers detection signs, AI tools, and practical defense strategies.]]></description>
            <link>https://www.probablypwned.com/article/how-to-detect-deepfakes-signs-tools-protection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/how-to-detect-deepfakes-signs-tools-protection</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[deepfakes]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[authentication]]></category>
            <category><![CDATA[fraud prevention]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 11 Feb 2026 01:01:36 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1535378620166-273708d44e4c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1535378620166-273708d44e4c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ZeroDayRAT Spyware Grants Full Access to Mobile Devices]]></title>
            <description><![CDATA[Commercial mobile spyware on Telegram offers live surveillance, OTP interception, and crypto theft across Android 5-16 and iOS up to version 26.]]></description>
            <link>https://www.probablypwned.com/article/zerodayrat-spyware-full-access-android-ios</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zerodayrat-spyware-full-access-android-ios</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ZeroDayRAT]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[spyware]]></category>
            <category><![CDATA[mobile malware]]></category>
            <category><![CDATA[RAT]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 10 Feb 2026 14:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[How Cisco IT Cut Incidents 25% With Unified Observability]]></title>
            <description><![CDATA[Cisco IT unified fragmented monitoring tools into a centralized observability platform, achieving zero network incidents and 45% faster detection using Splunk, ThousandEyes, and AI automation.]]></description>
            <link>https://www.probablypwned.com/article/cisco-it-observability-transformation-unified-insights</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-it-observability-transformation-unified-insights</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[observability]]></category>
            <category><![CDATA[Splunk]]></category>
            <category><![CDATA[ThousandEyes]]></category>
            <category><![CDATA[AppDynamics]]></category>
            <category><![CDATA[enterprise IT]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 09 Feb 2026 21:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco XDR Powers Black Hat Europe NOC With Beta Integrations]]></title>
            <description><![CDATA[Cisco XDR showcased production-ready integrations with Corelight NDR and Palo Alto Networks firewalls at Black Hat Europe, processing 25 log bundles per minute.]]></description>
            <link>https://www.probablypwned.com/article/cisco-xdr-integration-black-hat-europe-2025</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-xdr-integration-black-hat-europe-2025</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco XDR]]></category>
            <category><![CDATA[Black Hat Europe]]></category>
            <category><![CDATA[Corelight]]></category>
            <category><![CDATA[Palo Alto Networks]]></category>
            <category><![CDATA[OCSF]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 09 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[How Cisco Locked Down DNS at Black Hat Europe]]></title>
            <description><![CDATA[Cisco deployed Secure Access to process 66 million DNS queries at Black Hat Europe 2025, tracking ApateWeb domains and a surge in GenAI apps across the conference network.]]></description>
            <link>https://www.probablypwned.com/article/cisco-secure-access-dns-black-hat-europe-2025</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-secure-access-dns-black-hat-europe-2025</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[DNS security]]></category>
            <category><![CDATA[Black Hat Europe]]></category>
            <category><![CDATA[Secure Access]]></category>
            <category><![CDATA[ApateWeb]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 09 Feb 2026 16:20:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is EDR? Endpoint Detection and Response Explained]]></title>
            <description><![CDATA[Endpoint detection and response (EDR) monitors devices to catch threats antivirus misses. Learn how EDR works, key features, and how it compares to EPP and XDR.]]></description>
            <link>https://www.probablypwned.com/article/what-is-edr-endpoint-detection-response</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-edr-endpoint-detection-response</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[endpoint detection and response]]></category>
            <category><![CDATA[EDR]]></category>
            <category><![CDATA[endpoint security]]></category>
            <category><![CDATA[cybersecurity tools]]></category>
            <category><![CDATA[threat detection]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 09 Feb 2026 01:01:43 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Tirith Blocks Homoglyph Attacks Before They Hit Your Shell]]></title>
            <description><![CDATA[Open-source Tirith tool hooks into bash, zsh, fish, and PowerShell to catch Unicode imposter commands, ANSI injection, and pipe-to-shell tricks in real time.]]></description>
            <link>https://www.probablypwned.com/article/tirith-open-source-shell-homoglyph-command-detection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tirith-open-source-shell-homoglyph-command-detection</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[Tirith]]></category>
            <category><![CDATA[homoglyph]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[shell security]]></category>
            <category><![CDATA[open source]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AT&T Breach Data Resurfaces with 176M Enriched Records]]></title>
            <description><![CDATA[Enriched AT&T breach dataset with 148M Social Security numbers and 133M addresses is circulating privately, creating fresh identity theft and SIM-swap risks.]]></description>
            <link>https://www.probablypwned.com/article/att-breach-176-million-records-enriched-ssn-data-resurfaces</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/att-breach-176-million-records-enriched-ssn-data-resurfaces</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[AT&T]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[identity theft]]></category>
            <category><![CDATA[SIM swap]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 13:11:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Flickr Breach Exposes User Data via Email Vendor Flaw]]></title>
            <description><![CDATA[Flickr discloses a data breach through a third-party email provider vulnerability that exposed names, emails, and IP addresses for up to 35 million users.]]></description>
            <link>https://www.probablypwned.com/article/flickr-data-breach-third-party-email-provider-user-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/flickr-data-breach-third-party-email-provider-user-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Flickr]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[third-party risk]]></category>
            <category><![CDATA[email provider]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 13:10:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran's Infy APT Drops Tornado v51 After Internet Blackout]]></title>
            <description><![CDATA[SafeBreach tracks Infy APT deploying Tornado v51 malware with blockchain-based C2 after Iran's internet blackout, confirming state sponsorship ties.]]></description>
            <link>https://www.probablypwned.com/article/infy-tornado-v51-iran-blackout-blockchain-c2</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infy-tornado-v51-iran-blackout-blockchain-c2</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Infy]]></category>
            <category><![CDATA[Prince of Persia]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Tornado]]></category>
            <category><![CDATA[blockchain]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 13:09:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BridgePay Ransomware Attack Knocks Payment Gateway Offline]]></title>
            <description><![CDATA[BridgePay confirms ransomware attack crippled its payment processing platform, forcing merchants nationwide to cash-only. FBI and Secret Service are investigating.]]></description>
            <link>https://www.probablypwned.com/article/bridgepay-ransomware-attack-payment-gateway-outage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/bridgepay-ransomware-attack-payment-gateway-outage</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[BridgePay]]></category>
            <category><![CDATA[payment processing]]></category>
            <category><![CDATA[outage]]></category>
            <category><![CDATA[financial services]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 08 Feb 2026 13:08:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Shadow Campaigns: Spies Breach 70 Orgs in 37 Nations]]></title>
            <description><![CDATA[Asia-based APT TGR-STA-1030 compromised 70+ government and critical infrastructure targets across 37 countries using eBPF rootkits and Cobalt Strike.]]></description>
            <link>https://www.probablypwned.com/article/shadow-campaigns-tgr-sta-1030-espionage-37-countries</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shadow-campaigns-tgr-sta-1030-espionage-37-countries</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[eBPF rootkit]]></category>
            <category><![CDATA[Unit 42]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Substack Breach Exposes 700K Users' Emails and Phones]]></title>
            <description><![CDATA[Substack's October 2025 breach went undetected for four months. 700,000 users' email addresses and phone numbers were accessed by an unauthorized third party.]]></description>
            <link>https://www.probablypwned.com/article/substack-data-breach-700000-users-email-phone-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/substack-data-breach-700000-users-email-phone-exposed</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Substack]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[email exposure]]></category>
            <category><![CDATA[platform security]]></category>
            <category><![CDATA[user data]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:10:15 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Hits Romania's Oil Pipeline Operator]]></title>
            <description><![CDATA[Conpet, operator of 3,800km of Romanian oil pipelines, confirms cyberattack. Qilin claims 1TB of stolen data including financial records and passports.]]></description>
            <link>https://www.probablypwned.com/article/conpet-romania-oil-pipeline-qilin-ransomware-1tb</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/conpet-romania-oil-pipeline-qilin-ransomware-1tb</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Conpet]]></category>
            <category><![CDATA[Romania]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[oil pipeline]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:08:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Conduent Breach Now Affects 25.9 Million Americans]]></title>
            <description><![CDATA[The January 2025 ransomware attack on govtech giant Conduent keeps growing—15.4M in Texas, 10.5M in Oregon, with more states still counting.]]></description>
            <link>https://www.probablypwned.com/article/conduent-data-breach-25-million-americans-safeway-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/conduent-data-breach-25-million-americans-safeway-ransomware</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Conduent]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Safeway ransomware]]></category>
            <category><![CDATA[government data]]></category>
            <category><![CDATA[Social Security numbers]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:07:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Orders Federal Agencies to Dump End-of-Life Edge Gear]]></title>
            <description><![CDATA[Binding Operational Directive 26-02 gives federal agencies 12-18 months to remove unsupported routers, firewalls, and switches from networks.]]></description>
            <link>https://www.probablypwned.com/article/cisa-bod-26-02-edge-device-replacement-federal-agencies</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-bod-26-02-edge-device-replacement-federal-agencies</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[BOD 26-02]]></category>
            <category><![CDATA[edge devices]]></category>
            <category><![CDATA[federal agencies]]></category>
            <category><![CDATA[network security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:06:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[vLLM CVSS 9.8 Flaw Lets Attackers Own AI Servers via Video]]></title>
            <description><![CDATA[CVE-2026-22778 chains a heap leak and buffer overflow in vLLM's video processing to achieve full RCE on AI inference servers. Patch to 0.14.1 now.]]></description>
            <link>https://www.probablypwned.com/article/vllm-cve-2026-22778-rce-ai-servers-video-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vllm-cve-2026-22778-rce-ai-servers-video-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[vLLM]]></category>
            <category><![CDATA[CVE-2026-22778]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[CVSS 9.8]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 13:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is Red Teaming? Methodology, Tools, and Benefits]]></title>
            <description><![CDATA[Red teaming tests your defenses by simulating real attacks. Learn how red team engagements work, the key phases, tools used, and how they differ from pen testing.]]></description>
            <link>https://www.probablypwned.com/article/what-is-red-teaming-methodology-tools-benefits</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-red-teaming-methodology-tools-benefits</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[red teaming]]></category>
            <category><![CDATA[penetration testing]]></category>
            <category><![CDATA[offensive security]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <category><![CDATA[threat simulation]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 07 Feb 2026 01:01:44 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AIUC-1 Becomes First Standard for Securing AI Agents]]></title>
            <description><![CDATA[Cisco helps build AIUC-1, the first AI agent security standard, mapping its AI Security Framework to testable controls for prompt injection, jailbreaks, and more.]]></description>
            <link>https://www.probablypwned.com/article/aiuc-1-cisco-ai-security-framework-standard-agents</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aiuc-1-cisco-ai-security-framework-standard-agents</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[AIUC-1]]></category>
            <category><![CDATA[agentic AI]]></category>
            <category><![CDATA[AI governance]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware Gangs Share ISPsystem VMs to Hide Attacks]]></title>
            <description><![CDATA[Sophos finds 7,000+ servers with identical hostnames from ISPsystem VMmanager templates. LockBit, Qilin, and Conti all used the same bulletproof hosting VMs.]]></description>
            <link>https://www.probablypwned.com/article/ransomware-ispsystem-vmmanager-bulletproof-hosting-sophos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ransomware-ispsystem-vmmanager-bulletproof-hosting-sophos</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[ISPsystem]]></category>
            <category><![CDATA[bulletproof hosting]]></category>
            <category><![CDATA[Sophos]]></category>
            <category><![CDATA[virtual machines]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 18:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Super Bowl LX's Cyber Defense Playbook]]></title>
            <description><![CDATA[Inside the cyber command center protecting Super Bowl LX at Levi's Stadium, where Cisco deployed 1,500 Wi-Fi 7 access points and blocked 400,000+ threats before kickoff.]]></description>
            <link>https://www.probablypwned.com/article/super-bowl-lx-cisco-cybersecurity-wifi7-levis-stadium</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/super-bowl-lx-cisco-cybersecurity-wifi7-levis-stadium</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[Super Bowl]]></category>
            <category><![CDATA[Wi-Fi 7]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[Talos]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 17:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[NetOp AI Tackles the Network Readiness Gap for AI]]></title>
            <description><![CDATA[NetOp AI's network assessment tool helps Cisco partners identify infrastructure gaps blocking AI deployments. Here's how it works and why it matters.]]></description>
            <link>https://www.probablypwned.com/article/netop-ai-cisco-network-assessment-ai-readiness-scale</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/netop-ai-cisco-network-assessment-ai-readiness-scale</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[NetOp AI]]></category>
            <category><![CDATA[network assessment]]></category>
            <category><![CDATA[AI readiness]]></category>
            <category><![CDATA[MSP]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Rapid7 Links Notepad++ Breach to Lotus Blossom APT]]></title>
            <description><![CDATA[Rapid7 attributes the six-month Notepad++ supply chain compromise to Chinese APT Lotus Blossom, revealing a custom Chrysalis backdoor and three distinct infection chains.]]></description>
            <link>https://www.probablypwned.com/article/notepad-plus-plus-lotus-blossom-chrysalis-backdoor-rapid7</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/notepad-plus-plus-lotus-blossom-chrysalis-backdoor-rapid7</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Notepad++]]></category>
            <category><![CDATA[Lotus Blossom]]></category>
            <category><![CDATA[Chrysalis]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 13:05:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Talos Exposes DKnife: China-Linked Router AitM Framework]]></title>
            <description><![CDATA[Seven-implant Linux toolkit intercepts traffic on compromised routers, delivering ShadowPad and hijacking Android updates. Active C2 infrastructure dates to 2019.]]></description>
            <link>https://www.probablypwned.com/article/dknife-aitm-framework-talos-china-routers-shadowpad</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dknife-aitm-framework-talos-china-routers-shadowpad</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[DKnife]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[ShadowPad]]></category>
            <category><![CDATA[adversary-in-the-middle]]></category>
            <category><![CDATA[router compromise]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 13:04:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Confirms VMware ESXi Flaw Used in Ransomware]]></title>
            <description><![CDATA[CVE-2025-22225 sandbox escape now confirmed as a ransomware attack vector. Exploitation toolkit predates Broadcom's patch by a full year.]]></description>
            <link>https://www.probablypwned.com/article/vmware-esxi-cve-2025-22225-ransomware-cisa-confirms</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vmware-esxi-cve-2025-22225-ransomware-cisa-confirms</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-22225]]></category>
            <category><![CDATA[VMware ESXi]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 13:04:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SmarterMail Flaw Exploited in Ransomware Attacks]]></title>
            <description><![CDATA[CVE-2026-24423 lets unauthenticated attackers execute OS commands on SmarterMail servers. CISA confirms active ransomware exploitation and sets a February 26 patch deadline.]]></description>
            <link>https://www.probablypwned.com/article/smartermail-cve-2026-24423-ransomware-cisa-kev</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smartermail-cve-2026-24423-ransomware-cisa-kev</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-24423]]></category>
            <category><![CDATA[SmarterMail]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 13:03:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco AI Summit: Security Takes Center Stage]]></title>
            <description><![CDATA[Cisco's second AI Summit unveiled AI Defense, AgenticOps, and Silicon One P200. Here's what security teams need to know about agentic AI governance.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ai-summit-2026-agenticops-ai-defense-silicon-one</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ai-summit-2026-agenticops-ai-defense-silicon-one</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[AI Security]]></category>
            <category><![CDATA[AgenticOps]]></category>
            <category><![CDATA[AI Defense]]></category>
            <category><![CDATA[Silicon One]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 11:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1531482615713-2afd69097998?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1531482615713-2afd69097998?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is Access Control? Models, Types, and Best Practices]]></title>
            <description><![CDATA[Learn what access control means in cybersecurity, the four main models (DAC, MAC, RBAC, ABAC), and how to implement effective access control policies.]]></description>
            <link>https://www.probablypwned.com/article/what-is-access-control-models-types-best-practices</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-access-control-models-types-best-practices</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[access control]]></category>
            <category><![CDATA[RBAC]]></category>
            <category><![CDATA[zero trust]]></category>
            <category><![CDATA[identity management]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 06 Feb 2026 01:02:37 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Talos Warns AI Adoption Is Outrunning Security]]></title>
            <description><![CDATA[Cisco Talos sounds the alarm on AI tools that demand root access and store credentials in plaintext, calling the current adoption frenzy a security crisis.]]></description>
            <link>https://www.probablypwned.com/article/talos-ai-adoption-security-sacrifice-convenience</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/talos-ai-adoption-security-sacrifice-convenience</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[agentic AI]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 21:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Targets European Maritime Sector via Office Flaw]]></title>
            <description><![CDATA[Russia's APT28 exploited CVE-2026-21509 to hit maritime and transport organizations across nine countries, with shipping firms making up 35% of targets.]]></description>
            <link>https://www.probablypwned.com/article/apt28-maritime-transport-cve-2026-21509-office-europe</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-maritime-transport-cve-2026-21509-office-europe</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[CVE-2026-21509]]></category>
            <category><![CDATA[maritime]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Microsoft Office]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Live Amsterdam Tackles AI Policy Gap]]></title>
            <description><![CDATA[Cisco Live EMEA 2026 features a fireside chat on AI governance, digital sovereignty, and infrastructure readiness for government and enterprise leaders.]]></description>
            <link>https://www.probablypwned.com/article/cisco-live-amsterdam-ai-revolution-policy-government</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-live-amsterdam-ai-revolution-policy-government</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco Live]]></category>
            <category><![CDATA[AI policy]]></category>
            <category><![CDATA[digital sovereignty]]></category>
            <category><![CDATA[AI governance]]></category>
            <category><![CDATA[Amsterdam]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 19:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Outlines Two-Pillar Post-Quantum Strategy]]></title>
            <description><![CDATA[Cisco details its post-quantum cryptography approach targeting harvest-now-decrypt-later threats and quantum-resistant product foundations.]]></description>
            <link>https://www.probablypwned.com/article/cisco-post-quantum-cryptography-pqc-hndl-threat</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-post-quantum-cryptography-pqc-hndl-threat</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[post-quantum cryptography]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[NIST]]></category>
            <category><![CDATA[encryption]]></category>
            <category><![CDATA[HNDL]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Broken Phishing URLs Are Bypassing Your Filters]]></title>
            <description><![CDATA[SANS ISC handler Xavier Mertens documents phishing campaigns using malformed URL parameters to evade regex detection, URL normalization, and IOC extraction.]]></description>
            <link>https://www.probablypwned.com/article/broken-phishing-urls-cloudflare-workers-regex-evasion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/broken-phishing-urls-cloudflare-workers-regex-evasion</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[URL evasion]]></category>
            <category><![CDATA[Cloudflare Workers]]></category>
            <category><![CDATA[SANS ISC]]></category>
            <category><![CDATA[regex bypass]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 14:20:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[React2Shell Exploits Fuel Massive NGINX Traffic Hijacking]]></title>
            <description><![CDATA[Over 1,000 IPs exploit CVE-2025-55182 to inject malicious NGINX configs that redirect web traffic through attacker infrastructure, targeting Asian government and education sites.]]></description>
            <link>https://www.probablypwned.com/article/react2shell-nginx-hijacking-web-traffic-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/react2shell-nginx-hijacking-web-traffic-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[NGINX]]></category>
            <category><![CDATA[CVE-2025-55182]]></category>
            <category><![CDATA[traffic hijacking]]></category>
            <category><![CDATA[Baota panel]]></category>
            <category><![CDATA[cryptomining]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 13:09:39 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DEAD#VAX Campaign Hides AsyncRAT in Memory-Only Attack]]></title>
            <description><![CDATA[Securonix uncovers multi-stage fileless campaign using IPFS-hosted VHD files and process injection into signed Windows binaries to deploy AsyncRAT.]]></description>
            <link>https://www.probablypwned.com/article/deadvax-asyncrat-fileless-ipfs-vhd-phishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/deadvax-asyncrat-fileless-ipfs-vhd-phishing</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[AsyncRAT]]></category>
            <category><![CDATA[fileless malware]]></category>
            <category><![CDATA[IPFS]]></category>
            <category><![CDATA[DEAD#VAX]]></category>
            <category><![CDATA[process injection]]></category>
            <category><![CDATA[Securonix]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 13:08:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[APT28 Weaponized Office Zero-Day in Three Days Flat]]></title>
            <description><![CDATA[Operation Neusploit saw Russia's APT28 exploit CVE-2026-21509 against 60+ Ukrainian targets within 72 hours of Microsoft's disclosure, delivering MiniDoor and BEARDSHELL backdoors.]]></description>
            <link>https://www.probablypwned.com/article/apt28-operation-neusploit-cve-2026-21509-eastern-europe</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-operation-neusploit-cve-2026-21509-eastern-europe</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[CVE-2026-21509]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Operation Neusploit]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Microsoft Office]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 13:08:05 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Patches Five Critical Flaws Including CVSS 9.4 RCE]]></title>
            <description><![CDATA[CVE-2026-25049 bypasses n8n's previous sandbox fix to enable system command execution. Four additional vulnerabilities disclosed simultaneously.]]></description>
            <link>https://www.probablypwned.com/article/n8n-cve-2026-25049-expression-escape-rce-five-flaws</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-cve-2026-25049-expression-escape-rce-five-flaws</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-25049]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 05 Feb 2026 13:07:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Three Days to Patch: CISA's Urgent SolarWinds Deadline Explained]]></title>
            <description><![CDATA[Federal agencies face an aggressive Friday deadline to patch CVE-2025-40551 in SolarWinds Web Help Desk. The compressed timeline signals serious active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/solarwinds-whd-three-day-patch-deadline-federal-agencies</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/solarwinds-whd-three-day-patch-deadline-federal-agencies</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[BOD 22-01]]></category>
            <category><![CDATA[patching]]></category>
            <category><![CDATA[federal agencies]]></category>
            <category><![CDATA[CVE-2025-40551]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 19:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco 8375 Router Earns NetSecOPEN Validation for Branch Security]]></title>
            <description><![CDATA[Independent testing confirms 99.3% IPS effectiveness and 99.8% malware detection for Cisco's unified routing and firewall platform.]]></description>
            <link>https://www.probablypwned.com/article/netsecopen-cisco-8375-secure-router-branch-validation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/netsecopen-cisco-8375-secure-router-branch-validation</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[NetSecOPEN]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[branch security]]></category>
            <category><![CDATA[firewall]]></category>
            <category><![CDATA[RFC 9411]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 17:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Live EMEA 2026: Developer Sessions You Can't Miss]]></title>
            <description><![CDATA[From AI-driven network automation to Meraki's OAuth 2.0 rollout, here's what developers should target at Cisco Live Amsterdam.]]></description>
            <link>https://www.probablypwned.com/article/cisco-live-emea-2026-developer-guide-ai-meraki-mcp</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-live-emea-2026-developer-guide-ai-meraki-mcp</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco Live]]></category>
            <category><![CDATA[DevNet]]></category>
            <category><![CDATA[MCP]]></category>
            <category><![CDATA[Meraki]]></category>
            <category><![CDATA[AI automation]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 17:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Prime Infrastructure XSS Flaw Targets Admins]]></title>
            <description><![CDATA[CVE-2026-20111 enables stored cross-site scripting attacks against administrators of Cisco Prime Infrastructure network management systems.]]></description>
            <link>https://www.probablypwned.com/article/cisco-prime-infrastructure-xss-cve-2026-20111-network-management</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-prime-infrastructure-xss-cve-2026-20111-network-management</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[CVE-2026-20111]]></category>
            <category><![CDATA[network management]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Maps the Five Domains of AI Security]]></title>
            <description><![CDATA[New taxonomy from Cisco's CISO and security leadership defines five AI security domains and the organizational functions needed to secure enterprise AI systems.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ai-security-domains-organizational-functions-taxonomy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ai-security-domains-organizational-functions-taxonomy</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[governance]]></category>
            <category><![CDATA[CISO]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 16:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[XWorm RAT Hides in PNG Image via Steganography Attack]]></title>
            <description><![CDATA[SANS researcher uncovers multi-stage malware attack hiding XWorm payload inside a legitimate travel website image using steganography and obfuscated batch scripts.]]></description>
            <link>https://www.probablypwned.com/article/xworm-rat-steganography-png-batch-script-sans</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/xworm-rat-steganography-png-batch-script-sans</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[XWorm]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[SANS]]></category>
            <category><![CDATA[RAT]]></category>
            <category><![CDATA[Telegram]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 15:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Service Finder Plugin Exploit Hits 13,800 Sites]]></title>
            <description><![CDATA[Attackers exploiting CVE-2025-5947 in Service Finder Bookings plugin to hijack admin accounts through cookie manipulation. Over 6,000 sites potentially exposed.]]></description>
            <link>https://www.probablypwned.com/article/wordpress-service-finder-cve-2025-5947-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wordpress-service-finder-cve-2025-5947-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2025-5947]]></category>
            <category><![CDATA[admin takeover]]></category>
            <category><![CDATA[Service Finder]]></category>
            <category><![CDATA[plugin vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:05:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[1 in 5 Infostealer Infections Will Expose Enterprise Creds]]></title>
            <description><![CDATA[Flare research finds enterprise identity compromise doubled in 2025, with Microsoft Entra ID appearing in 79% of logs. Session cookies enable MFA bypass at scale.]]></description>
            <link>https://www.probablypwned.com/article/flare-infostealer-enterprise-credentials-microsoft-entra-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/flare-infostealer-enterprise-credentials-microsoft-entra-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[Microsoft Entra ID]]></category>
            <category><![CDATA[credentials]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[Flare]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:04:54 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[59 KEV Entries Quietly Flagged for Ransomware Use in 2025]]></title>
            <description><![CDATA[GreyNoise reveals CISA silently updated ransomware indicators on 59 vulnerabilities without alerts. New RSS feed tool catches changes within an hour.]]></description>
            <link>https://www.probablypwned.com/article/greynoise-cisa-kev-ransomware-silent-updates-rss-tool</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/greynoise-cisa-kev-ransomware-silent-updates-rss-tool</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[GreyNoise]]></category>
            <category><![CDATA[vulnerability management]]></category>
            <category><![CDATA[patching]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:04:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds SolarWinds, Sangoma, GitLab Flaws to KEV]]></title>
            <description><![CDATA[Four actively exploited vulnerabilities added to CISA's catalog including SolarWinds Web Help Desk deserialization flaw with CVSS 9.8. Federal agencies have until February 6 to patch.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-solarwinds-sangoma-gitlab-february-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-solarwinds-sangoma-gitlab-february-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[Sangoma FreePBX]]></category>
            <category><![CDATA[GitLab]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:03:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Looker Flaws Let Attackers Hijack BI Servers]]></title>
            <description><![CDATA[Tenable discloses 'LookOut' vulnerabilities in Google Looker enabling remote code execution and full database theft. Self-hosted deployments at 60,000+ organizations exposed.]]></description>
            <link>https://www.probablypwned.com/article/google-looker-lookout-vulnerabilities-cve-2025-12743-rce-database</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-looker-lookout-vulnerabilities-cve-2025-12743-rce-database</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Google Looker]]></category>
            <category><![CDATA[CVE-2025-12743]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[database theft]]></category>
            <category><![CDATA[Tenable]]></category>
            <category><![CDATA[business intelligence]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 13:03:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco's ACE Framework Cuts LLM Token Costs by Up to 90%]]></title>
            <description><![CDATA[Analytics Context Engineering addresses three failure modes when LLMs process machine data, delivering dramatic token savings and accuracy gains.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ace-analytics-context-engineering-llm-token-reduction</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ace-analytics-context-engineering-llm-token-reduction</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[LLM]]></category>
            <category><![CDATA[context engineering]]></category>
            <category><![CDATA[observability]]></category>
            <category><![CDATA[AI agents]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 11:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1485827404703-89b55fcc595e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OWASP Top 10 Explained: Critical Web Application Security Risks]]></title>
            <description><![CDATA[The OWASP Top 10 lists the most critical web application security vulnerabilities. Learn what each risk means, see real-world examples, and understand how to protect your applications.]]></description>
            <link>https://www.probablypwned.com/article/owasp-top-10-2025-web-application-security-risks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/owasp-top-10-2025-web-application-security-risks</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OWASP Top 10]]></category>
            <category><![CDATA[web application security]]></category>
            <category><![CDATA[vulnerabilities]]></category>
            <category><![CDATA[secure coding]]></category>
            <category><![CDATA[application security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 04 Feb 2026 01:02:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cybersecurity's Talent Crisis Puts STEM Education in the Spotlight]]></title>
            <description><![CDATA[With 4.8 million cybersecurity jobs unfilled globally, STEM programs from K-12 through career training are racing to close the gap.]]></description>
            <link>https://www.probablypwned.com/article/stem-education-cybersecurity-workforce-cisco-academy</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stem-education-cybersecurity-workforce-cisco-academy</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[STEM education]]></category>
            <category><![CDATA[cybersecurity workforce]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[career development]]></category>
            <category><![CDATA[training]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WhatsApp Bug Lets Malicious Media Spread via Group Chats]]></title>
            <description><![CDATA[Researchers disclose zero-click attack vector on Android where adding a user to a group can trigger malware execution through manipulated media files.]]></description>
            <link>https://www.probablypwned.com/article/whatsapp-group-chat-media-vulnerability-zero-click</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/whatsapp-group-chat-media-vulnerability-zero-click</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[zero-click]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[mobile security]]></category>
            <category><![CDATA[Meta]]></category>
            <category><![CDATA[vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 13:05:28 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Breaches Tulsa International Airport]]></title>
            <description><![CDATA[Russian-linked gang dumps executive emails, employee IDs, and banking communications in first airline sector attack of 2026.]]></description>
            <link>https://www.probablypwned.com/article/qilin-ransomware-tulsa-airport-aviation-sector-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/qilin-ransomware-tulsa-airport-aviation-sector-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[aviation]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Russia]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 13:04:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[341 Malicious OpenClaw Skills Distribute Atomic Stealer]]></title>
            <description><![CDATA[Security researchers uncover ClawHavoc campaign distributing Atomic Stealer through fake cryptocurrency and productivity tools on ClawHub marketplace.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-clawhub-malicious-skills-atomic-stealer-crypto</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-clawhub-malicious-skills-atomic-stealer-crypto</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[ClawHub]]></category>
            <category><![CDATA[Atomic Stealer]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[AI agent]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 13:03:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Notepad++ Update Hijacked by Chinese APT for Six Months]]></title>
            <description><![CDATA[Violet Typhoon compromised the text editor's hosting provider to redirect updates to malicious servers targeting telecom and financial firms.]]></description>
            <link>https://www.probablypwned.com/article/notepad-plus-plus-supply-chain-attack-violet-typhoon-apt31</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/notepad-plus-plus-supply-chain-attack-violet-typhoon-apt31</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Notepad++]]></category>
            <category><![CDATA[Violet Typhoon]]></category>
            <category><![CDATA[APT31]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Lotus Blossom]]></category>
            <category><![CDATA[Chrysalis]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 13:03:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[New Tools Help Defenders Track OpenClaw AI Agent Activity]]></title>
            <description><![CDATA[SANS ISC highlights openclaw-detect and openclaw-telemetry tools as security teams scramble to monitor the viral AI assistant amid ongoing vulnerability disclosures.]]></description>
            <link>https://www.probablypwned.com/article/openclaw-detection-monitoring-tools-sans-isc-telemetry</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openclaw-detection-monitoring-tools-sans-isc-telemetry</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[OpenClaw]]></category>
            <category><![CDATA[AI agents]]></category>
            <category><![CDATA[detection]]></category>
            <category><![CDATA[SIEM integration]]></category>
            <category><![CDATA[security monitoring]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 03 Feb 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Scan for Exposed Self-Hosted Anthropic Models]]></title>
            <description><![CDATA[SANS ISC detects reconnaissance activity targeting locally hosted Claude API endpoints. Researchers warn of growing risk from misconfigured AI deployments.]]></description>
            <link>https://www.probablypwned.com/article/anthropic-api-scanning-exposed-self-hosted-models-sans</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/anthropic-api-scanning-exposed-self-hosted-models-sans</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Anthropic]]></category>
            <category><![CDATA[Claude]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[API exposure]]></category>
            <category><![CDATA[self-hosted LLM]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrossCurve Bridge Drained of $3M in Smart Contract Exploit]]></title>
            <description><![CDATA[Attackers exploited a validation flaw to send spoofed cross-chain messages and unlock tokens across Ethereum, Arbitrum, and six other networks.]]></description>
            <link>https://www.probablypwned.com/article/crosscurve-bridge-exploit-3-million-smart-contract-vulnerability</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crosscurve-bridge-exploit-3-million-smart-contract-vulnerability</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CrossCurve]]></category>
            <category><![CDATA[DeFi]]></category>
            <category><![CDATA[smart contract]]></category>
            <category><![CDATA[bridge exploit]]></category>
            <category><![CDATA[Ethereum]]></category>
            <category><![CDATA[Arbitrum]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 13:07:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Leaks 10M Records from Tinder, Hinge, OkCupid]]></title>
            <description><![CDATA[Match Group confirms breach after ShinyHunters dumps 1.7GB of user data. Attackers used voice phishing to compromise an Okta SSO account.]]></description>
            <link>https://www.probablypwned.com/article/match-group-tinder-hinge-breach-shinyhunters-10-million-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/match-group-tinder-hinge-breach-shinyhunters-10-million-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Match Group]]></category>
            <category><![CDATA[Tinder]]></category>
            <category><![CDATA[Hinge]]></category>
            <category><![CDATA[OkCupid]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[SSO]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 13:06:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA KEV Deadline Hits Today for Unpatched Gogs Zero-Day]]></title>
            <description><![CDATA[CVE-2025-8110 allows authenticated attackers to achieve RCE on self-hosted Git servers via path traversal. Over 700 instances already compromised.]]></description>
            <link>https://www.probablypwned.com/article/gogs-cve-2025-8110-zero-day-rce-cisa-kev-no-patch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gogs-cve-2025-8110-zero-day-rce-cisa-kev-no-patch</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-8110]]></category>
            <category><![CDATA[Gogs]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[Git]]></category>
            <category><![CDATA[path traversal]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 13:05:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is Phishing? Types of Attacks and How to Spot Them]]></title>
            <description><![CDATA[Learn what phishing is, the different types of phishing attacks (email, SMS, voice), red flags to watch for, and how to protect yourself from scams.]]></description>
            <link>https://www.probablypwned.com/article/what-is-phishing-types-how-to-spot-prevent</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-phishing-types-how-to-spot-prevent</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[social engineering]]></category>
            <category><![CDATA[email security]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <category><![CDATA[scams]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Mon, 02 Feb 2026 01:02:16 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633265486064-086b219458ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[208,000 MongoDB Servers Exposed, 1,400 Already Hit by Extortion]]></title>
            <description><![CDATA[Flare researchers find a single threat actor wiping misconfigured MongoDB databases and demanding $500 Bitcoin ransoms. Nearly half of unauthenticated instances already compromised.]]></description>
            <link>https://www.probablypwned.com/article/mongodb-exposed-instances-data-extortion-attacks-flare</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mongodb-exposed-instances-data-extortion-attacks-flare</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[MongoDB]]></category>
            <category><![CDATA[data extortion]]></category>
            <category><![CDATA[database security]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Flare]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 01 Feb 2026 16:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1545987796-200677ee1011?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Redis RCE Exploit More Severe Than Initially Rated]]></title>
            <description><![CDATA[JFrog researchers develop working remote code execution exploit for CVE-2025-62507, a stack buffer overflow in Redis discovered by Google's AI security agent.]]></description>
            <link>https://www.probablypwned.com/article/redis-cve-2025-62507-rce-exploit-jfrog</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/redis-cve-2025-62507-rce-exploit-jfrog</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Redis]]></category>
            <category><![CDATA[CVE-2025-62507]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[buffer-overflow]]></category>
            <category><![CDATA[AI-discovered]]></category>
            <category><![CDATA[database]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 01 Feb 2026 13:08:47 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iconics SCADA Flaw Allows System File Corruption]]></title>
            <description><![CDATA[CVE-2025-0921 enables privileged file system operations that can disrupt industrial control systems in automotive, energy, and manufacturing environments.]]></description>
            <link>https://www.probablypwned.com/article/iconics-scada-cve-2025-0921-file-system-dos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iconics-scada-cve-2025-0921-file-system-dos</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SCADA]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[CVE-2025-0921]]></category>
            <category><![CDATA[Iconics]]></category>
            <category><![CDATA[OT]]></category>
            <category><![CDATA[industrial-control]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 01 Feb 2026 13:08:03 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MuddyWater Deploys Rust-Based RAT in Middle East Campaign]]></title>
            <description><![CDATA[Iranian APT group shifts tactics with RustyWater implant targeting diplomatic, financial, and telecom sectors across the Middle East via spear-phishing.]]></description>
            <link>https://www.probablypwned.com/article/muddywater-rustywater-rust-rat-middle-east-spearphishing</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/muddywater-rustywater-rust-rat-middle-east-spearphishing</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[MuddyWater]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[RustyWater]]></category>
            <category><![CDATA[Rust]]></category>
            <category><![CDATA[Middle East]]></category>
            <category><![CDATA[spear-phishing]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 01 Feb 2026 13:07:12 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RedKitten Malware Targets Iranian Protest Documenters]]></title>
            <description><![CDATA[French researchers uncover SloppyMIO, an AI-assisted malware campaign using fabricated victim lists to target individuals documenting human rights abuses during Iranian protests.]]></description>
            <link>https://www.probablypwned.com/article/redkitten-sloppymio-malware-iran-protests</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/redkitten-sloppymio-malware-iran-protests</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[SloppyMIO]]></category>
            <category><![CDATA[RedKitten]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[human rights]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 13:05:13 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SHADOW#REACTOR: Multi-Stage Remcos RAT Hits Enterprises]]></title>
            <description><![CDATA[Security researchers expose an active campaign using layered evasion techniques to deliver Remcos RAT through MSBuild abuse and .NET Reactor-protected loaders.]]></description>
            <link>https://www.probablypwned.com/article/remcos-rat-shadow-reactor-multi-stage-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/remcos-rat-shadow-reactor-multi-stage-campaign</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Remcos RAT]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[initial access broker]]></category>
            <category><![CDATA[LOLBin]]></category>
            <category><![CDATA[evasion]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 13:04:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco ISE XXE Flaw Has Public PoC, Patch Now]]></title>
            <description><![CDATA[Cisco patches CVE-2026-20029, an XML external entity vulnerability in Identity Services Engine with proof-of-concept exploit code already publicly available.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ise-xxe-cve-2026-20029-poc-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ise-xxe-cve-2026-20029-poc-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20029]]></category>
            <category><![CDATA[XXE]]></category>
            <category><![CDATA[ISE]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[exploit]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 13:04:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Dismantles IPIDEA Proxy Network Used by 550+ APTs]]></title>
            <description><![CDATA[Google Threat Intelligence Group disrupts one of the world's largest residential proxy networks, cutting off infrastructure used by nation-state actors from China, Russia, Iran, and North Korea.]]></description>
            <link>https://www.probablypwned.com/article/google-ipidea-residential-proxy-network-disruption</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-ipidea-residential-proxy-network-disruption</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[proxy network]]></category>
            <category><![CDATA[residential proxy]]></category>
            <category><![CDATA[threat actors]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[malware infrastructure]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 13:03:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ex-Google Engineer Convicted in First US AI Espionage Case]]></title>
            <description><![CDATA[Federal jury convicts Linwei Ding on 14 counts of economic espionage and trade secret theft for stealing Google's AI infrastructure secrets for China.]]></description>
            <link>https://www.probablypwned.com/article/linwei-ding-google-ai-trade-secrets-china-conviction</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/linwei-ding-google-ai-trade-secrets-china-conviction</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[trade-secrets]]></category>
            <category><![CDATA[insider-threat]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 10:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064548237-096f735f344f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[What Is Ransomware? How It Works and How to Protect Yourself]]></title>
            <description><![CDATA[Learn what ransomware is, how attacks work, the main types including double extortion, and practical steps to defend against this growing threat.]]></description>
            <link>https://www.probablypwned.com/article/what-is-ransomware-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/what-is-ransomware-guide</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <category><![CDATA[data protection]]></category>
            <category><![CDATA[extortion]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 31 Jan 2026 01:01:46 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Top 5 Threat Intelligence Data APIs for Security Teams]]></title>
            <description><![CDATA[The best threat intelligence APIs for enriching IOCs, detecting malware, and integrating threat data into your SIEM and security workflows.]]></description>
            <link>https://www.probablypwned.com/article/top-5-threat-intelligence-data-apis-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/top-5-threat-intelligence-data-apis-2026</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[threat-intelligence]]></category>
            <category><![CDATA[API]]></category>
            <category><![CDATA[SIEM]]></category>
            <category><![CDATA[IOC]]></category>
            <category><![CDATA[security-tools]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 19:24:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco DevNet Spotlights Partner-Built Security Integrations]]></title>
            <description><![CDATA[January's Month of Partner Innovation showcases PagerDuty alerting, Meraki backup tools, and cloud migration capabilities built on Cisco APIs.]]></description>
            <link>https://www.probablypwned.com/article/cisco-devnet-partner-innovation-month-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-devnet-partner-innovation-month-2026</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[DevNet]]></category>
            <category><![CDATA[Meraki]]></category>
            <category><![CDATA[PagerDuty]]></category>
            <category><![CDATA[partner ecosystem]]></category>
            <category><![CDATA[API security]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Phishers Hide Behind Google Slides Publish Feature]]></title>
            <description><![CDATA[Attackers exploit Google Presentations' publish mode to host phishing pages that bypass Google's own security warnings, targeting Vivaldi Webmail users.]]></description>
            <link>https://www.probablypwned.com/article/google-slides-publish-phishing-vivaldi-webmail</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-slides-publish-phishing-vivaldi-webmail</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Google Slides]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Vivaldi]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 18:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SolarWinds Web Help Desk Gets Emergency Patches for Four Critical Flaws]]></title>
            <description><![CDATA[Deserialization bugs and authentication bypasses enable unauthenticated RCE. Attackers have targeted WHD vulnerabilities before.]]></description>
            <link>https://www.probablypwned.com/article/solarwinds-web-help-desk-critical-rce-auth-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/solarwinds-web-help-desk-critical-rce-auth-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SolarWinds]]></category>
            <category><![CDATA[Web Help Desk]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[authentication-bypass]]></category>
            <category><![CDATA[deserialization]]></category>
            <category><![CDATA[CVSS-9.8]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 13:11:18 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran's Hacktivists Were State Actors All Along, CSIS Report Finds]]></title>
            <description><![CDATA[Analysis reveals CyberAv3ngers and other 'hacktivist' groups targeting US infrastructure are actually IRGC-controlled operations masquerading as ideological actors.]]></description>
            <link>https://www.probablypwned.com/article/iran-apt-cyberav3ngers-hacktivist-state-sponsored-csis</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iran-apt-cyberav3ngers-hacktivist-state-sponsored-csis</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[CyberAv3ngers]]></category>
            <category><![CDATA[IRGC]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[hacktivist]]></category>
            <category><![CDATA[critical-infrastructure]]></category>
            <category><![CDATA[OT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 13:09:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ivanti EPMM Zero-Days Under Attack, CISA Sets Friday Deadline]]></title>
            <description><![CDATA[Two critical code injection flaws in Ivanti Endpoint Manager Mobile enable unauthenticated RCE. Federal agencies must remediate by February 1.]]></description>
            <link>https://www.probablypwned.com/article/ivanti-epmm-zero-day-cve-2026-1281-cve-2026-1340-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ivanti-epmm-zero-day-cve-2026-1281-cve-2026-1340-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[CVE-2026-1281]]></category>
            <category><![CDATA[CVE-2026-1340]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[mobile-device-management]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 30 Jan 2026 13:08:22 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1512941937669-90a1b58e7e9c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1512941937669-90a1b58e7e9c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenSSL Stack Overflow Enables Remote Code Execution]]></title>
            <description><![CDATA[CVE-2025-15467 allows attackers to crash or compromise systems by sending malicious CMS messages. All AI-discovered in OpenSSL's largest coordinated security release.]]></description>
            <link>https://www.probablypwned.com/article/openssl-cve-2025-15467-stack-overflow-rce-ai-discovered</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openssl-cve-2025-15467-stack-overflow-rce-ai-discovered</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenSSL]]></category>
            <category><![CDATA[CVE-2025-15467]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[stack buffer overflow]]></category>
            <category><![CDATA[AISLE]]></category>
            <category><![CDATA[AI security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 29 Jan 2026 16:42:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Sandbox Escape Flaws Allow Full Server Compromise]]></title>
            <description><![CDATA[JFrog discloses CVE-2026-1470 and CVE-2026-0863 in workflow automation platform. Both vulnerabilities enable authenticated remote code execution.]]></description>
            <link>https://www.probablypwned.com/article/n8n-sandbox-escape-cve-2026-1470-cve-2026-0863-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-sandbox-escape-cve-2026-1470-cve-2026-0863-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-1470]]></category>
            <category><![CDATA[CVE-2026-0863]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 29 Jan 2026 13:04:31 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ClickFix Attacks Now Abuse Windows App-V to Deliver Malware]]></title>
            <description><![CDATA[New campaign combines fake CAPTCHA pages with signed Microsoft scripts to bypass security tools and install Amatera infostealer on enterprise systems.]]></description>
            <link>https://www.probablypwned.com/article/clickfix-fake-captcha-appv-scripts-amatera-stealer</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/clickfix-fake-captcha-appv-scripts-amatera-stealer</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[Amatera]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[fake CAPTCHA]]></category>
            <category><![CDATA[App-V]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 29 Jan 2026 13:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mustang Panda Upgrades COOLCLIENT With Browser Credential Theft]]></title>
            <description><![CDATA[Chinese APT adds clipboard monitoring, browser stealing, and enhanced plugins to its long-running backdoor. Government entities in Asia remain primary targets.]]></description>
            <link>https://www.probablypwned.com/article/mustang-panda-coolclient-backdoor-infostealer-browser-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mustang-panda-coolclient-backdoor-infostealer-browser-theft</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Mustang Panda]]></category>
            <category><![CDATA[COOLCLIENT]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[HoneyMyte]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 29 Jan 2026 13:03:10 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware's Evolution: From File Encryption to Psychological Warfare]]></title>
            <description><![CDATA[Modern ransomware gangs have weaponized fear, legal liability, and deadline pressure. Here's how extortion tactics have fundamentally changed.]]></description>
            <link>https://www.probablypwned.com/article/ransomware-psychology-extortion-tactics-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ransomware-psychology-extortion-tactics-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[threat-intelligence]]></category>
            <category><![CDATA[psychology]]></category>
            <category><![CDATA[double-extortion]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 28 Jan 2026 13:05:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress Plugin Flaw Gives Attackers Admin Access Without Login]]></title>
            <description><![CDATA[CVE-2026-23550 in Modular DS plugin scores CVSS 10.0. Active exploitation began January 13, with 40,000+ sites at risk.]]></description>
            <link>https://www.probablypwned.com/article/wordpress-modular-ds-cve-2026-23550-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wordpress-modular-ds-cve-2026-23550-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[CVE-2026-23550]]></category>
            <category><![CDATA[privilege-escalation]]></category>
            <category><![CDATA[Modular DS]]></category>
            <category><![CDATA[CVSS-10]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 28 Jan 2026 13:04:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet FortiCloud SSO Zero-Day Exploited to Hijack Firewalls]]></title>
            <description><![CDATA[CVE-2026-24858 allows attackers with FortiCloud accounts to log into other organizations' FortiGate devices. Patches rolling out now.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-forticloud-sso-zero-day-cve-2026-24858</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-forticloud-sso-zero-day-cve-2026-24858</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2026-24858]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[authentication-bypass]]></category>
            <category><![CDATA[FortiCloud]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 28 Jan 2026 13:03:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Data Privacy Week 2026 Kicks Off With AI and Children's Privacy Focus]]></title>
            <description><![CDATA[The NCA's annual campaign runs January 26-30 with daily sessions on AI chatbots, dynamic pricing, and the right to be forgotten.]]></description>
            <link>https://www.probablypwned.com/article/data-privacy-week-2026-take-control-of-your-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/data-privacy-week-2026-take-control-of-your-data</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[data privacy]]></category>
            <category><![CDATA[NCA]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[privacy rights]]></category>
            <category><![CDATA[children's privacy]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 27 Jan 2026 13:06:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SmarterMail Auth Bypass Lets Attackers Reset Admin Passwords]]></title>
            <description><![CDATA[CVE-2026-23760 enables unauthenticated admin takeover in SmarterMail. Exploitation began two days after patch release.]]></description>
            <link>https://www.probablypwned.com/article/smartermail-cve-2026-23760-admin-password-reset-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smartermail-cve-2026-23760-admin-password-reset-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-23760]]></category>
            <category><![CDATA[SmarterMail]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 27 Jan 2026 13:05:25 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Office Zero-Day Under Active Attack Gets Emergency Patch]]></title>
            <description><![CDATA[CVE-2026-21509 bypasses OLE security protections across Office 2016-2024. CISA adds it to KEV catalog with February 16 deadline.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-office-zero-day-cve-2026-21509-ole-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-office-zero-day-cve-2026-21509-ole-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-21509]]></category>
            <category><![CDATA[Office]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 27 Jan 2026 13:02:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064548016-0b5c13ca2c85?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064548016-0b5c13ca2c85?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Probes Windows 11 Boot Failures After January Patch]]></title>
            <description><![CDATA[KB5074109 update causing UNMOUNTABLE_BOOT_VOLUME errors on some Windows 11 devices. Physical machines affected; VMs appear unimpacted.]]></description>
            <link>https://www.probablypwned.com/article/windows-11-boot-failures-january-2026-patch-kb5074109</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/windows-11-boot-failures-january-2026-patch-kb5074109</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Windows 11]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[KB5074109]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[boot failure]]></category>
            <category><![CDATA[BSOD]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 26 Jan 2026 13:09:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea's Konni APT Deploys AI-Built Malware Against Devs]]></title>
            <description><![CDATA[Check Point uncovers Konni campaign using AI-generated PowerShell backdoors to target blockchain developers across Asia-Pacific. Marks shift from diplomatic espionage.]]></description>
            <link>https://www.probablypwned.com/article/konni-apt-ai-generated-powershell-malware-blockchain-developers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/konni-apt-ai-generated-powershell-malware-blockchain-developers</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Konni]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[AI malware]]></category>
            <category><![CDATA[blockchain]]></category>
            <category><![CDATA[Opal Sleet]]></category>
            <category><![CDATA[PowerShell]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 26 Jan 2026 13:08:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Firefox 147 Fixes 16 Vulnerabilities Including Sandbox Escapes]]></title>
            <description><![CDATA[Mozilla patches six high-severity flaws in Firefox 147 and ESR releases. Multiple sandbox escape vulnerabilities could enable arbitrary code execution.]]></description>
            <link>https://www.probablypwned.com/article/firefox-147-security-update-16-vulnerabilities-sandbox-escapes</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/firefox-147-security-update-16-vulnerabilities-sandbox-escapes</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Firefox]]></category>
            <category><![CDATA[Mozilla]]></category>
            <category><![CDATA[CVE-2026-0891]]></category>
            <category><![CDATA[CVE-2026-0892]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 26 Jan 2026 13:07:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Curl Ends Bug Bounty Program After AI Slop Floods Queue]]></title>
            <description><![CDATA[The ubiquitous command-line tool will stop accepting HackerOne submissions January 31. After $86K paid across 78 vulnerabilities, AI-generated noise made the program unsustainable.]]></description>
            <link>https://www.probablypwned.com/article/curl-ends-bug-bounty-ai-generated-reports</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/curl-ends-bug-bounty-ai-generated-reports</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[curl]]></category>
            <category><![CDATA[bug bounty]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[HackerOne]]></category>
            <category><![CDATA[security research]]></category>
            <category><![CDATA[open source]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sun, 25 Jan 2026 13:05:14 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1531746790731-6c087fecd65a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1531746790731-6c087fecd65a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VSCode Extensions With 1.5M Installs Exfiltrate Code to China]]></title>
            <description><![CDATA[Two AI coding assistants on Microsoft's marketplace steal source code and credentials in real-time. Extensions use hidden iframes and analytics SDKs to profile developers.]]></description>
            <link>https://www.probablypwned.com/article/malicious-vscode-extensions-china-1-5-million-installs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/malicious-vscode-extensions-china-1-5-million-installs</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VSCode]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[developer tools]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[data theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 25 Jan 2026 13:04:42 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1542831371-29b0f74f9713?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ShinyHunters Vishing Campaign Targets Okta SSO Accounts]]></title>
            <description><![CDATA[Extortion group confirms voice phishing attacks stealing SSO credentials from Crunchbase, Betterment, and more. Custom phishing kits enable real-time MFA bypass.]]></description>
            <link>https://www.probablypwned.com/article/shinyhunters-vishing-okta-sso-crunchbase-betterment</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shinyhunters-vishing-okta-sso-crunchbase-betterment</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[vishing]]></category>
            <category><![CDATA[Okta]]></category>
            <category><![CDATA[SSO]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 25 Jan 2026 13:04:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560264280-88b68371db39?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds VMware vCenter, Zimbra Flaws to Exploited List]]></title>
            <description><![CDATA[Five vulnerabilities added to CISA's KEV catalog this week. VMware vCenter RCE bug patched 18 months ago now seeing active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-vmware-vcenter-zimbra-versa-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-vmware-vcenter-zimbra-versa-january-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[VMware]]></category>
            <category><![CDATA[Zimbra]]></category>
            <category><![CDATA[CVE-2024-37079]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:05:45 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[AitM Phishing Campaign Hits Energy Sector via SharePoint]]></title>
            <description><![CDATA[Microsoft disrupts multi-stage attack combining adversary-in-the-middle phishing with BEC. Attackers abused SharePoint and inbox rules for persistence.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-aitm-phishing-bec-energy-sector</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-aitm-phishing-bec-energy-sector</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[AitM]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[BEC]]></category>
            <category><![CDATA[energy sector]]></category>
            <category><![CDATA[SharePoint]]></category>
            <category><![CDATA[Microsoft]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:05:07 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Osiris Ransomware Uses Custom Driver to Kill Security Tools]]></title>
            <description><![CDATA[New ransomware family employs BYOVD technique with POORTRY driver to disable endpoint protection. Evidence links operators to Inc ransomware campaigns.]]></description>
            <link>https://www.probablypwned.com/article/osiris-ransomware-byovd-poortry-driver</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/osiris-ransomware-byovd-poortry-driver</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Osiris]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[BYOVD]]></category>
            <category><![CDATA[POORTRY]]></category>
            <category><![CDATA[Inc ransomware]]></category>
            <category><![CDATA[EDR bypass]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:04:26 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[11-Year-Old Telnet Bug Hands Attackers Root Access]]></title>
            <description><![CDATA[CVE-2026-24061 allows remote authentication bypass in GNU InetUtils telnetd. Exploitation activity detected within hours of disclosure.]]></description>
            <link>https://www.probablypwned.com/article/cve-2026-24061-gnu-inetutils-telnetd-root-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cve-2026-24061-gnu-inetutils-telnetd-root-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-24061]]></category>
            <category><![CDATA[telnet]]></category>
            <category><![CDATA[GNU InetUtils]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:03:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Sandworm Deploys DynoWiper in Attack on Poland's Power Grid]]></title>
            <description><![CDATA[ESET researchers attribute December cyberattack on Polish energy infrastructure to Russian GRU hackers. Previously unknown wiper malware recovered.]]></description>
            <link>https://www.probablypwned.com/article/sandworm-dynowiper-poland-power-grid-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sandworm-dynowiper-poland-power-grid-attack</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Sandworm]]></category>
            <category><![CDATA[APT44]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[wiper malware]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[Poland]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 24 Jan 2026 13:03:11 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1473341304170-971dccb5ac1e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1473341304170-971dccb5ac1e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiGate Patch Fails: Attackers Still Exploiting SSO Bypass]]></title>
            <description><![CDATA[Arctic Wolf reports automated attacks creating rogue admin accounts on supposedly patched FortiGate devices. Fortinet acknowledges incomplete fix.]]></description>
            <link>https://www.probablypwned.com/article/fortigate-patch-bypass-cve-2025-59718-attacks-continue</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortigate-patch-bypass-cve-2025-59718-attacks-continue</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2025-59718]]></category>
            <category><![CDATA[FortiGate]]></category>
            <category><![CDATA[patch bypass]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 23 Jan 2026 13:06:08 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pwn2Own Automotive 2026 Ends With 76 Zero-Days, $1M+ Awarded]]></title>
            <description><![CDATA[Fuzzware.io claims Master of Pwn at Tokyo competition after researchers demonstrate record-breaking exploits against Tesla, EV chargers, and infotainment systems.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-automotive-2026-final-76-zero-days-master-of-pwn</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-automotive-2026-final-76-zero-days-master-of-pwn</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[automotive security]]></category>
            <category><![CDATA[EV chargers]]></category>
            <category><![CDATA[Tesla]]></category>
            <category><![CDATA[Master of Pwn]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 23 Jan 2026 13:05:24 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1553260168-4cb5dafc1108?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1553260168-4cb5dafc1108?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russia's Fancy Bear Running Low-Cost Credential Theft Across Three Continents]]></title>
            <description><![CDATA[Recorded Future tracks APT28 harvesting credentials from energy, defense, and government targets in the Balkans, Middle East, and Central Asia using free hosting infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/apt28-fancy-bear-credential-harvesting-balkans-central-asia</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-fancy-bear-credential-harvesting-balkans-central-asia</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[Fancy Bear]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[GRU]]></category>
            <category><![CDATA[credential harvesting]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 22 Jan 2026 13:08:52 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517976487492-5750f3195933?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LastPass Warns of Phishing Campaign Targeting Master Passwords]]></title>
            <description><![CDATA[Fake maintenance emails urge users to backup their vaults before a deadline, redirecting victims to credential-harvesting sites. The campaign launched over MLK weekend.]]></description>
            <link>https://www.probablypwned.com/article/lastpass-phishing-campaign-vault-backup-master-password</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lastpass-phishing-campaign-vault-backup-master-password</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[LastPass]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[password manager]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 22 Jan 2026 13:08:02 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pwn2Own Automotive 2026 Day Two: 66 Zero-Days, $955K in Prizes]]></title>
            <description><![CDATA[Researchers demonstrated 29 new zero-day exploits on Day Two at Pwn2Own Automotive in Tokyo, targeting EV chargers, infotainment systems, and Automotive Grade Linux.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-automotive-2026-day-two-66-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-automotive-2026-day-two-66-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[automotive security]]></category>
            <category><![CDATA[EV chargers]]></category>
            <category><![CDATA[Tesla]]></category>
            <category><![CDATA[IVI]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 22 Jan 2026 13:07:09 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1549317661-bd32c8ce0db2?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1549317661-bd32c8ce0db2?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Zoom Patches CVSS 9.9 Flaw That Let Meeting Participants Run Code]]></title>
            <description><![CDATA[CVE-2026-22844 allowed meeting participants to execute arbitrary code on Zoom's on-premises multimedia routers. No active exploitation reported yet.]]></description>
            <link>https://www.probablypwned.com/article/zoom-mmr-cve-2026-22844-critical-rce-meeting-participant</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zoom-mmr-cve-2026-22844-critical-rce-meeting-participant</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-22844]]></category>
            <category><![CDATA[Zoom]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 22 Jan 2026 13:06:21 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1587825140708-dfaf72ae4b04?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1587825140708-dfaf72ae4b04?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fake Ad Blocker Crashes Browsers to Deploy Enterprise Backdoor]]></title>
            <description><![CDATA[The NexShield Chrome extension impersonated uBlock Origin's developer and used ClickFix techniques to deliver ModeloRAT malware to corporate networks.]]></description>
            <link>https://www.probablypwned.com/article/nexshield-crashfix-chrome-extension-modelorat-enterprise</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nexshield-crashfix-chrome-extension-modelorat-enterprise</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[ModeloRAT]]></category>
            <category><![CDATA[CrashFix]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[KongTuke]]></category>
            <category><![CDATA[enterprise malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 21 Jan 2026 13:09:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WordPress ACF Extended Bug Lets Anyone Become Admin]]></title>
            <description><![CDATA[CVE-2025-14533 in the ACF Extended plugin allows unauthenticated attackers to register as administrators on 100,000 WordPress sites.]]></description>
            <link>https://www.probablypwned.com/article/acf-extended-wordpress-cve-2025-14533-admin-takeover</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/acf-extended-wordpress-cve-2025-14533-admin-takeover</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-14533]]></category>
            <category><![CDATA[WordPress]]></category>
            <category><![CDATA[ACF Extended]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[admin takeover]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 21 Jan 2026 13:08:33 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507238691740-187a5b1d37b8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507238691740-187a5b1d37b8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pwn2Own Automotive Day One: Tesla Hacked, $516K Awarded]]></title>
            <description><![CDATA[Researchers exploited 37 zero-day vulnerabilities in Tesla systems, EV chargers, and infotainment units during the first day of Pwn2Own Automotive 2026 in Tokyo.]]></description>
            <link>https://www.probablypwned.com/article/pwn2own-automotive-2026-day-one-tesla-37-zero-days</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pwn2own-automotive-2026-day-one-tesla-37-zero-days</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Pwn2Own]]></category>
            <category><![CDATA[Tesla]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[automotive security]]></category>
            <category><![CDATA[EV chargers]]></category>
            <category><![CDATA[bug bounty]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 21 Jan 2026 13:07:41 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1593941707874-ef25b8b4a92b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1593941707874-ef25b8b4a92b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EU Proposes Cybersecurity Overhaul to Counter Supply Chain Risks]]></title>
            <description><![CDATA[The European Commission's revised Cybersecurity Act expands ENISA's powers and creates a framework to restrict high-risk technology suppliers.]]></description>
            <link>https://www.probablypwned.com/article/eu-cybersecurity-act-revision-enisa-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/eu-cybersecurity-act-revision-enisa-supply-chain</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[EU]]></category>
            <category><![CDATA[ENISA]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[cybersecurity policy]]></category>
            <category><![CDATA[Huawei]]></category>
            <category><![CDATA[regulation]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 21 Jan 2026 13:07:06 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1519389950473-47ba0277781c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1519389950473-47ba0277781c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Best Cybersecurity Tools on Amazon for Security Professionals]]></title>
            <description><![CDATA[Essential hardware security tools every pentester and security professional needs. From YubiKeys to WiFi adapters, these Amazon picks protect your digital life.]]></description>
            <link>https://www.probablypwned.com/article/best-cybersecurity-tools-amazon-2025</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/best-cybersecurity-tools-amazon-2025</guid>
            <category><![CDATA[Tools]]></category>
            <category><![CDATA[hardware-security]]></category>
            <category><![CDATA[penetration-testing]]></category>
            <category><![CDATA[YubiKey]]></category>
            <category><![CDATA[security-tools]]></category>
            <category><![CDATA[Amazon]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Warns Ransomware Groups Targeting SimpleHelp RMM]]></title>
            <description><![CDATA[DragonForce and other actors exploiting CVE-2024-57727 to compromise utility billing providers and their downstream customers.]]></description>
            <link>https://www.probablypwned.com/article/cisa-simplehelp-ransomware-utility-billing-dragonforce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-simplehelp-ransomware-utility-billing-dragonforce</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[SimpleHelp]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[DragonForce]]></category>
            <category><![CDATA[RMM]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 13:05:51 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[PDFSider Backdoor Hits Fortune 100 Firm, Linked to Qilin]]></title>
            <description><![CDATA[Resecurity uncovers stealthy DLL-sideloading malware with APT-grade anti-VM tricks. Multiple ransomware groups now deploying it.]]></description>
            <link>https://www.probablypwned.com/article/pdfsider-malware-fortune-100-qilin-ransomware-dll-sideload</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pdfsider-malware-fortune-100-qilin-ransomware-dll-sideload</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[PDFSider]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[DLL sideloading]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[finance]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 13:04:56 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ingram Micro Confirms Ransomware Breach Affecting 42,000]]></title>
            <description><![CDATA[SafePay ransomware group allegedly stole 3.5TB from the $48B IT distributor. Employee SSNs, passports, and performance reviews exposed.]]></description>
            <link>https://www.probablypwned.com/article/ingram-micro-ransomware-breach-42000-employees-safepay</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ingram-micro-ransomware-breach-42000-employees-safepay</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Ingram Micro]]></category>
            <category><![CDATA[SafePay]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 13:04:19 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1568952433726-3896e3881c65?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1568952433726-3896e3881c65?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Oracle Patches 336 Vulnerabilities in January 2026 CPU]]></title>
            <description><![CDATA[Multiple CVSS 10.0 flaws affect Commerce, Communications, and PeopleSoft. MySQL patches include a critical 9.8-severity bug.]]></description>
            <link>https://www.probablypwned.com/article/oracle-critical-patch-update-january-2026-336-vulnerabilities</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/oracle-critical-patch-update-january-2026-336-vulnerabilities</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[Critical Patch Update]]></category>
            <category><![CDATA[MySQL]]></category>
            <category><![CDATA[Java]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 20 Jan 2026 13:03:40 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apache Struts XXE Flaw Exposes Enterprise Apps to Data Theft]]></title>
            <description><![CDATA[CVE-2025-68493 in the XWork component enables XML External Entity attacks that can leak files, perform SSRF, or crash systems. Patch to version 6.1.1.]]></description>
            <link>https://www.probablypwned.com/article/apache-struts-xxe-cve-2025-68493-sensitive-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apache-struts-xxe-cve-2025-68493-sensitive-data</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache Struts]]></category>
            <category><![CDATA[CVE-2025-68493]]></category>
            <category><![CDATA[XXE]]></category>
            <category><![CDATA[Java]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 19 Jan 2026 13:05:58 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical zlib Buffer Overflow Threatens Widespread Systems]]></title>
            <description><![CDATA[CVE-2026-22184 allows attackers to trigger memory corruption via an oversized archive name in zlib's untgz utility. No patch existed at initial disclosure.]]></description>
            <link>https://www.probablypwned.com/article/zlib-untgz-buffer-overflow-cve-2026-22184</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/zlib-untgz-buffer-overflow-cve-2026-22184</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[zlib]]></category>
            <category><![CDATA[CVE-2026-22184]]></category>
            <category><![CDATA[buffer overflow]]></category>
            <category><![CDATA[memory corruption]]></category>
            <category><![CDATA[open source]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 19 Jan 2026 13:05:27 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[BreachForums Database Leaked, Exposing 324K Users]]></title>
            <description><![CDATA[A backup misconfiguration led to the exposure of nearly 324,000 user records from the notorious hacking forum, including usernames, hashed passwords, and IP addresses.]]></description>
            <link>https://www.probablypwned.com/article/breachforums-database-leak-324000-cybercriminal-users</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/breachforums-database-leak-324000-cybercriminal-users</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[BreachForums]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[cybercrime]]></category>
            <category><![CDATA[hacking forum]]></category>
            <category><![CDATA[irony]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 19 Jan 2026 13:04:48 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Releases 10 ICS Advisories for Siemens, Schneider, Others]]></title>
            <description><![CDATA[Industrial control system vulnerabilities disclosed in Siemens RUGGEDCOM, Industrial Edge devices, Schneider EcoStruxure, AVEVA, and Festo products.]]></description>
            <link>https://www.probablypwned.com/article/cisa-ics-advisories-siemens-schneider-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-ics-advisories-siemens-schneider-january-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[ICS]]></category>
            <category><![CDATA[Siemens]]></category>
            <category><![CDATA[Schneider Electric]]></category>
            <category><![CDATA[AVEVA]]></category>
            <category><![CDATA[Festo]]></category>
            <category><![CDATA[OT security]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 14:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1581091226825-a6a2a5aee158?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Shadow AI Drives 2x Surge in Enterprise Data Violations]]></title>
            <description><![CDATA[Netskope report finds organizations average 223 GenAI policy incidents monthly as employees use personal accounts to access AI tools outside corporate controls.]]></description>
            <link>https://www.probablypwned.com/article/netskope-shadow-ai-genai-data-violations-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/netskope-shadow-ai-genai-data-violations-2026</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[GenAI]]></category>
            <category><![CDATA[shadow AI]]></category>
            <category><![CDATA[data leakage]]></category>
            <category><![CDATA[Netskope]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[policy violations]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 13:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1620712943543-bcc4688e7485?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Announces Ads Coming to ChatGPT Free Tier]]></title>
            <description><![CDATA[AI company will begin testing advertisements in ChatGPT for US users in coming weeks, projecting $1 billion in ad revenue by end of 2026.]]></description>
            <link>https://www.probablypwned.com/article/openai-chatgpt-ads-free-users-privacy-concerns</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-chatgpt-ads-free-users-privacy-concerns</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[advertising]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[privacy]]></category>
            <category><![CDATA[monetization]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 11:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI: BadBox 2.0 Malware Pre-Installed on 1M+ Android Devices]]></title>
            <description><![CDATA[Budget Android TV boxes and tablets ship with backdoors from the factory, turning home networks into criminal infrastructure for ad fraud and proxy services.]]></description>
            <link>https://www.probablypwned.com/article/fbi-badbox-2-android-malware-million-devices</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-badbox-2-android-malware-million-devices</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[BadBox]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[FBI]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 10:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iran-Linked Hackers Target Middle East Officials via WhatsApp]]></title>
            <description><![CDATA[APT42 campaign compromises government ministers, activists, and journalists through fake login pages and real-time surveillance capabilities.]]></description>
            <link>https://www.probablypwned.com/article/apt42-iran-whatsapp-gmail-middle-east-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt42-iran-whatsapp-gmail-middle-east-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT42]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[Gmail]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[IRGC]]></category>
            <category><![CDATA[Middle East]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 18 Jan 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[TamperedChef Infostealer Hides in Fake PDF Editors via Google Ads]]></title>
            <description><![CDATA[Sophos exposes malvertising campaign that stayed dormant for 56 days before activating credential theft across 50+ fraudulent domains.]]></description>
            <link>https://www.probablypwned.com/article/tamperedchef-malvertising-pdf-infostealer-google-ads</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/tamperedchef-malvertising-pdf-infostealer-google-ads</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[TamperedChef]]></category>
            <category><![CDATA[malvertising]]></category>
            <category><![CDATA[Google Ads]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[PDF]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 16:58:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Astaroth Banking Trojan Spreads via WhatsApp Worm in Brazil]]></title>
            <description><![CDATA[New Boto Cor-de-Rosa campaign uses Python-based worm module to auto-send malware through victims' WhatsApp contacts.]]></description>
            <link>https://www.probablypwned.com/article/astaroth-whatsapp-worm-brazil-boto-cor-de-rosa</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/astaroth-whatsapp-worm-brazil-boto-cor-de-rosa</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Astaroth]]></category>
            <category><![CDATA[banking trojan]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[Brazil]]></category>
            <category><![CDATA[worm]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 16:57:57 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Black Cat Infects 278,000 Hosts in China via SEO Poisoning]]></title>
            <description><![CDATA[Cybercrime group uses fake software downloads and malicious Bing ads to deploy infostealer malware at scale across Chinese systems.]]></description>
            <link>https://www.probablypwned.com/article/black-cat-seo-poisoning-china-278000-hosts-infected</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/black-cat-seo-poisoning-china-278000-hosts-infected</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Black Cat]]></category>
            <category><![CDATA[SEO poisoning]]></category>
            <category><![CDATA[malvertising]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[China]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 16:57:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SHADOW#REACTOR Campaign Drops Remcos RAT via MSBuild]]></title>
            <description><![CDATA[Multi-stage malware campaign uses text-based stagers and living-off-the-land binaries to deliver Remcos RAT to enterprise targets.]]></description>
            <link>https://www.probablypwned.com/article/shadow-reactor-remcos-rat-msbuild-enterprise-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/shadow-reactor-remcos-rat-msbuild-enterprise-attacks</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Remcos RAT]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[SHADOW#REACTOR]]></category>
            <category><![CDATA[MSBuild]]></category>
            <category><![CDATA[initial access broker]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 16:56:59 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Extensions Target Workday and NetSuite for Session Theft]]></title>
            <description><![CDATA[Five malicious extensions masquerading as HR tools steal authentication tokens, block security panels, and enable account takeover through cookie injection.]]></description>
            <link>https://www.probablypwned.com/article/chrome-extensions-workday-netsuite-session-hijacking</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-extensions-workday-netsuite-session-hijacking</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[Workday]]></category>
            <category><![CDATA[NetSuite]]></category>
            <category><![CDATA[session hijacking]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[browser security]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 15:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[StealC XSS Flaw Let Researchers Monitor Malware Operators]]></title>
            <description><![CDATA[CyberArk exploited a vulnerability in the StealC infostealer's control panel to identify threat actors, steal session cookies, and track an operator who compromised 5,000 victims.]]></description>
            <link>https://www.probablypwned.com/article/stealc-xss-vulnerability-researchers-hack-hackers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/stealc-xss-vulnerability-researchers-hack-hackers</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[StealC]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <category><![CDATA[CyberArk]]></category>
            <category><![CDATA[malware research]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 14:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Reprompt Attack Turned Microsoft Copilot Into a Data Thief]]></title>
            <description><![CDATA[Varonis researchers disclosed a vulnerability chain that let attackers exfiltrate user data through Copilot with a single malicious link click. Microsoft has patched the issue.]]></description>
            <link>https://www.probablypwned.com/article/reprompt-attack-microsoft-copilot-single-click-exfiltration</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/reprompt-attack-microsoft-copilot-single-click-exfiltration</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Copilot]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[data exfiltration]]></category>
            <category><![CDATA[Varonis]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 13:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Victoria Education Breach Exposes Student Data at 1,700 Schools]]></title>
            <description><![CDATA[Australian government schools confirm hackers accessed student names, emails, and encrypted passwords. VCE students prioritized for credential resets before school year.]]></description>
            <link>https://www.probablypwned.com/article/victorian-education-breach-1700-schools-student-data</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/victorian-education-breach-1700-schools-student-data</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Australia]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[student data]]></category>
            <category><![CDATA[Victoria]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 11:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580582932707-520aed937b7b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580582932707-520aed937b7b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Black Basta Leader Oleg Nefedov Added to Interpol Wanted List]]></title>
            <description><![CDATA[German and Ukrainian authorities identify 35-year-old Russian national as Black Basta boss, raid homes of two affiliates in Ukraine.]]></description>
            <link>https://www.probablypwned.com/article/black-basta-leader-oleg-nefedov-interpol-red-notice</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/black-basta-leader-oleg-nefedov-interpol-red-notice</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Black Basta]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Interpol]]></category>
            <category><![CDATA[law enforcement]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Europol]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 10:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1589994965851-a8f479c573a9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1589994965851-a8f479c573a9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China-Linked UAT-8837 Exploits Sitecore Zero-Day in US Attacks]]></title>
            <description><![CDATA[Cisco Talos exposes China-nexus APT targeting critical infrastructure with CVE-2025-53690 exploitation, credential harvesting, and potential supply chain compromise.]]></description>
            <link>https://www.probablypwned.com/article/uat-8837-china-apt-sitecore-zero-day-north-america</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-8837-china-apt-sitecore-zero-day-north-america</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[UAT-8837]]></category>
            <category><![CDATA[Sitecore]]></category>
            <category><![CDATA[CVE-2025-53690]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 17 Jan 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Patches Email Gateway Zero-Day Exploited by Chinese APT]]></title>
            <description><![CDATA[AsyncOS fixes released for CVE-2025-20393 after weeks of active exploitation. Compromised appliances require full rebuild to remove persistent backdoors.]]></description>
            <link>https://www.probablypwned.com/article/cisco-asyncos-cve-2025-20393-patch-released</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-asyncos-cve-2025-20393-patch-released</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2025-20393]]></category>
            <category><![CDATA[AsyncOS]]></category>
            <category><![CDATA[patch]]></category>
            <category><![CDATA[UAT-9686]]></category>
            <category><![CDATA[China APT]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 14:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gootloader Malware Uses 1,000 Stacked ZIPs to Dodge Detection]]></title>
            <description><![CDATA[The initial access malware now delivers payloads through deliberately malformed archives that crash security tools while executing normally on Windows.]]></description>
            <link>https://www.probablypwned.com/article/gootloader-malware-1000-zip-archives-evasion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gootloader-malware-1000-zip-archives-evasion</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Gootloader]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[evasion]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Vanilla Tempest]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 13:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WhisperPair Flaw Lets Hackers Hijack Sony, Google Headphones]]></title>
            <description><![CDATA[Critical Google Fast Pair vulnerability affects millions of wireless audio devices from major manufacturers. Attackers can eavesdrop on calls within Bluetooth range.]]></description>
            <link>https://www.probablypwned.com/article/whisperpair-bluetooth-vulnerability-google-fast-pair</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/whisperpair-bluetooth-vulnerability-google-fast-pair</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WhisperPair]]></category>
            <category><![CDATA[Bluetooth]]></category>
            <category><![CDATA[Google Fast Pair]]></category>
            <category><![CDATA[CVE-2025-36911]]></category>
            <category><![CDATA[eavesdropping]]></category>
            <category><![CDATA[Sony]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 12:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1505740420928-5e560c06d30e?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1505740420928-5e560c06d30e?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Dismantles RedVDS Phishing Platform Behind $40M Fraud]]></title>
            <description><![CDATA[Coordinated takedown seizes cybercrime service that enabled 191,000 account compromises. Operation marks Microsoft's 35th action against criminal infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-redvds-takedown-40-million-fraud</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-redvds-takedown-40-million-fraud</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[RedVDS]]></category>
            <category><![CDATA[takedown]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[BEC]]></category>
            <category><![CDATA[cybercrime]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 10:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Grubhub Hit by Second Breach, ShinyHunters Demanding Ransom]]></title>
            <description><![CDATA[Food delivery giant confirms hackers stole data and are now extorting the company. Attack traced to credentials stolen in August 2025 Salesloft breach.]]></description>
            <link>https://www.probablypwned.com/article/grubhub-data-breach-shinyhunters-extortion-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/grubhub-data-breach-shinyhunters-extortion-january-2026</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Grubhub]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 16 Jan 2026 09:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1460925895917-afdab827c52f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cal.com Flaw Lets Attackers Bypass MFA With Fake TOTP Codes]]></title>
            <description><![CDATA[Critical authentication bug in popular scheduling platform reduces multi-factor auth to single-factor. Patch available in version 6.0.7.]]></description>
            <link>https://www.probablypwned.com/article/cal-com-totp-bypass-account-takeover-vulnerability</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cal-com-totp-bypass-account-takeover-vulnerability</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cal.com]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <category><![CDATA[authentication]]></category>
            <category><![CDATA[account takeover]]></category>
            <category><![CDATA[TOTP]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 15 Jan 2026 12:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n Sandbox Escape Lets Users Run System Commands]]></title>
            <description><![CDATA[CVE-2025-68668 bypasses Python code restrictions in workflow automation platform. CVSS 9.9 flaw affects versions 1.0.0 through 1.x.]]></description>
            <link>https://www.probablypwned.com/article/n8n-python-sandbox-bypass-cve-2025-68668</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-python-sandbox-bypass-cve-2025-68668</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2025-68668]]></category>
            <category><![CDATA[sandbox escape]]></category>
            <category><![CDATA[Python]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[workflow automation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 15 Jan 2026 11:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1515879218367-8466d910aaa4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russian Hackers Target Ukraine Military With Fake Charities]]></title>
            <description><![CDATA[Void Blizzard deploys PLUGGYAPE backdoor through Signal and WhatsApp, impersonating charitable organizations to compromise Ukrainian defense forces.]]></description>
            <link>https://www.probablypwned.com/article/void-blizzard-pluggyape-malware-ukraine-defense</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/void-blizzard-pluggyape-malware-ukraine-defense</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Void Blizzard]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[Ukraine]]></category>
            <category><![CDATA[PLUGGYAPE]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 15 Jan 2026 09:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Palo Alto Patches GlobalProtect DoS Flaw With Public PoC]]></title>
            <description><![CDATA[CVE-2026-0227 allows unauthenticated attackers to crash firewalls via malformed packets. Proof-of-concept code is publicly available.]]></description>
            <link>https://www.probablypwned.com/article/palo-alto-pan-os-globalprotect-dos-cve-2026-0227</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/palo-alto-pan-os-globalprotect-dos-cve-2026-0227</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Palo Alto Networks]]></category>
            <category><![CDATA[PAN-OS]]></category>
            <category><![CDATA[CVE-2026-0227]]></category>
            <category><![CDATA[GlobalProtect]]></category>
            <category><![CDATA[DoS]]></category>
            <category><![CDATA[firewall]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 15 Jan 2026 08:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Everest Gang Claims 900GB Nissan Breach, Sets 5-Day Deadline]]></title>
            <description><![CDATA[Russia-linked ransomware group posts samples allegedly from Nissan's internal systems including dealership records and financial documents.]]></description>
            <link>https://www.probablypwned.com/article/everest-ransomware-nissan-900gb-data-breach-claim</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/everest-ransomware-nissan-900gb-data-breach-claim</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[Nissan]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[automotive]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 14:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1503376780353-7e6692767b70?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1503376780353-7e6692767b70?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Attackers Mapped 91,000+ AI Endpoints in Mass Recon Campaign]]></title>
            <description><![CDATA[GreyNoise honeypot data reveals coordinated reconnaissance of LLM infrastructure including OpenAI, Claude, and Ollama deployments over 11 days.]]></description>
            <link>https://www.probablypwned.com/article/greynoise-91000-attacks-llm-ai-infrastructure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/greynoise-91000-attacks-llm-ai-infrastructure</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[LLM]]></category>
            <category><![CDATA[Ollama]]></category>
            <category><![CDATA[reconnaissance]]></category>
            <category><![CDATA[GreyNoise]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 13:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442135136-760c813a743d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[VoidLink: New Malware Framework Built for Linux Cloud Attacks]]></title>
            <description><![CDATA[Check Point researchers expose a sophisticated cloud-native malware framework designed from the ground up to target AWS, Azure, GCP, and containerized environments.]]></description>
            <link>https://www.probablypwned.com/article/voidlink-malware-framework-linux-cloud-check-point</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/voidlink-malware-framework-linux-cloud-check-point</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[VoidLink]]></category>
            <category><![CDATA[Linux]]></category>
            <category><![CDATA[cloud security]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[AWS]]></category>
            <category><![CDATA[Azure]]></category>
            <category><![CDATA[containers]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 11:45:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FortiSIEM RCE Flaw Lets Attackers Gain Root Without Auth]]></title>
            <description><![CDATA[CVE-2025-64155 in Fortinet's SIEM product enables unauthenticated command injection via phMonitor service. CVSS 9.4, patches now available.]]></description>
            <link>https://www.probablypwned.com/article/fortisiem-critical-rce-cve-2025-64155-unauthenticated</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortisiem-critical-rce-cve-2025-64155-unauthenticated</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[FortiSIEM]]></category>
            <category><![CDATA[CVE-2025-64155]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 10:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Patches 113 CVEs Including Actively Exploited Zero-Day]]></title>
            <description><![CDATA[January 2026 Patch Tuesday addresses CVE-2026-20805, an info disclosure bug already under attack. CISA gives feds until February 3 to patch.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-patch-tuesday-january-2026-zero-day-cve-2026-20805</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-patch-tuesday-january-2026-zero-day-cve-2026-20805</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[Patch Tuesday]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2026-20805]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 14 Jan 2026 09:15:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633419461186-7d40a38105ec?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633419461186-7d40a38105ec?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WEF Report: CEOs Now Fear AI-Powered Fraud More Than Ransomware]]></title>
            <description><![CDATA[Global Cybersecurity Outlook 2026 finds executives prioritizing cyber-enabled fraud as top risk. Report warns of 'three-front war' against crime, AI misuse, and supply chain threats.]]></description>
            <link>https://www.probablypwned.com/article/wef-cybersecurity-outlook-2026-fraud-overtakes-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/wef-cybersecurity-outlook-2026-fraud-overtakes-ransomware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[World Economic Forum]]></category>
            <category><![CDATA[cybersecurity trends]]></category>
            <category><![CDATA[AI threats]]></category>
            <category><![CDATA[fraud]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 13 Jan 2026 16:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557804506-669a67965ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chinese APT Used VMware ESXi Zero-Days to Escape VMs]]></title>
            <description><![CDATA[Huntress researchers discover 'MAESTRO' toolkit exploiting three VMware vulnerabilities. Attackers chained SonicWall VPN access with hypervisor escape to deploy persistent backdoors.]]></description>
            <link>https://www.probablypwned.com/article/vmware-esxi-maestro-zero-day-china-apt-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/vmware-esxi-maestro-zero-day-china-apt-exploitation</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[VMware]]></category>
            <category><![CDATA[ESXi]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[hypervisor escape]]></category>
            <category><![CDATA[SonicWall]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 13 Jan 2026 15:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SAP Patches CVSS 9.9 SQL Injection in January Update]]></title>
            <description><![CDATA[January 2026 Patch Day addresses 17 flaws including four HotNews vulnerabilities. CVE-2026-0501 allows authenticated attackers to compromise S/4HANA financial systems.]]></description>
            <link>https://www.probablypwned.com/article/sap-security-patch-day-january-2026-critical-sql-injection</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sap-security-patch-day-january-2026-critical-sql-injection</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SAP]]></category>
            <category><![CDATA[CVE-2026-0501]]></category>
            <category><![CDATA[SQL injection]]></category>
            <category><![CDATA[S/4HANA]]></category>
            <category><![CDATA[patch tuesday]]></category>
            <category><![CDATA[enterprise security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 13 Jan 2026 14:30:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Salt Typhoon Breaches Congressional Committee Staff Emails]]></title>
            <description><![CDATA[Chinese state hackers accessed email accounts of House staffers working on China, foreign affairs, and defense. The intrusion was discovered in December.]]></description>
            <link>https://www.probablypwned.com/article/salt-typhoon-congressional-committee-email-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/salt-typhoon-congressional-committee-email-breach</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Salt Typhoon]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Congress]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 12 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1501776192086-602832fae6e4?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1501776192086-602832fae6e4?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Australian Insurer Prosura Breach Exposes Driver's Licenses]]></title>
            <description><![CDATA[Attackers claim 98 million records from the car rental insurance provider. Stolen data includes license photos, policy documents, and personal details.]]></description>
            <link>https://www.probablypwned.com/article/prosura-australia-insurance-breach-98-million-records</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/prosura-australia-insurance-breach-98-million-records</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Prosura]]></category>
            <category><![CDATA[Australia]]></category>
            <category><![CDATA[insurance]]></category>
            <category><![CDATA[PII]]></category>
            <category><![CDATA[identity theft]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 12 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1450101499163-c8848c66ca85?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1450101499163-c8848c66ca85?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[FBI Warns Kimsuky Using QR Codes to Steal Credentials]]></title>
            <description><![CDATA[North Korean APT embeds malicious QR codes in spear-phishing emails to bypass corporate email security and compromise mobile devices.]]></description>
            <link>https://www.probablypwned.com/article/fbi-kimsuky-quishing-north-korea-qr-codes</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fbi-kimsuky-quishing-north-korea-qr-codes</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Kimsuky]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[quishing]]></category>
            <category><![CDATA[QR codes]]></category>
            <category><![CDATA[spear-phishing]]></category>
            <category><![CDATA[APT]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 12 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Meta Denies Breach as 17.5M Instagram Records Fuel Password Reset Attacks]]></title>
            <description><![CDATA[Scraped data from 2024 API misconfiguration resurfaces on dark web. Attackers weaponize leaked emails to flood users with legitimate password reset requests.]]></description>
            <link>https://www.probablypwned.com/article/instagram-17-million-accounts-scraped-password-reset-wave</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/instagram-17-million-accounts-scraped-password-reset-wave</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Instagram]]></category>
            <category><![CDATA[Meta]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[API scraping]]></category>
            <category><![CDATA[password reset]]></category>
            <category><![CDATA[social media]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 16:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Patches ISE Flaw After Public PoC Exploit Emerges]]></title>
            <description><![CDATA[CVE-2026-20029 lets authenticated admins read restricted system files through XML parsing weakness. Trend Micro ZDI researcher found the bug; no workarounds available.]]></description>
            <link>https://www.probablypwned.com/article/cisco-ise-xxe-cve-2026-20029-poc-exploit-released</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-ise-xxe-cve-2026-20029-poc-exploit-released</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[CVE-2026-20029]]></category>
            <category><![CDATA[ISE]]></category>
            <category><![CDATA[XXE]]></category>
            <category><![CDATA[PoC exploit]]></category>
            <category><![CDATA[network access control]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 14:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Closes 10 Emergency Directives in Historic Shift]]></title>
            <description><![CDATA[The agency retired directives spanning SolarWinds to Microsoft Exchange in the largest bulk closure ever. KEV catalog now handles most vulnerability mandates.]]></description>
            <link>https://www.probablypwned.com/article/cisa-retires-10-emergency-directives-policy-shift</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-retires-10-emergency-directives-policy-shift</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[emergency directive]]></category>
            <category><![CDATA[BOD 22-01]]></category>
            <category><![CDATA[federal cybersecurity]]></category>
            <category><![CDATA[policy]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 12:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Russia's APT28 Harvests Credentials Across Balkans and Central Asia]]></title>
            <description><![CDATA[Fancy Bear campaigns from February through September 2025 targeted energy, defense, and policy organizations using fake VPN and email login pages.]]></description>
            <link>https://www.probablypwned.com/article/apt28-fancy-bear-credential-theft-balkans-middle-east</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apt28-fancy-bear-credential-theft-balkans-middle-east</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT28]]></category>
            <category><![CDATA[Fancy Bear]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[GRU]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 10:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Angular XSS Flaw Bypasses Sanitization via SVG Script Tags]]></title>
            <description><![CDATA[CVE-2026-22610 lets attackers inject JavaScript through SVG script attributes that Angular's sanitizer fails to recognize. Patches available for versions 19-21.]]></description>
            <link>https://www.probablypwned.com/article/angular-xss-svg-script-cve-2026-22610</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/angular-xss-svg-script-cve-2026-22610</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Angular]]></category>
            <category><![CDATA[CVE-2026-22610]]></category>
            <category><![CDATA[XSS]]></category>
            <category><![CDATA[JavaScript]]></category>
            <category><![CDATA[SVG]]></category>
            <category><![CDATA[web security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 11 Jan 2026 08:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Supply Chain Attacks on Developer Tools: A Growing Threat]]></title>
            <description><![CDATA[From VS Code extensions to automation platforms, attackers are targeting the tools developers trust. Here's what security teams need to know.]]></description>
            <link>https://www.probablypwned.com/article/supply-chain-attacks-developer-tools-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/supply-chain-attacks-developer-tools-guide</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[developer tools]]></category>
            <category><![CDATA[VS Code]]></category>
            <category><![CDATA[Open VSX]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 18:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ransomware Groups to Watch in 2025-2026]]></title>
            <description><![CDATA[Qilin has hit 1,000+ victims. Everest targets critical infrastructure. Here's what security teams need to know about today's most active ransomware operations.]]></description>
            <link>https://www.probablypwned.com/article/ransomware-groups-2025-2026-profiles-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ransomware-groups-2025-2026-profiles-guide</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[RaaS]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 17:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea's Cyber Army: A Lazarus Group Profile]]></title>
            <description><![CDATA[DPRK hackers stole $2B in cryptocurrency in 2025 alone. Understanding Lazarus Group's operations helps defend against state-sponsored financial theft.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-lazarus-cyber-operations-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-lazarus-cyber-operations-guide</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Lazarus Group]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[DPRK]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 16:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[17.5 Million Instagram Accounts Leaked on BreachForums]]></title>
            <description><![CDATA[A threat actor shared Instagram user data including emails and phone numbers for free. Users report receiving suspicious password reset emails within hours of the leak.]]></description>
            <link>https://www.probablypwned.com/article/instagram-17-million-accounts-leaked-breachforums</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/instagram-17-million-accounts-leaked-breachforums</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Instagram]]></category>
            <category><![CDATA[Meta]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[BreachForums]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[social media]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 15:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611162617474-5b21e879e113?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Healthcare Cybersecurity: Why Hospitals Are Under Siege]]></title>
            <description><![CDATA[Ransomware attacks on healthcare surged 30% in 2025. Here's why medical organizations remain prime targets and what defenders can do about it.]]></description>
            <link>https://www.probablypwned.com/article/healthcare-cybersecurity-ransomware-threats-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/healthcare-cybersecurity-ransomware-threats-guide</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[medical devices]]></category>
            <category><![CDATA[HIPAA]]></category>
            <category><![CDATA[patient safety]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 14:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fog Ransomware Targets US Schools Through Stolen VPNs]]></title>
            <description><![CDATA[A ransomware operation has compromised multiple US educational institutions using stolen VPN credentials. The education sector represents 80% of known victims.]]></description>
            <link>https://www.probablypwned.com/article/fog-ransomware-targets-us-education-via-vpn-credentials</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fog-ransomware-targets-us-education-via-vpn-credentials</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Fog]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[Arctic Wolf]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 13:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1509062522246-3755977927d7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CrazyHunter Ransomware Hits Taiwan Healthcare Sector]]></title>
            <description><![CDATA[A new ransomware group has compromised at least six healthcare organizations in Taiwan using BYOVD attacks to disable security software before encryption.]]></description>
            <link>https://www.probablypwned.com/article/crazyhunter-ransomware-taiwan-healthcare-byovd-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/crazyhunter-ransomware-taiwan-healthcare-byovd-attacks</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[CrazyHunter]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[Taiwan]]></category>
            <category><![CDATA[BYOVD]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 12:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Coolify Command Injection Flaws Grant Root Access]]></title>
            <description><![CDATA[Five critical vulnerabilities in the self-hosting platform allow authenticated users to execute arbitrary commands as root. Over 52,000 instances are exposed globally.]]></description>
            <link>https://www.probablypwned.com/article/coolify-critical-command-injection-52000-instances-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/coolify-critical-command-injection-52000-instances-exposed</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Coolify]]></category>
            <category><![CDATA[command injection]]></category>
            <category><![CDATA[CVE-2025-66209]]></category>
            <category><![CDATA[self-hosting]]></category>
            <category><![CDATA[Docker]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 11:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1629654297299-c8506221ca97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Snort 3 Flaws Enable DoS and Data Leaks]]></title>
            <description><![CDATA[CVE-2026-20026 and CVE-2026-20027 allow remote attackers to crash Snort or extract sensitive data. No workarounds exist—patches are the only fix.]]></description>
            <link>https://www.probablypwned.com/article/cisco-snort-3-dce-rpc-vulnerabilities-dos-data-leak</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-snort-3-dce-rpc-vulnerabilities-dos-data-leak</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[Snort]]></category>
            <category><![CDATA[CVE-2026-20026]]></category>
            <category><![CDATA[CVE-2026-20027]]></category>
            <category><![CDATA[DCE-RPC]]></category>
            <category><![CDATA[IDS]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 10:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Browser Extension Threats: What Security Teams Must Know]]></title>
            <description><![CDATA[Malicious extensions have compromised over 15 million users in the past year. Here's how attackers exploit the extension ecosystem and what organizations can do.]]></description>
            <link>https://www.probablypwned.com/article/browser-extension-threats-enterprise-security-guide</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/browser-extension-threats-enterprise-security-guide</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[browser extensions]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[enterprise security]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 09:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1488590528505-98d2b5aba04b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Auth Bypass in Network Appliances: A Pattern Emerges]]></title>
            <description><![CDATA[From Fortinet to SonicWall, authentication bypass vulnerabilities share common traits. Understanding these patterns helps security teams prioritize patching.]]></description>
            <link>https://www.probablypwned.com/article/authentication-bypass-network-appliances-pattern-analysis</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/authentication-bypass-network-appliances-pattern-analysis</guid>
            <category><![CDATA[Security Guides]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[vulnerability patterns]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Sat, 10 Jan 2026 08:00:00 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hacker Selling 139GB of US Utility Engineering Data]]></title>
            <description><![CDATA[Pickett USA breach exposes LiDAR scans, transmission line surveys, and substation layouts for Tampa Electric, Duke Energy Florida, and American Electric Power. Asking price: 6.5 BTC.]]></description>
            <link>https://www.probablypwned.com/article/pickett-usa-breach-utility-lidar-data-for-sale</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/pickett-usa-breach-utility-lidar-data-for-sale</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[utilities]]></category>
            <category><![CDATA[LiDAR]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[energy sector]]></category>
            <category><![CDATA[Pickett USA]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 09 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1567264837824-c993e26bf663?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1567264837824-c993e26bf663?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft Teams Enables Security Defaults on January 12]]></title>
            <description><![CDATA[Tenants using default settings will get automatic protection against weaponizable file types and malicious URLs. Administrators who want to opt out must act before the rollout.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-teams-security-defaults-january-12</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-teams-security-defaults-january-12</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[Microsoft Teams]]></category>
            <category><![CDATA[security]]></category>
            <category><![CDATA[messaging]]></category>
            <category><![CDATA[file protection]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[enterprise]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Fri, 09 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[jsPDF Flaw Lets Attackers Embed Local Files in PDFs]]></title>
            <description><![CDATA[CVE-2025-68428 enables path traversal in the popular JavaScript PDF library, allowing attackers to read arbitrary files from Node.js servers and exfiltrate them via generated documents.]]></description>
            <link>https://www.probablypwned.com/article/jspdf-cve-2025-68428-arbitrary-file-read-nodejs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/jspdf-cve-2025-68428-arbitrary-file-read-nodejs</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[jsPDF]]></category>
            <category><![CDATA[CVE-2025-68428]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[Node.js]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 09 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Extensions Stealing ChatGPT Chats Hit 900K Users]]></title>
            <description><![CDATA[Two rogue browser extensions masquerading as AI tools exfiltrated complete conversation histories from ChatGPT and DeepSeek to attacker-controlled servers every 30 minutes.]]></description>
            <link>https://www.probablypwned.com/article/chrome-extensions-900k-users-chatgpt-deepseek-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-extensions-900k-users-chatgpt-deepseek-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Chrome extensions]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[DeepSeek]]></category>
            <category><![CDATA[data theft]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[AI]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 09 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco Talos Exposes UAT-7290: China APT Targeting Telecoms]]></title>
            <description><![CDATA[Newly disclosed threat actor compromises telecom providers in South Asia and Southeastern Europe, establishing relay infrastructure for other Chinese APT groups.]]></description>
            <link>https://www.probablypwned.com/article/uat-7290-china-apt-telecom-south-asia-talos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uat-7290-china-apt-telecom-south-asia-talos</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[UAT-7290]]></category>
            <category><![CDATA[telecommunications]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Cisco Talos]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 08 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[n8n 'Ni8mare' Flaw Allows Unauthenticated Server Takeover]]></title>
            <description><![CDATA[CVE-2026-21858 scores CVSS 10.0 and requires no credentials to exploit. Attackers can read files, forge admin sessions, and execute commands.]]></description>
            <link>https://www.probablypwned.com/article/n8n-ni8mare-cve-2026-21858-unauthenticated-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/n8n-ni8mare-cve-2026-21858-unauthenticated-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2026-21858]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[workflow automation]]></category>
            <category><![CDATA[Ni8mare]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 08 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds 16-Year-Old PowerPoint Flaw to Exploited List]]></title>
            <description><![CDATA[January 7 KEV update includes CVE-2009-0556 from 2009 alongside recently patched HPE OneView vulnerability. Both are seeing active exploitation.]]></description>
            <link>https://www.probablypwned.com/article/cisa-kev-powerpoint-hpe-oneview-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-kev-powerpoint-hpe-oneview-january-2026</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[CVE-2009-0556]]></category>
            <category><![CDATA[CVE-2025-37164]]></category>
            <category><![CDATA[PowerPoint]]></category>
            <category><![CDATA[HPE OneView]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 08 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1535191042502-e6a9a3d407e7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1535191042502-e6a9a3d407e7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UK Commits £210M to Mandatory Public Sector Cybersecurity]]></title>
            <description><![CDATA[New Government Cyber Action Plan creates centralized security unit, dedicated cyber profession, and mandatory requirements for all departments. Legacy systems get top priority.]]></description>
            <link>https://www.probablypwned.com/article/uk-government-cyber-action-plan-210-million</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uk-government-cyber-action-plan-210-million</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[UK government]]></category>
            <category><![CDATA[policy]]></category>
            <category><![CDATA[cybersecurity]]></category>
            <category><![CDATA[public sector]]></category>
            <category><![CDATA[NCSC]]></category>
            <category><![CDATA[regulation]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Resecurity Catches Hackers Red-Handed with Deliberate Honeypot Trap]]></title>
            <description><![CDATA[Cybersecurity firm Resecurity reveals that hackers claiming to have breached their systems only accessed a deliberately deployed honeypot containing fake data designed to monitor threat actor activity.]]></description>
            <link>https://www.probablypwned.com/article/resecurity-honeypot-catches-hackers-scattered-lapsus-slh</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/resecurity-honeypot-catches-hackers-scattered-lapsus-slh</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Resecurity]]></category>
            <category><![CDATA[honeypot]]></category>
            <category><![CDATA[Scattered-Lapsus]]></category>
            <category><![CDATA[threat-intelligence]]></category>
            <category><![CDATA[deception]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Qilin Ransomware Hits 5 Targets in 24 Hours Including Healthcare]]></title>
            <description><![CDATA[The Russian-linked gang led all ransomware groups on January 6 with attacks spanning wine distributors, art logistics, and medical practices across three countries.]]></description>
            <link>https://www.probablypwned.com/article/qilin-ransomware-17-attacks-healthcare-january-2026</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/qilin-ransomware-17-attacks-healthcare-january-2026</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Qilin]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[ransomware-as-a-service]]></category>
            <category><![CDATA[threat actors]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Microsoft: Tycoon2FA Phishing Exploits Email Misconfigurations]]></title>
            <description><![CDATA[Threat actors spoof organization domains by abusing complex mail routing and weak DMARC policies. Microsoft blocked 13 million malicious emails in October alone.]]></description>
            <link>https://www.probablypwned.com/article/microsoft-tycoon2fa-domain-spoofing-13-million-emails</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/microsoft-tycoon2fa-domain-spoofing-13-million-emails</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Tycoon2FA]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Microsoft]]></category>
            <category><![CDATA[email security]]></category>
            <category><![CDATA[DMARC]]></category>
            <category><![CDATA[MFA bypass]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768494-4dee2763ff3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lazarus Weaponizes Fake Job Interviews With ClickFix Malware]]></title>
            <description><![CDATA[North Korean APT-Q-1 now combines fraudulent cryptocurrency job postings with ClickFix social engineering to deploy GolangGhost backdoor and BeaverTail stealer.]]></description>
            <link>https://www.probablypwned.com/article/lazarus-apt-clickfix-fake-job-interviews-malware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lazarus-apt-clickfix-fake-job-interviews-malware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Lazarus]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome WebView Flaw Lets Attackers Bypass Security Controls]]></title>
            <description><![CDATA[Google patches CVE-2026-0628 in first 2026 update. The high-severity bug affects billions of users across Chrome and Android applications.]]></description>
            <link>https://www.probablypwned.com/article/google-chrome-webview-cve-2026-0628-security-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-chrome-webview-cve-2026-0628-security-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-0628]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[WebView]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[patch]]></category>
            <category><![CDATA[Android]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1619252584172-a83a949b6efd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1619252584172-a83a949b6efd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical D-Link Router Flaw Under Active Attack, No Patch Coming]]></title>
            <description><![CDATA[CVE-2026-0625 allows unauthenticated remote code execution on legacy DSL routers. Affected models reached end-of-life in 2020 and won't receive fixes.]]></description>
            <link>https://www.probablypwned.com/article/d-link-dsl-router-cve-2026-0625-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/d-link-dsl-router-cve-2026-0625-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-0625]]></category>
            <category><![CDATA[D-Link]]></category>
            <category><![CDATA[router]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[active exploitation]]></category>
            <category><![CDATA[EOL]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dartmouth Data Breach Exposes 40,000+ in Clop Ransomware Attack]]></title>
            <description><![CDATA[Russian ransomware group Clop claims responsibility for breach at Dartmouth College, posting stolen data on dark web and affecting more than 40,000 individuals including students, staff, and alumni.]]></description>
            <link>https://www.probablypwned.com/article/dartmouth-clop-ransomware-breach-40000-affected</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dartmouth-clop-ransomware-breach-40000-affected</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Dartmouth]]></category>
            <category><![CDATA[Clop]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[MOVEit]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Dartmouth Breach Exposes 44,000 in Clop Oracle Campaign]]></title>
            <description><![CDATA[Russian ransomware gang exploited CVE-2025-61882 to steal SSNs and financial data from the college. The same vulnerability hit Harvard, UPenn, and 100+ organizations.]]></description>
            <link>https://www.probablypwned.com/article/dartmouth-clop-ransomware-breach-44000-oracle-ebs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/dartmouth-clop-ransomware-breach-44000-oracle-ebs</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Clop]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Dartmouth]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[higher education]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1541339907198-e08756dedf3f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Patches High-Severity WebView Policy Bypass]]></title>
            <description><![CDATA[CVE-2026-0628 allowed malicious extensions to inject scripts into privileged pages through insufficient policy enforcement. Update to Chrome 143.0.7499.192.]]></description>
            <link>https://www.probablypwned.com/article/chrome-webview-cve-2026-0628-policy-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chrome-webview-cve-2026-0628-policy-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2026-0628]]></category>
            <category><![CDATA[Chrome]]></category>
            <category><![CDATA[WebView]]></category>
            <category><![CDATA[browser security]]></category>
            <category><![CDATA[Google]]></category>
            <category><![CDATA[patch]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[New 'Brutus' Brute-Force Tool Targets Fortinet on Dark Web]]></title>
            <description><![CDATA[A threat actor called RedTeam is selling a $1,500 credential-stuffing tool with built-in scanning, proxy rotation, and multi-protocol support aimed at enterprise VPN infrastructure.]]></description>
            <link>https://www.probablypwned.com/article/brutus-brute-force-tool-fortinet-dark-web</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/brutus-brute-force-tool-fortinet-dark-web</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[brute force]]></category>
            <category><![CDATA[dark web]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[credential stuffing]]></category>
            <category><![CDATA[tools]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Blue Shield California Exposes Member Health Data in Portal Error]]></title>
            <description><![CDATA[System enhancement gone wrong allowed members to view other members' names, diagnoses, and medications. The insurer is offering affected individuals credit monitoring.]]></description>
            <link>https://www.probablypwned.com/article/blue-shield-california-record-merge-data-exposure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/blue-shield-california-record-merge-data-exposure</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Blue Shield]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[HIPAA]]></category>
            <category><![CDATA[California]]></category>
            <category><![CDATA[privacy]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160550-2173dba999ef?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ASML Breach Claim: 154 Databases and Encryption Keys Leaked]]></title>
            <description><![CDATA[Threat actor '1011' posted alleged data from the semiconductor equipment giant to a Russian cybercrime forum. Security researchers are verifying the files.]]></description>
            <link>https://www.probablypwned.com/article/asml-semiconductor-breach-154-databases-encryption-keys</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/asml-semiconductor-breach-154-databases-encryption-keys</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ASML]]></category>
            <category><![CDATA[semiconductor]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[encryption keys]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[700Credit Breach Exposes Millions of Social Security Numbers from Auto Dealership Transactions]]></title>
            <description><![CDATA[Consumer credit provider 700Credit suffers massive data breach affecting auto loan applicants nationwide, with millions of Social Security numbers potentially compromised through dealership credit checks.]]></description>
            <link>https://www.probablypwned.com/article/700credit-breach-millions-ssn-auto-dealerships</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/700credit-breach-millions-ssn-auto-dealerships</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[700Credit]]></category>
            <category><![CDATA[SSN]]></category>
            <category><![CDATA[auto-dealership]]></category>
            <category><![CDATA[credit-bureau]]></category>
            <category><![CDATA[identity-theft]]></category>
            <category><![CDATA[data-breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 07 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1449824913935-59a10b8d2000?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1449824913935-59a10b8d2000?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Silk Typhoon: Chinese APT Escalates Attacks on US Government and IT Supply Chain]]></title>
            <description><![CDATA[Microsoft and CrowdStrike warn of intensified Silk Typhoon operations targeting US government agencies and IT supply chains, with 150% increase in China-linked intrusions.]]></description>
            <link>https://www.probablypwned.com/article/silk-typhoon-china-apt-us-government-treasury-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/silk-typhoon-china-apt-us-government-treasury-attack</guid>
            <category><![CDATA[Nation State]]></category>
            <category><![CDATA[Silk-Typhoon]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Treasury]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ledger Data Breach: Payment Processor Compromise Exposes Crypto Wallet Users]]></title>
            <description><![CDATA[Cryptocurrency hardware wallet maker Ledger confirms customer data exposed after third-party payment processor Global-e suffers cloud system breach.]]></description>
            <link>https://www.probablypwned.com/article/ledger-data-breach-global-e-payment-processor</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ledger-data-breach-global-e-payment-processor</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Ledger]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[Global-e]]></category>
            <category><![CDATA[supply-chain]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1622630998477-20aa696ecb05?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1622630998477-20aa696ecb05?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GlassWorm Malware Targets macOS Developers Through Poisoned VS Code Extensions]]></title>
            <description><![CDATA[First macOS-focused wave of GlassWorm malware discovered on Open VSX marketplace, stealing cryptocurrency wallets, Keychain passwords, and developer credentials through trojanized extensions.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-malware-macos-vscode-extensions-supply-chain</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-malware-macos-vscode-extensions-supply-chain</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[VSCode]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[malware]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555066931-4365d14bab8c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Brightspeed Investigating Breach After Crimson Collective Claims 1M+ Customer Records]]></title>
            <description><![CDATA[US fiber broadband provider Brightspeed confirms investigation into cyberattack claims by emerging threat group Crimson Collective, which alleges exfiltration of over one million customer records.]]></description>
            <link>https://www.probablypwned.com/article/brightspeed-crimson-collective-million-customers-data-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/brightspeed-crimson-collective-million-customers-data-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Brightspeed]]></category>
            <category><![CDATA[Crimson-Collective]]></category>
            <category><![CDATA[ISP-breach]]></category>
            <category><![CDATA[telecommunications]]></category>
            <category><![CDATA[data-breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apple Warns 1.8 Billion iPhone Users of WebKit Zero-Days Linked to Pegasus Spyware]]></title>
            <description><![CDATA[Apple issues emergency patches for two WebKit zero-day vulnerabilities being actively exploited in sophisticated attacks linked to NSO Group's Pegasus spyware.]]></description>
            <link>https://www.probablypwned.com/article/apple-ios-zero-day-webkit-pegasus-spyware-warning</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apple-ios-zero-day-webkit-pegasus-spyware-warning</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[iOS]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[WebKit]]></category>
            <category><![CDATA[Pegasus]]></category>
            <category><![CDATA[NSO-Group]]></category>
            <category><![CDATA[spyware]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 06 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510557880182-3d4d3cba35a5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510557880182-3d4d3cba35a5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Space Force Awards $212M Contract for Base Network Overhaul]]></title>
            <description><![CDATA[CACI wins task order to modernize classified and unclassified networks at all 14 U.S. Space Force bases, implementing zero trust architecture and cloud capabilities.]]></description>
            <link>https://www.probablypwned.com/article/space-force-caci-212-million-network-modernization-zero-trust</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/space-force-caci-212-million-network-modernization-zero-trust</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Space Force]]></category>
            <category><![CDATA[zero trust]]></category>
            <category><![CDATA[network security]]></category>
            <category><![CDATA[defense]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Federal Contractor Sedgwick Hit by TridentLocker Ransomware]]></title>
            <description><![CDATA[New Year's Eve attack on Sedgwick Government Solutions compromises file transfer system serving DHS, CISA, and ICE. TridentLocker claims 3.4GB of stolen data.]]></description>
            <link>https://www.probablypwned.com/article/sedgwick-government-solutions-tridentlocker-ransomware-dhs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sedgwick-government-solutions-tridentlocker-ransomware-dhs</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[TridentLocker]]></category>
            <category><![CDATA[federal contractor]]></category>
            <category><![CDATA[DHS]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563986768609-322da13575f3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Stolen Credentials Fuel Self-Sustaining Malware Distribution]]></title>
            <description><![CDATA[Hudson Rock research reveals 220 legitimate business websites hijacked for ClickFix malware attacks after admin credentials were stolen by infostealers.]]></description>
            <link>https://www.probablypwned.com/article/infostealer-clickfix-stolen-credentials-malware-distribution</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/infostealer-clickfix-stolen-credentials-malware-distribution</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[ClickFix]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[malware distribution]]></category>
            <category><![CDATA[social engineering]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Christmas Attack Campaign Targets ColdFusion with 2.5M Requests]]></title>
            <description><![CDATA[GreyNoise researchers uncover coordinated campaign exploiting 767 CVEs across 47 technology stacks. Hong Kong-based infrastructure generated 98% of attack traffic on Christmas Day.]]></description>
            <link>https://www.probablypwned.com/article/coldfusion-christmas-attack-2-5-million-requests-hong-kong</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/coldfusion-christmas-attack-2-5-million-requests-hong-kong</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ColdFusion]]></category>
            <category><![CDATA[exploitation]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[initial access broker]]></category>
            <category><![CDATA[JNDI injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Canadian College Suspends Classes After Holiday Cyber Attack]]></title>
            <description><![CDATA[Aurora College in Canada's Northwest Territories cancels all classes January 5-9 after cyber attack over Christmas break takes down servers, email, and e-learning systems.]]></description>
            <link>https://www.probablypwned.com/article/aurora-college-cyber-attack-canada-classes-suspended</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aurora-college-cyber-attack-canada-classes-suspended</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[cyber attack]]></category>
            <category><![CDATA[education]]></category>
            <category><![CDATA[Canada]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 05 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[RondoDox Botnet Targets 90K Servers via React2Shell]]></title>
            <description><![CDATA[Nine-month-old botnet campaign pivots to exploit CVE-2025-55182 in Next.js, deploying cryptominers and Mirai variants across exposed instances.]]></description>
            <link>https://www.probablypwned.com/article/rondodox-botnet-react2shell-90000-servers-exposed</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/rondodox-botnet-react2shell-90000-servers-exposed</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[RondoDox]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[CVE-2025-55182]]></category>
            <category><![CDATA[Next.js]]></category>
            <category><![CDATA[cryptominer]]></category>
            <category><![CDATA[Mirai]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 04 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Finland Arrests Ship Crew Over Baltic Cable Sabotage]]></title>
            <description><![CDATA[Two crew members detained after cargo vessel's anchor allegedly severed Finland-Estonia telecommunications cable in suspected hybrid warfare operation.]]></description>
            <link>https://www.probablypwned.com/article/finland-arrests-crew-baltic-submarine-cable-sabotage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/finland-arrests-crew-baltic-submarine-cable-sabotage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[hybrid warfare]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[submarine cable]]></category>
            <category><![CDATA[sabotage]]></category>
            <category><![CDATA[Finland]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 04 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1530973428-5bf2db2e4d71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1530973428-5bf2db2e4d71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[EmEditor Website Compromised to Deliver Infostealer]]></title>
            <description><![CDATA[Popular text editor's download page was hijacked for four days in December, serving trojanized installers that steal browser credentials and crypto wallets.]]></description>
            <link>https://www.probablypwned.com/article/emeditor-supply-chain-attack-infostealer-walsham</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/emeditor-supply-chain-attack-infostealer-walsham</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[EmEditor]]></category>
            <category><![CDATA[browser extension]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[credential theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 04 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Warns of Critical WHILL Wheelchair Bluetooth Flaw]]></title>
            <description><![CDATA[CVE-2025-14346 allows attackers within Bluetooth range to fully control electric wheelchairs without authentication, earning a CVSS 9.8 severity score.]]></description>
            <link>https://www.probablypwned.com/article/cisa-whill-wheelchair-bluetooth-takeover-cve-2025-14346</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-whill-wheelchair-bluetooth-takeover-cve-2025-14346</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[CVE-2025-14346]]></category>
            <category><![CDATA[medical devices]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[Bluetooth]]></category>
            <category><![CDATA[accessibility]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 04 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1559526324-c1f275fbfa32?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1559526324-c1f275fbfa32?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[New Zealand Health Portal Breach Exposes 126,000 Patients]]></title>
            <description><![CDATA[ManageMyHealth confirms Kazu ransomware gang compromised Health Documents module, threatening to leak 108GB of medical records unless $60,000 ransom is paid.]]></description>
            <link>https://www.probablypwned.com/article/managemyhealth-new-zealand-kazu-ransomware-126000-patients</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/managemyhealth-new-zealand-kazu-ransomware-126000-patients</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[New Zealand]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[patient data]]></category>
            <category><![CDATA[Kazu]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 03 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Illinois Exposed 672,000 Medicaid Recipients for Three Years]]></title>
            <description><![CDATA[Configuration error left addresses, case numbers, and demographic data publicly accessible on mapping website from January 2022 until September 2025.]]></description>
            <link>https://www.probablypwned.com/article/illinois-dhs-medicaid-data-exposure-672000-recipients</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/illinois-dhs-medicaid-data-exposure-672000-recipients</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[Medicaid]]></category>
            <category><![CDATA[configuration error]]></category>
            <category><![CDATA[Illinois]]></category>
            <category><![CDATA[healthcare]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 03 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Google Cloud Feature Weaponized in 9,000-Email Phishing Wave]]></title>
            <description><![CDATA[Attackers abuse Google Cloud Application Integration to send phishing emails that bypass SPF, DKIM, and DMARC, targeting 3,200 organizations globally.]]></description>
            <link>https://www.probablypwned.com/article/google-cloud-application-integration-phishing-3200-orgs</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/google-cloud-application-integration-phishing-3200-orgs</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[Google Cloud]]></category>
            <category><![CDATA[email security]]></category>
            <category><![CDATA[credential theft]]></category>
            <category><![CDATA[DMARC bypass]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sat, 03 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Everest Ransomware Dumps Full 1TB of ASUS Stolen Data]]></title>
            <description><![CDATA[After ASUS missed ransom deadline, Everest releases complete data trove including ROG source code, Qualcomm SDKs, and ArcSoft files on cybercrime forums.]]></description>
            <link>https://www.probablypwned.com/article/everest-ransomware-asus-1tb-full-data-dump-leaked</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/everest-ransomware-asus-1tb-full-data-dump-leaked</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[ASUS]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[data leak]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[source code]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 03 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical RCE Flaw in Signal K Threatens Marine Vessels]]></title>
            <description><![CDATA[CVE-2025-66398 lets unauthenticated attackers achieve code execution on boat navigation servers. CVSS 9.6 vulnerability affects all versions before 2.19.0.]]></description>
            <link>https://www.probablypwned.com/article/signal-k-server-cve-2025-66398-boat-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/signal-k-server-cve-2025-66398-boat-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Signal K]]></category>
            <category><![CDATA[CVE-2025-66398]]></category>
            <category><![CDATA[maritime security]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[RCE]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Lithuanian Arrested After KMSAuto Malware Steals $1.2M]]></title>
            <description><![CDATA[A five-year investigation ends with extradition to South Korea. The 29-year-old allegedly infected 2.8 million Windows systems through trojanized software activation tools.]]></description>
            <link>https://www.probablypwned.com/article/lithuanian-kmsauto-clipper-malware-arrest-crypto-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lithuanian-kmsauto-clipper-malware-arrest-crypto-theft</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[KMSAuto]]></category>
            <category><![CDATA[clipper malware]]></category>
            <category><![CDATA[cryptocurrency theft]]></category>
            <category><![CDATA[arrest]]></category>
            <category><![CDATA[South Korea]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1453733190371-0a9bedd82893?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1453733190371-0a9bedd82893?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GNU Wget2 Flaw Lets Attackers Overwrite System Files]]></title>
            <description><![CDATA[CVE-2025-69194 is a path traversal bug in Metalink handling that could let remote attackers write arbitrary files. CVSS 8.8.]]></description>
            <link>https://www.probablypwned.com/article/gnu-wget2-cve-2025-69194-path-traversal</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/gnu-wget2-cve-2025-69194-path-traversal</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[GNU Wget2]]></category>
            <category><![CDATA[CVE-2025-69194]]></category>
            <category><![CDATA[path traversal]]></category>
            <category><![CDATA[file overwrite]]></category>
            <category><![CDATA[Metalink]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GlassWorm Malware Pivots to macOS, Targets Crypto Wallets]]></title>
            <description><![CDATA[The self-propagating VS Code extension worm now replaces Ledger Live and Trezor Suite with trojanized versions. Russian-speaking operators behind campaign.]]></description>
            <link>https://www.probablypwned.com/article/glassworm-macos-open-vsx-cryptocurrency-wallets</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/glassworm-macos-open-vsx-cryptocurrency-wallets</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[GlassWorm]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Open VSX]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Covenant Health Breach Exposes 478,000 Patient Records]]></title>
            <description><![CDATA[Investigation reveals Qilin ransomware attack in May 2025 was far larger than initially reported. The gang has already leaked 850GB of stolen data.]]></description>
            <link>https://www.probablypwned.com/article/covenant-health-breach-478000-qilin-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/covenant-health-breach-478000-qilin-ransomware</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Covenant Health]]></category>
            <category><![CDATA[healthcare breach]]></category>
            <category><![CDATA[Qilin ransomware]]></category>
            <category><![CDATA[PHI]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 02 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160399-112ba8d25d1d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160399-112ba8d25d1d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CVSS 10.0 Zero-Day Hits 70,000 XSpeeder Devices]]></title>
            <description><![CDATA[CVE-2025-54322 enables unauthenticated root RCE on SD-WAN appliances and edge routers. Vendor has ignored seven months of disclosure attempts. No patch available.]]></description>
            <link>https://www.probablypwned.com/article/xspeeder-sxzos-cvss-10-zero-day-70000-devices</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/xspeeder-sxzos-cvss-10-zero-day-70000-devices</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[XSpeeder]]></category>
            <category><![CDATA[CVE-2025-54322]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[SD-WAN]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[The 10 Worst Vulnerabilities of 2025: Ranked by Real-World Impact]]></title>
            <description><![CDATA[Beyond CVSS scores, these vulnerabilities caused the most damage in 2025—from nation-state exploitation to mass ransomware campaigns and breaches affecting millions.]]></description>
            <link>https://www.probablypwned.com/article/top-10-worst-vulnerabilities-2025-by-impact</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/top-10-worst-vulnerabilities-2025-by-impact</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[vulnerabilities]]></category>
            <category><![CDATA[CVE]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[nation-state]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Ivanti]]></category>
            <category><![CDATA[React2Shell]]></category>
            <category><![CDATA[SAP]]></category>
            <category><![CDATA[critical-infrastructure]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[IBM API Connect Auth Bypass Rated CVSS 9.8]]></title>
            <description><![CDATA[CVE-2025-13915 allows remote attackers to bypass authentication without credentials. Affects versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0 used by major banks and airlines.]]></description>
            <link>https://www.probablypwned.com/article/ibm-api-connect-cve-2025-13915-cvss-9-8-auth-bypass</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ibm-api-connect-cve-2025-13915-cvss-9-8-auth-bypass</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[IBM]]></category>
            <category><![CDATA[API Connect]]></category>
            <category><![CDATA[CVE-2025-13915]]></category>
            <category><![CDATA[authentication bypass]]></category>
            <category><![CDATA[CVSS 9.8]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[European Space Agency Confirms Data Breach]]></title>
            <description><![CDATA[Threat actor '888' claims 200GB of source code, API keys, and credentials from ESA's Bitbucket and JIRA servers. Agency says only unclassified scientific systems were affected.]]></description>
            <link>https://www.probablypwned.com/article/european-space-agency-breach-200gb-data-888</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/european-space-agency-breach-200gb-data-888</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ESA]]></category>
            <category><![CDATA[European Space Agency]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[888]]></category>
            <category><![CDATA[source code]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DarkSpectre Malware Infected 8.8 Million Browser Users]]></title>
            <description><![CDATA[Chinese threat actor behind coordinated extension campaigns spanning seven years. Zoom Stealer component harvested corporate meeting credentials from 28 platforms.]]></description>
            <link>https://www.probablypwned.com/article/darkspectre-browser-extension-8-million-users-china</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/darkspectre-browser-extension-8-million-users-china</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[DarkSpectre]]></category>
            <category><![CDATA[browser extensions]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[corporate espionage]]></category>
            <category><![CDATA[Zoom Stealer]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Thu, 01 Jan 2026 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SmarterMail CVE-2025-52691 Scores Perfect 10.0 CVSS for Unauthenticated RCE]]></title>
            <description><![CDATA[Singapore's CSA warns of a critical SmarterMail vulnerability allowing remote code execution through file upload without authentication. Patch immediately.]]></description>
            <link>https://www.probablypwned.com/article/smartermail-cve-2025-52691-cvss-10-critical-rce</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/smartermail-cve-2025-52691-cvss-10-critical-rce</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-52691]]></category>
            <category><![CDATA[SmarterMail]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[CVSS 10]]></category>
            <category><![CDATA[email server]]></category>
            <category><![CDATA[critical vulnerability]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 31 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Silver Fox APT Impersonates Indian Tax Officials in Espionage Campaign]]></title>
            <description><![CDATA[CloudSEK identifies Chinese threat group Silver Fox targeting Indian organizations with phishing emails disguised as income tax department communications.]]></description>
            <link>https://www.probablypwned.com/article/silver-fox-apt-china-india-tax-impersonation-campaign</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/silver-fox-apt-china-india-tax-impersonation-campaign</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Silver Fox]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[India]]></category>
            <category><![CDATA[tax season]]></category>
            <category><![CDATA[phishing]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 31 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Gentlemen Ransomware Cripples Romania's Largest Coal Power Producer]]></title>
            <description><![CDATA[Oltenia Energy Complex shut down IT systems on December 26 after a ransomware attack encrypted critical documents and disrupted ERP, email, and web operations.]]></description>
            <link>https://www.probablypwned.com/article/romania-oltenia-energy-gentlemen-ransomware-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/romania-oltenia-energy-gentlemen-ransomware-attack</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Romania]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[energy sector]]></category>
            <category><![CDATA[Gentlemen ransomware]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 31 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chipotle Discloses Employee Data Breach Through Workday Payroll Accounts]]></title>
            <description><![CDATA[Attackers accessed Chipotle employee Workday accounts between October 9-26, potentially exposing personal information stored in payroll systems.]]></description>
            <link>https://www.probablypwned.com/article/chipotle-employee-workday-payroll-data-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/chipotle-employee-workday-payroll-data-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Chipotle]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[Workday]]></category>
            <category><![CDATA[payroll]]></category>
            <category><![CDATA[employee data]]></category>
            <category><![CDATA[credential stuffing]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 31 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[ServiceNow Acquires Armis for $7.75 Billion in Largest Security Deal of 2025]]></title>
            <description><![CDATA[AI workflow giant expands into connected device security. Deal expected to close in late 2026 pending regulatory review.]]></description>
            <link>https://www.probablypwned.com/article/servicenow-acquires-armis-7-75-billion-ai-security</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/servicenow-acquires-armis-7-75-billion-ai-security</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[ServiceNow]]></category>
            <category><![CDATA[Armis]]></category>
            <category><![CDATA[acquisition]]></category>
            <category><![CDATA[IoT security]]></category>
            <category><![CDATA[cybersecurity M&A]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Tue, 30 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1434030216411-0b793f4b4173?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1434030216411-0b793f4b4173?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Mustang Panda Deploys Kernel-Mode Rootkit to Conceal TONESHELL Backdoor]]></title>
            <description><![CDATA[Chinese APT uses stolen certificate to sign malicious driver that disables security tools. First documented case of TONESHELL delivered via kernel-mode loader.]]></description>
            <link>https://www.probablypwned.com/article/mustang-panda-kernel-rootkit-toneshell-signed-driver</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mustang-panda-kernel-rootkit-toneshell-signed-driver</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Mustang Panda]]></category>
            <category><![CDATA[TONESHELL]]></category>
            <category><![CDATA[rootkit]]></category>
            <category><![CDATA[China APT]]></category>
            <category><![CDATA[kernel driver]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 30 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Korean Air Confirms 30,000 Employee Records Stolen in Supplier Breach]]></title>
            <description><![CDATA[Hackers exploited Oracle EBS vulnerability at catering subsidiary to steal employee data including bank account numbers. Second major Korean airline breach this week.]]></description>
            <link>https://www.probablypwned.com/article/korean-air-30000-employees-oracle-ebs-supplier-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/korean-air-30000-employees-oracle-ebs-supplier-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Korean Air]]></category>
            <category><![CDATA[Oracle EBS]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[employee data]]></category>
            <category><![CDATA[South Korea]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 30 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Adds MongoBleed to KEV as Exploitation Spreads to 87,000 Instances]]></title>
            <description><![CDATA[Federal agencies have until January 19 to patch CVE-2025-14847. Security researchers release open-source detection tool as attackers harvest credentials from exposed servers.]]></description>
            <link>https://www.probablypwned.com/article/cisa-mongobleed-kev-87000-vulnerable-instances</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-mongobleed-kev-87000-vulnerable-instances</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[MongoDB]]></category>
            <category><![CDATA[CVE-2025-14847]]></category>
            <category><![CDATA[CISA KEV]]></category>
            <category><![CDATA[MongoBleed]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 30 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Trust Wallet Chrome Extension Compromised, $7 Million Drained from Users]]></title>
            <description><![CDATA[Attackers pushed malicious update v2.68 to Chrome Web Store using leaked API key. Hundreds affected as seed phrases harvested via embedded analytics library.]]></description>
            <link>https://www.probablypwned.com/article/trust-wallet-chrome-extension-breach-7-million-stolen</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/trust-wallet-chrome-extension-breach-7-million-stolen</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Trust Wallet]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Chrome extension]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[Binance]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 29 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1621761191319-c6fb62004040?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1621761191319-c6fb62004040?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MacSync Stealer Bypasses macOS Gatekeeper Using Apple's Own Notarization]]></title>
            <description><![CDATA[New variant distributed as signed and notarized Swift app evades built-in security. Jamf Threat Labs traces evolution from ClickFix techniques to silent installer approach.]]></description>
            <link>https://www.probablypwned.com/article/macsync-stealer-bypasses-gatekeeper-notarization</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/macsync-stealer-bypasses-gatekeeper-notarization</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[macOS]]></category>
            <category><![CDATA[MacSync]]></category>
            <category><![CDATA[Gatekeeper]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[notarization]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 29 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1486312338219-ce68d2c6f44d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Hacker Leaks 2.3 Million WIRED Records, Threatens 40 Million More from Condé Nast]]></title>
            <description><![CDATA[Database dump posted Christmas Day includes subscriber emails, names, and addresses. Attacker 'Lovely' claims access to broader Condé Nast data spanning multiple publications.]]></description>
            <link>https://www.probablypwned.com/article/conde-nast-wired-breach-40-million-records-threatened</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/conde-nast-wired-breach-40-million-records-threatened</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Condé Nast]]></category>
            <category><![CDATA[WIRED]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[media]]></category>
            <category><![CDATA[Have I Been Pwned]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 29 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550745165-9bc0b252726f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[OpenAI Says Prompt Injection in AI Browsers May Never Be Solved]]></title>
            <description><![CDATA[Company admits ChatGPT Atlas remains vulnerable to attacks that hijack AI agents through malicious web content. New defenses deployed, but fundamental risk persists.]]></description>
            <link>https://www.probablypwned.com/article/openai-chatgpt-atlas-prompt-injection-unsolvable</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/openai-chatgpt-atlas-prompt-injection-unsolvable</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[OpenAI]]></category>
            <category><![CDATA[ChatGPT Atlas]]></category>
            <category><![CDATA[prompt injection]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[agentic AI]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sun, 28 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1676299081847-824916de030a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1676299081847-824916de030a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Malicious npm Package 'lotusbail' Hijacked WhatsApp Accounts for Six Months]]></title>
            <description><![CDATA[Supply chain attack disguised as working WhatsApp API library stole credentials, messages, and linked attacker devices to victim accounts. 56,000+ downloads since May.]]></description>
            <link>https://www.probablypwned.com/article/npm-lotusbail-whatsapp-supply-chain-attack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/npm-lotusbail-whatsapp-supply-chain-attack</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[npm]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[WhatsApp]]></category>
            <category><![CDATA[lotusbail]]></category>
            <category><![CDATA[JavaScript]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sun, 28 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555952494-efd681c7e3f9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555952494-efd681c7e3f9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Everest Ransomware Claims 1TB Chrysler Data Theft on Christmas Day]]></title>
            <description><![CDATA[Ransomware group says it exfiltrated over a terabyte of Chrysler customer data including Salesforce records and recall case narratives. Threatening to publish in days.]]></description>
            <link>https://www.probablypwned.com/article/everest-ransomware-chrysler-christmas-data-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/everest-ransomware-chrysler-christmas-data-theft</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Everest]]></category>
            <category><![CDATA[Chrysler]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[automotive]]></category>
            <category><![CDATA[Stellantis]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 28 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1489824904134-891ab64532f1?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1489824904134-891ab64532f1?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Coupang CEO Finally Apologizes Over 33.7 Million Customer Data Breach]]></title>
            <description><![CDATA[South Korea's largest e-commerce breach exposed personal data for two-thirds of the population. Former employee identified as perpetrator. National Assembly hearings scheduled.]]></description>
            <link>https://www.probablypwned.com/article/coupang-ceo-apologizes-33-million-customer-data-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/coupang-ceo-apologizes-33-million-customer-data-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Coupang]]></category>
            <category><![CDATA[South Korea]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[e-commerce]]></category>
            <category><![CDATA[insider threat]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sun, 28 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1556742049-0cfed4f6a45d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1556742049-0cfed4f6a45d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[UK Regulator Hits LastPass with £1.2 Million Fine Over 2022 Breach]]></title>
            <description><![CDATA[ICO penalty cites inadequate security measures that enabled hackers to steal data of 1.6 million UK users. Cryptocurrency theft linked to breach exceeds $438 million.]]></description>
            <link>https://www.probablypwned.com/article/uk-ico-fines-lastpass-1-2-million-2022-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/uk-ico-fines-lastpass-1-2-million-2022-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[LastPass]]></category>
            <category><![CDATA[ICO]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[GDPR]]></category>
            <category><![CDATA[regulatory fine]]></category>
            <category><![CDATA[password manager]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Sat, 27 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1496368077930-c1e31b4e5b44?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1496368077930-c1e31b4e5b44?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[MongoDB Urges Immediate Patching for Memory-Read Vulnerability]]></title>
            <description><![CDATA[CVE-2025-14847 allows unauthenticated attackers to read server memory in low-complexity attacks. Multiple MongoDB versions affected.]]></description>
            <link>https://www.probablypwned.com/article/mongodb-cve-2025-14847-memory-read-vulnerability</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/mongodb-cve-2025-14847-memory-read-vulnerability</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[MongoDB]]></category>
            <category><![CDATA[CVE-2025-14847]]></category>
            <category><![CDATA[memory disclosure]]></category>
            <category><![CDATA[database security]]></category>
            <category><![CDATA[patching]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 27 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558021212-51b6ecfa0db9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LockBit5 Claims 53 Victims in Single Day as Holiday Attacks Surge]]></title>
            <description><![CDATA[Ransomware tracking data shows 63 total claims from 6 groups on December 26. LockBit's revival dominates holiday attack wave targeting reduced security staff.]]></description>
            <link>https://www.probablypwned.com/article/lockbit5-holiday-ransomware-surge-december-2025</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/lockbit5-holiday-ransomware-surge-december-2025</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[LockBit]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[holiday attacks]]></category>
            <category><![CDATA[Akira]]></category>
            <category><![CDATA[SafePay]]></category>
            <category><![CDATA[threat intelligence]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Sat, 27 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LangChain Serialization Flaw Lets Attackers Steal AI Agent Secrets]]></title>
            <description><![CDATA[CVE-2025-68664 scores CVSS 9.3 and enables secret extraction and prompt injection in LangChain Core. Patch immediately if you're running AI agents.]]></description>
            <link>https://www.probablypwned.com/article/langchain-cve-2025-68664-ai-agent-secret-theft</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/langchain-cve-2025-68664-ai-agent-secret-theft</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[LangChain]]></category>
            <category><![CDATA[CVE-2025-68664]]></category>
            <category><![CDATA[AI security]]></category>
            <category><![CDATA[serialization]]></category>
            <category><![CDATA[prompt injection]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Sat, 27 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1677442136019-21780ecad995?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WinRAR Flaw CVE-2025-6218 Exploited by Russian, Chinese, and Pakistani APTs]]></title>
            <description><![CDATA[CISA adds WinRAR path traversal vulnerability to KEV catalog as Gamaredon, Bitter, and GOFFEE deploy it for espionage and wiper attacks across multiple continents.]]></description>
            <link>https://www.probablypwned.com/article/winrar-cve-2025-6218-apt-groups-active-exploitation</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/winrar-cve-2025-6218-apt-groups-active-exploitation</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WinRAR]]></category>
            <category><![CDATA[CVE-2025-6218]]></category>
            <category><![CDATA[Gamaredon]]></category>
            <category><![CDATA[Bitter]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[path-traversal]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 26 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1517694712202-14dd9538aa97?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Nissan Discloses 21,000 Customers Exposed in Red Hat GitLab Breach]]></title>
            <description><![CDATA[Crimson Collective hackers breached Red Hat's self-managed GitLab in September, stealing 570GB from 28,000 repositories including Nissan customer data.]]></description>
            <link>https://www.probablypwned.com/article/nissan-red-hat-gitlab-breach-21000-customers</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/nissan-red-hat-gitlab-breach-21000-customers</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Nissan]]></category>
            <category><![CDATA[Red Hat]]></category>
            <category><![CDATA[GitLab]]></category>
            <category><![CDATA[supply-chain]]></category>
            <category><![CDATA[Crimson Collective]]></category>
            <category><![CDATA[data breach]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Fri, 26 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558618666-fcd25c85cd64?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Apple Patches WebKit Zero-Days Linked to Spyware Attacks on Targeted Individuals]]></title>
            <description><![CDATA[CVE-2025-14174 and CVE-2025-43529 were exploited in sophisticated attacks before Apple's December 12 emergency patches across iOS, macOS, and Safari.]]></description>
            <link>https://www.probablypwned.com/article/apple-webkit-zero-day-cve-2025-14174-spyware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apple-webkit-zero-day-cve-2025-14174-spyware</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apple]]></category>
            <category><![CDATA[WebKit]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2025-14174]]></category>
            <category><![CDATA[spyware]]></category>
            <category><![CDATA[iOS]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 26 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1591337676887-a217a6970a8a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1591337676887-a217a6970a8a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Goldman Sachs Warns Investors of Law Firm Data Breach at Fried Frank]]></title>
            <description><![CDATA[Fried Frank Harris Shriver & Jacobson data breach exposes Goldman Sachs alternative fund investor information, prompting class action lawsuit.]]></description>
            <link>https://www.probablypwned.com/article/goldman-sachs-fried-frank-law-firm-breach</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/goldman-sachs-fried-frank-law-firm-breach</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Goldman Sachs]]></category>
            <category><![CDATA[Fried Frank]]></category>
            <category><![CDATA[law firm]]></category>
            <category><![CDATA[third-party risk]]></category>
            <category><![CDATA[class action]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 25 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Pro-Russian Hackers Cripple French Postal Service During Christmas Rush]]></title>
            <description><![CDATA[Noname057(16) claims DDoS attack on La Poste that disrupted package tracking and banking services for millions during peak holiday delivery season.]]></description>
            <link>https://www.probablypwned.com/article/french-postal-service-ddos-noname057-christmas</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/french-postal-service-ddos-noname057-christmas</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Noname057]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[France]]></category>
            <category><![CDATA[La Poste]]></category>
            <category><![CDATA[hacktivism]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 25 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1557597774-9d273605dfa9?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1557597774-9d273605dfa9?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Fortinet Warns 5-Year-Old FortiOS 2FA Bypass Is Under Active Attack]]></title>
            <description><![CDATA[CVE-2020-12812 allows attackers to bypass two-factor authentication on FortiGate devices by simply changing username case. Fortinet issued fresh advisory on December 25.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-cve-2020-12812-2fa-bypass-resurfaces</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-cve-2020-12812-2fa-bypass-resurfaces</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2020-12812]]></category>
            <category><![CDATA[2FA bypass]]></category>
            <category><![CDATA[FortiOS]]></category>
            <category><![CDATA[LDAP]]></category>
            <category><![CDATA[active exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 25 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1573164713988-8665fc963095?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Aflac Confirms 22.6 Million Affected in June Data Breach]]></title>
            <description><![CDATA[Insurance giant Aflac discloses hackers stole SSNs, health records, and personal data from 22.6 million people in a June 2025 breach attributed to Scattered Spider.]]></description>
            <link>https://www.probablypwned.com/article/aflac-data-breach-22-million-scattered-spider</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/aflac-data-breach-22-million-scattered-spider</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Aflac]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[healthcare]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[insurance]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Thu, 25 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1576091160399-112ba8d25d1d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1576091160399-112ba8d25d1d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Clop Ransomware Gang Steals 3.5 Million Records from University of Phoenix]]></title>
            <description><![CDATA[Oracle E-Business Suite zero-day exploitation adds another victim to Clop's CVE-2025-61882 campaign. SSNs and bank account numbers among exposed data.]]></description>
            <link>https://www.probablypwned.com/article/university-phoenix-breach-3-5-million-clop-oracle</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/university-phoenix-breach-3-5-million-clop-oracle</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Clop]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Oracle]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[University of Phoenix]]></category>
            <category><![CDATA[CVE-2025-61882]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Marquis Fintech Breach Exposes 400,000 Bank Customers via Unpatched SonicWall]]></title>
            <description><![CDATA[Akira ransomware gang exploited known SonicWall vulnerability to hit fintech vendor serving 700+ banks and credit unions. SSNs and card numbers stolen.]]></description>
            <link>https://www.probablypwned.com/article/marquis-fintech-breach-400000-bank-customers-sonicwall</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/marquis-fintech-breach-400000-bank-customers-sonicwall</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Marquis]]></category>
            <category><![CDATA[Akira]]></category>
            <category><![CDATA[SonicWall]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[banking]]></category>
            <category><![CDATA[ransomware]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1554224155-6726b3ff858f?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1554224155-6726b3ff858f?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[INTERPOL Operation Sentinel: 574 Arrested in Africa-Wide Cybercrime Crackdown]]></title>
            <description><![CDATA[Month-long operation across 19 African nations recovers $3 million, takes down 6,000 malicious links, and decrypts six ransomware variants.]]></description>
            <link>https://www.probablypwned.com/article/interpol-operation-sentinel-574-arrests-africa-cybercrime</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/interpol-operation-sentinel-574-arrests-africa-cybercrime</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[INTERPOL]]></category>
            <category><![CDATA[Operation Sentinel]]></category>
            <category><![CDATA[Africa]]></category>
            <category><![CDATA[BEC]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[law enforcement]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1453733190371-0a9bedd82893?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1453733190371-0a9bedd82893?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical n8n Flaw Lets Attackers Execute Code on 100,000+ Instances]]></title>
            <description><![CDATA[CVE-2025-68613 in the workflow automation platform scores CVSS 9.9 with public PoC code now available. Patch to version 1.122.0 immediately.]]></description>
            <link>https://www.probablypwned.com/article/critical-n8n-rce-vulnerability-cve-2025-68613</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/critical-n8n-rce-vulnerability-cve-2025-68613</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[n8n]]></category>
            <category><![CDATA[CVE-2025-68613]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[workflow automation]]></category>
            <category><![CDATA[zero-day]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1461749280684-dccba630e2f6?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA's Pre-Ransomware Warning Program Loses Its Only Operator]]></title>
            <description><![CDATA[David Stern, the sole employee running CISA's ransomware early warning initiative, resigned December 19 after being ordered to relocate. The program had sent 2,100+ alerts in 2024.]]></description>
            <link>https://www.probablypwned.com/article/cisa-loses-ransomware-warning-program-lead-david-stern</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-loses-ransomware-warning-program-lead-david-stern</guid>
            <category><![CDATA[Announcements]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[government]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[PRNI]]></category>
            <dc:creator><![CDATA[ProbablyPwned Editorial Team]]></dc:creator>
            <pubDate>Wed, 24 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1434030216411-0b793f4b4173?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1434030216411-0b793f4b4173?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[WatchGuard Firebox Zero-Day CVE-2025-14733 Actively Exploited, 125K Devices Exposed]]></title>
            <description><![CDATA[Critical out-of-bounds write vulnerability in WatchGuard Firebox firewalls under active exploitation with over 125,000 devices exposed online.]]></description>
            <link>https://www.probablypwned.com/article/watchguard-firebox-cve-2025-14733-actively-exploited</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/watchguard-firebox-cve-2025-14733-actively-exploited</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[WatchGuard]]></category>
            <category><![CDATA[CVE-2025-14733]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[firewall]]></category>
            <category><![CDATA[active-exploitation]]></category>
            <category><![CDATA[VPN]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1562813733-b31f71025d54?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Ukrainian National Pleads Guilty in Nefilim Ransomware Conspiracy]]></title>
            <description><![CDATA[Artem Stryzhak admits role in double-extortion ransomware attacks targeting large US and European companies from 2018 to 2021.]]></description>
            <link>https://www.probablypwned.com/article/ukrainian-nefilim-ransomware-affiliate-guilty-plea</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ukrainian-nefilim-ransomware-affiliate-guilty-plea</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Nefilim]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[guilty plea]]></category>
            <category><![CDATA[double extortion]]></category>
            <category><![CDATA[Ukraine]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1589578527966-fdac0f44566c?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1589578527966-fdac0f44566c?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Spotify's 300TB Music Library Scraped by Pirate Activist Group]]></title>
            <description><![CDATA[Anna's Archive claims to have scraped 86 million audio files from Spotify. The platform confirms DRM circumvention but says user data is not affected.]]></description>
            <link>https://www.probablypwned.com/article/spotify-300tb-music-library-scraped-annas-archive</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/spotify-300tb-music-library-scraped-annas-archive</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Spotify]]></category>
            <category><![CDATA[Anna's Archive]]></category>
            <category><![CDATA[data-scraping]]></category>
            <category><![CDATA[music-piracy]]></category>
            <category><![CDATA[DRM]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614680376593-902f74cf0d41?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614680376593-902f74cf0d41?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SonicWall Patches Exploited SMA1000 Zero-Day Used in Chained RCE Attack]]></title>
            <description><![CDATA[CVE-2025-40602 privilege escalation flaw combined with earlier vulnerability enables unauthenticated remote code execution on SonicWall appliances.]]></description>
            <link>https://www.probablypwned.com/article/sonicwall-sma1000-cve-2025-40602-chained-rce-exploit</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/sonicwall-sma1000-cve-2025-40602-chained-rce-exploit</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[SonicWall]]></category>
            <category><![CDATA[CVE-2025-40602]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[privilege escalation]]></category>
            <category><![CDATA[VPN]]></category>
            <category><![CDATA[chained exploit]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1536148935331-408321065b18?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Iranian Infy APT Resurfaces After Five Years with Telegram-Based C2]]></title>
            <description><![CDATA[SafeBreach uncovers new Prince of Persia campaign using updated Foudre and Tonnerre malware, now leveraging Telegram for command and control.]]></description>
            <link>https://www.probablypwned.com/article/iranian-infy-apt-resurfaces-foudre-tonnerre-telegram</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/iranian-infy-apt-resurfaces-foudre-tonnerre-telegram</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Iran]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[Infy]]></category>
            <category><![CDATA[Prince of Persia]]></category>
            <category><![CDATA[Foudre]]></category>
            <category><![CDATA[Tonnerre]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[espionage]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 23 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1560732488-6b0df240254a?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Romania's Water Management Agency Hit by Ransomware Attack Affecting 1,000 Systems]]></title>
            <description><![CDATA[Attackers weaponized Windows BitLocker to encrypt systems across Romanian Waters, impacting 10 of 11 river basin management organizations.]]></description>
            <link>https://www.probablypwned.com/article/romania-water-agency-ransomware-bitlocker-1000-systems</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/romania-water-agency-ransomware-bitlocker-1000-systems</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[Romania]]></category>
            <category><![CDATA[BitLocker]]></category>
            <category><![CDATA[water utility]]></category>
            <category><![CDATA[SCADA]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Mon, 22 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Former Incident Responders Plead Guilty to Running ALPHV Ransomware Attacks]]></title>
            <description><![CDATA[A Sygnia IR manager and DigitalMint negotiator admitted to deploying BlackCat ransomware while employed to help victims respond to such attacks.]]></description>
            <link>https://www.probablypwned.com/article/incident-responders-plead-guilty-alphv-blackcat-ransomware</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/incident-responders-plead-guilty-alphv-blackcat-ransomware</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[insider threat]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[ALPHV]]></category>
            <category><![CDATA[BlackCat]]></category>
            <category><![CDATA[incident response]]></category>
            <category><![CDATA[cybercrime]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 22 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1507003211169-0a1dd7228f2d?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[DOJ Charges 54 in $40 Million ATM Jackpotting Scheme Linked to Venezuelan Gang]]></title>
            <description><![CDATA[Federal indictments target Tren de Aragua members who used Ploutus malware to steal over $40 million from U.S. ATMs since 2021.]]></description>
            <link>https://www.probablypwned.com/article/doj-charges-54-atm-jackpotting-ploutus-malware-tren-de-aragua</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/doj-charges-54-atm-jackpotting-ploutus-malware-tren-de-aragua</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[ATM jackpotting]]></category>
            <category><![CDATA[Ploutus]]></category>
            <category><![CDATA[Tren de Aragua]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[DOJ]]></category>
            <category><![CDATA[financial crime]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Mon, 22 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Releases New BRICKSTORM Backdoor IOCs Tied to PRC State Actors]]></title>
            <description><![CDATA[Joint advisory from CISA, NSA, and Canadian Cyber Centre details new Rust-based variants of Chinese government malware targeting IT and government sectors.]]></description>
            <link>https://www.probablypwned.com/article/cisa-brickstorm-backdoor-rust-prc-state-sponsored</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-brickstorm-backdoor-rust-prc-state-sponsored</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[BRICKSTORM]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[backdoor]]></category>
            <category><![CDATA[Rust]]></category>
            <category><![CDATA[state-sponsored]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Mon, 22 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1516321318423-f06f85e504b3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[The 10 Biggest Cyber Stories of 2025: A Year of Record-Breaking Attacks]]></title>
            <description><![CDATA[From the largest cryptocurrency heist in history to nation-state espionage campaigns targeting critical infrastructure, 2025 redefined the cyber threat landscape.]]></description>
            <link>https://www.probablypwned.com/article/top-10-cyber-stories-2025-year-in-review</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/top-10-cyber-stories-2025-year-in-review</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[year-in-review]]></category>
            <category><![CDATA[Lazarus Group]]></category>
            <category><![CDATA[Scattered Spider]]></category>
            <category><![CDATA[Salt Typhoon]]></category>
            <category><![CDATA[data breach]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[nation-state]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Sun, 21 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SantaStealer Malware-as-a-Service Launches Just in Time for the Holidays]]></title>
            <description><![CDATA[Russian-developed infostealer now production-ready after December 16 release, targets browser credentials, crypto wallets, and messaging apps for $175/month.]]></description>
            <link>https://www.probablypwned.com/article/santastealer-malware-as-service-telegram-launch</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/santastealer-malware-as-service-telegram-launch</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[infostealer]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[SantaStealer]]></category>
            <category><![CDATA[Telegram]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[credential-theft]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1580894894513-541e068a3e2b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[React2Shell Vulnerability Now Weaponized in Ransomware Campaigns]]></title>
            <description><![CDATA[CVE-2025-55182 exploitation escalates as Weaxor ransomware operators use critical React Server Components flaw for initial access across 60+ organizations.]]></description>
            <link>https://www.probablypwned.com/article/react2shell-cve-2025-55182-ransomware-initial-access</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/react2shell-cve-2025-55182-ransomware-initial-access</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[CVE-2025-55182]]></category>
            <category><![CDATA[React]]></category>
            <category><![CDATA[ransomware]]></category>
            <category><![CDATA[Next.js]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[Weaxor]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1633356122544-f134324a6cee?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1633356122544-f134324a6cee?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[LongNosedGoblin: New China-Aligned APT Abuses Group Policy for Espionage]]></title>
            <description><![CDATA[ESET researchers discover sophisticated threat actor targeting Southeast Asian and Japanese governments using Windows Group Policy for lateral movement.]]></description>
            <link>https://www.probablypwned.com/article/longnosedgoblin-china-apt-group-policy-espionage</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/longnosedgoblin-china-apt-group-policy-espionage</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[LongNosedGoblin]]></category>
            <category><![CDATA[Group Policy]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Southeast Asia]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1585079542156-2755d9c8a094?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Kimwolf Botnet Hijacks 1.8 Million Android TV Boxes for DDoS Attacks]]></title>
            <description><![CDATA[Massive Android botnet targets set-top boxes and tablets, issued 1.7 billion attack commands in 3 days, briefly surpassing Google in DNS rankings.]]></description>
            <link>https://www.probablypwned.com/article/kimwolf-android-botnet-1-8-million-devices-ddos</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/kimwolf-android-botnet-1-8-million-devices-ddos</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[botnet]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[DDoS]]></category>
            <category><![CDATA[Kimwolf]]></category>
            <category><![CDATA[IoT]]></category>
            <category><![CDATA[AISURU]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1611532736597-de2d4265fba3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Denmark Blames Russia for Destructive Cyberattack That Burst Water Pipes]]></title>
            <description><![CDATA[Danish intelligence attributes Z-Pentest hacktivist attack on Køge water utility to Russian state, summons ambassador over 'hybrid war' operations.]]></description>
            <link>https://www.probablypwned.com/article/denmark-blames-russia-destructive-water-utility-cyberattack</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/denmark-blames-russia-destructive-water-utility-cyberattack</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[critical-infrastructure]]></category>
            <category><![CDATA[water-utility]]></category>
            <category><![CDATA[Z-Pentest]]></category>
            <category><![CDATA[Denmark]]></category>
            <category><![CDATA[hybrid-warfare]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Fri, 19 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1567264837824-c993e26bf663?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1567264837824-c993e26bf663?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[North Korea Stole $2.02 Billion in Cryptocurrency During 2025]]></title>
            <description><![CDATA[DPRK-affiliated threat actors dominated crypto theft in 2025, accounting for 76% of exchange compromises with cumulative theft now exceeding $6.75 billion.]]></description>
            <link>https://www.probablypwned.com/article/north-korea-cryptocurrency-theft-2025-two-billion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/north-korea-cryptocurrency-theft-2025-two-billion</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[North Korea]]></category>
            <category><![CDATA[Lazarus Group]]></category>
            <category><![CDATA[cryptocurrency]]></category>
            <category><![CDATA[Bybit]]></category>
            <category><![CDATA[theft]]></category>
            <category><![CDATA[DPRK]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Thu, 18 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1639762681485-074b7f938ba0?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[HPE Patches Maximum-Severity OneView RCE Vulnerability]]></title>
            <description><![CDATA[CVE-2025-37164 allows unauthenticated remote code execution against HPE OneView infrastructure management platforms running versions prior to 11.00.]]></description>
            <link>https://www.probablypwned.com/article/hpe-oneview-critical-rce-flaw-cve-2025-37164</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/hpe-oneview-critical-rce-flaw-cve-2025-37164</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[HPE]]></category>
            <category><![CDATA[OneView]]></category>
            <category><![CDATA[CVE-2025-37164]]></category>
            <category><![CDATA[RCE]]></category>
            <category><![CDATA[infrastructure management]]></category>
            <category><![CDATA[patch]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 18 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1597852074816-d933c7d2b988?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cisco AsyncOS Zero-Day Exploited by China-Linked APT, No Patch Available]]></title>
            <description><![CDATA[Critical CVE-2025-20393 in Cisco Secure Email Gateway actively exploited by UAT-9686 threat actors deploying AquaShell backdoor since November.]]></description>
            <link>https://www.probablypwned.com/article/cisco-asyncos-zero-day-exploited-china-apt-cve-2025-20393</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisco-asyncos-zero-day-exploited-china-apt-cve-2025-20393</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Cisco]]></category>
            <category><![CDATA[zero-day]]></category>
            <category><![CDATA[CVE-2025-20393]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[email security]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 18 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Warns of Asus Live Update Supply Chain Backdoor Under Active Attack]]></title>
            <description><![CDATA[CVE-2025-59374 exploits compromised ASUS software distribution to deploy backdoors on consumer and enterprise systems worldwide.]]></description>
            <link>https://www.probablypwned.com/article/cisa-asus-live-update-supply-chain-backdoor-cve-2025-59374</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-asus-live-update-supply-chain-backdoor-cve-2025-59374</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[ASUS]]></category>
            <category><![CDATA[supply chain]]></category>
            <category><![CDATA[CVE-2025-59374]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[KEV]]></category>
            <category><![CDATA[backdoor]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Thu, 18 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1518770660439-4636190af475?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[China-Linked Ink Dragon APT Targets European Governments with ShadowPad]]></title>
            <description><![CDATA[Sophisticated threat group escalates operations against European government entities using relay networks that route attacks through multiple victim organizations.]]></description>
            <link>https://www.probablypwned.com/article/ink-dragon-china-apt-european-governments-shadowpad</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ink-dragon-china-apt-european-governments-shadowpad</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT]]></category>
            <category><![CDATA[China]]></category>
            <category><![CDATA[Ink Dragon]]></category>
            <category><![CDATA[ShadowPad]]></category>
            <category><![CDATA[FINALDRAFT]]></category>
            <category><![CDATA[espionage]]></category>
            <category><![CDATA[Europe]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 17 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1510511459019-5dda7724fd87?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[GhostPoster Malware Hides in Firefox Extension Logos, Infects 50,000 Users]]></title>
            <description><![CDATA[Security researchers uncover sophisticated steganography attack concealing malicious JavaScript within PNG logo files of 17 Firefox browser extensions.]]></description>
            <link>https://www.probablypwned.com/article/ghostposter-firefox-extensions-malware-steganography</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/ghostposter-firefox-extensions-malware-steganography</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Firefox]]></category>
            <category><![CDATA[browser extensions]]></category>
            <category><![CDATA[steganography]]></category>
            <category><![CDATA[malware]]></category>
            <category><![CDATA[ad fraud]]></category>
            <category><![CDATA[affiliate hijacking]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 17 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1504639725590-34d0984388bd?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Cellik Android Malware-as-a-Service Trojanizes Any Google Play App]]></title>
            <description><![CDATA[New $150/month malware platform allows attackers to create weaponized versions of legitimate Android apps while maintaining full functionality.]]></description>
            <link>https://www.probablypwned.com/article/cellik-android-malware-service-trojanizes-play-store-apps</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cellik-android-malware-service-trojanizes-play-store-apps</guid>
            <category><![CDATA[Malware]]></category>
            <category><![CDATA[Android]]></category>
            <category><![CDATA[malware-as-a-service]]></category>
            <category><![CDATA[MaaS]]></category>
            <category><![CDATA[mobile security]]></category>
            <category><![CDATA[Cellik]]></category>
            <category><![CDATA[trojan]]></category>
            <dc:creator><![CDATA[Malware Desk]]></dc:creator>
            <pubDate>Wed, 17 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1563013544-824ae1b704d3?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Amazon Disrupts Multi-Year Russian GRU Campaign Targeting Energy Sector]]></title>
            <description><![CDATA[Amazon's threat intelligence team exposes and disrupts Sandworm operations targeting Western critical infrastructure through misconfigured edge devices.]]></description>
            <link>https://www.probablypwned.com/article/amazon-disrupts-russian-gru-sandworm-energy-sector-attacks</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/amazon-disrupts-russian-gru-sandworm-energy-sector-attacks</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[APT44]]></category>
            <category><![CDATA[Sandworm]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[GRU]]></category>
            <category><![CDATA[critical infrastructure]]></category>
            <category><![CDATA[energy sector]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Wed, 17 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1550751827-4bd374c3f58b?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Chrome Extension with 8 Million Users Caught Stealing AI Chats]]></title>
            <description><![CDATA[Urban VPN and related browser extensions secretly harvest conversations from ChatGPT, Claude, Copilot, and other AI platforms, selling data to advertisers.]]></description>
            <link>https://www.probablypwned.com/article/urban-vpn-chrome-extension-stealing-ai-chatbot-conversations</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/urban-vpn-chrome-extension-stealing-ai-chatbot-conversations</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[Chrome-extension]]></category>
            <category><![CDATA[privacy]]></category>
            <category><![CDATA[AI]]></category>
            <category><![CDATA[data-harvesting]]></category>
            <category><![CDATA[ChatGPT]]></category>
            <category><![CDATA[Claude]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1555949963-ff9fe0c870eb?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[SoundCloud Confirms Breach Affecting 28 Million Users]]></title>
            <description><![CDATA[ShinyHunters cyber extortion group targets SoundCloud, compromising 20% of users and launching DDoS attacks. Company confirms email addresses exposed.]]></description>
            <link>https://www.probablypwned.com/article/soundcloud-breach-shinyhunters-extortion</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/soundcloud-breach-shinyhunters-extortion</guid>
            <category><![CDATA[Data Breaches]]></category>
            <category><![CDATA[SoundCloud]]></category>
            <category><![CDATA[ShinyHunters]]></category>
            <category><![CDATA[data-breach]]></category>
            <category><![CDATA[extortion]]></category>
            <category><![CDATA[DDoS]]></category>
            <dc:creator><![CDATA[Data Breach Desk]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1558494949-ef010cbdcc31?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Critical Fortinet FortiGate Auth Bypass Under Active Exploitation]]></title>
            <description><![CDATA[Two critical CVSS 9.8 vulnerabilities in FortiGate devices are being actively exploited just days after patch release. Attackers targeting SSO authentication.]]></description>
            <link>https://www.probablypwned.com/article/fortinet-fortigate-authentication-bypass-actively-exploited</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/fortinet-fortigate-authentication-bypass-actively-exploited</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Fortinet]]></category>
            <category><![CDATA[CVE-2025-59718]]></category>
            <category><![CDATA[CVE-2025-59719]]></category>
            <category><![CDATA[authentication-bypass]]></category>
            <category><![CDATA[active-exploitation]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1614064641938-3bbee52942c7?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[CISA Warns Pro-Russia Hacktivists Attacking US Water and Energy]]></title>
            <description><![CDATA[Joint advisory from CISA, FBI, NSA warns of pro-Russia hacktivist groups successfully compromising SCADA systems at US water, energy, and food facilities.]]></description>
            <link>https://www.probablypwned.com/article/cisa-pro-russia-hacktivists-critical-infrastructure</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/cisa-pro-russia-hacktivists-critical-infrastructure</guid>
            <category><![CDATA[Threat Intelligence]]></category>
            <category><![CDATA[CISA]]></category>
            <category><![CDATA[Russia]]></category>
            <category><![CDATA[critical-infrastructure]]></category>
            <category><![CDATA[OT-security]]></category>
            <category><![CDATA[SCADA]]></category>
            <category><![CDATA[hacktivism]]></category>
            <dc:creator><![CDATA[Threat Intel Desk]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&amp;q=80"/>
        </item>
        <item>
            <title><![CDATA[Maximum Severity Apache Tika Flaw Threatens Document Pipelines]]></title>
            <description><![CDATA[CVE-2025-66516 is a CVSS 10.0 XXE injection vulnerability in Apache Tika affecting Solr, Elasticsearch, and countless document processing systems.]]></description>
            <link>https://www.probablypwned.com/article/apache-tika-critical-xxe-vulnerability-cve-2025-66516</link>
            <guid isPermaLink="true">https://www.probablypwned.com/article/apache-tika-critical-xxe-vulnerability-cve-2025-66516</guid>
            <category><![CDATA[Vulnerabilities]]></category>
            <category><![CDATA[Apache-Tika]]></category>
            <category><![CDATA[CVE-2025-66516]]></category>
            <category><![CDATA[XXE]]></category>
            <category><![CDATA[critical]]></category>
            <category><![CDATA[document-processing]]></category>
            <dc:creator><![CDATA[Vulnerability Desk]]></dc:creator>
            <pubDate>Tue, 16 Dec 2025 19:29:29 GMT</pubDate>
            <media:content url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80" medium="image" type="image/jpeg"/>
            <media:thumbnail url="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?w=1200&amp;q=80"/>
        </item>
    </channel>
</rss>