<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title><![CDATA[NetzBastion.de - IT-Sicherheitsnachrichten]]></title>
    <link>https://netzbastion.de</link>
    <description><![CDATA[Aktuelle IT-Sicherheitsnachrichten, CVE-Warnungen und Sicherheitslücken aus aller Welt]]></description>
    <language>de-DE</language>
    <lastBuildDate>Fri, 17 Apr 2026 08:20:17 GMT</lastBuildDate>
    <atom:link href="https://netzbastion.de/feed.xml" rel="self" type="application/rss+xml"/>
    <image>
      <url>https://netzbastion.de/favicon.svg</url>
      <title>NetzBastion.de - IT-Sicherheitsnachrichten</title>
      <link>https://netzbastion.de</link>
    </image>
    <item>
      <title><![CDATA[Microsoft: Some Windows servers enter reboot loops after April patches]]></title>
      <link>https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-reboot-loops-affecting-some-domain-controllers/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-reboot-loops-affecting-some-domain-controllers/</guid>
      <pubDate>Fri, 17 Apr 2026 07:59:47 GMT</pubDate>
      <description><![CDATA[Microsoft warns that some Windows domain controllers are entering restart loops after installing the April 2026 security updates. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[Cursor AI Vulnerability Exposed Developer Devices]]></title>
      <link>https://www.securityweek.com/cursor-ai-vulnerability-exposed-developer-devices/</link>
      <guid isPermaLink="true">https://www.securityweek.com/cursor-ai-vulnerability-exposed-developer-devices/</guid>
      <pubDate>Fri, 17 Apr 2026 07:29:16 GMT</pubDate>
      <description><![CDATA[An indirect prompt injection could be chained with a sandbox bypass and Cursor’s remote tunnel feature for shell access to machines.
The post Cursor AI Vulnerability Exposed Developer Devices appeared first on SecurityWeek.]]></description>
      <category>low</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions]]></title>
      <link>https://thehackernews.com/2026/04/nist-limits-cve-enrichment-after-263.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/nist-limits-cve-enrichment-after-263.html</guid>
      <pubDate>Fri, 17 Apr 2026 07:14:00 GMT</pubDate>
      <description><![CDATA[The National Institute of Standards and Technology (NIST) has announced changes to the way it handles cybersecurity vulnerabilities and exposures (CVEs) listed in its National Vulnerability Database (NVD), stating it will only enrich those that fulfil certain conditions owing to an explosion in CVE submissions.
"CVEs that do not meet those criteria will still be listed in the NVD but will not]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Man gets 30 months for selling thousands of hacked DraftKings accounts]]></title>
      <link>https://www.bleepingcomputer.com/news/security/man-gets-30-months-for-selling-thousands-of-hacked-draftkings-accounts/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/man-gets-30-months-for-selling-thousands-of-hacked-draftkings-accounts/</guid>
      <pubDate>Fri, 17 Apr 2026 07:10:32 GMT</pubDate>
      <description><![CDATA[23-year-old Kamerin Stokes of Memphis, Tennessee, was sentenced to 30 months in prison for selling access to tens of thousands of hacked DraftKings accounts. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[53 DDoS Domains Taken Down by Law Enforcement]]></title>
      <link>https://www.securityweek.com/53-ddos-domains-taken-down-by-law-enforcement/</link>
      <guid isPermaLink="true">https://www.securityweek.com/53-ddos-domains-taken-down-by-law-enforcement/</guid>
      <pubDate>Fri, 17 Apr 2026 06:40:21 GMT</pubDate>
      <description><![CDATA[Authorities in 21 countries participated in a coordinated action against DDoS-for-hire services.
The post 53 DDoS Domains Taken Down by Law Enforcement appeared first on SecurityWeek.]]></description>
      <category>low</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[Recently leaked Windows zero-days now exploited in attacks]]></title>
      <link>https://www.bleepingcomputer.com/news/security/recently-leaked-windows-zero-days-now-exploited-in-attacks/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/recently-leaked-windows-zero-days-now-exploited-in-attacks/</guid>
      <pubDate>Fri, 17 Apr 2026 06:14:52 GMT</pubDate>
      <description><![CDATA[Threat actors are exploiting three recently disclosed Windows security vulnerabilities in attacks aimed at gaining SYSTEM or elevated administrator permissions. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts]]></title>
      <link>https://thehackernews.com/2026/04/operation-poweroff-seizes-53-ddos.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/operation-poweroff-seizes-53-ddos.html</guid>
      <pubDate>Fri, 17 Apr 2026 05:46:00 GMT</pubDate>
      <description><![CDATA[An international law enforcement operation has taken down 53 domains and arrested four people in connection with commercial distributed denial-of-service (DDoS) operations that were used by more than 75,000 cybercriminals.
The ongoing effort, dubbed Operation PowerOFF, disrupted access to the DDoS-for-hire services, took down the technical infrastructure supporting them, and obtained access to]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation]]></title>
      <link>https://thehackernews.com/2026/04/apache-activemq-cve-2026-34197-added-to.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/apache-activemq-cve-2026-34197-added-to.html</guid>
      <pubDate>Fri, 17 Apr 2026 03:22:00 GMT</pubDate>
      <description><![CDATA[A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
To that end, the agency has added the vulnerability, tracked as CVE-2026-34197 (CVSS score: 8.8), to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian]]></description>
      <category>high</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[ISC Stormcast For Friday, April 17th, 2026 https://isc.sans.edu/podcastdetail/9896, (Fri, Apr 17th)]]></title>
      <link>https://isc.sans.edu/diary/rss/32906</link>
      <guid isPermaLink="true">https://isc.sans.edu/diary/rss/32906</guid>
      <pubDate>Fri, 17 Apr 2026 02:00:03 GMT</pubDate>
      <description><![CDATA[]]></description>
      <category>low</category>
      <source>SANS ISC</source>
    </item>
    <item>
      <title><![CDATA[Lumma Stealer infection with Sectop RAT (ArechClient2), (Fri, Apr 17th)]]></title>
      <link>https://isc.sans.edu/diary/rss/32904</link>
      <guid isPermaLink="true">https://isc.sans.edu/diary/rss/32904</guid>
      <pubDate>Fri, 17 Apr 2026 00:30:27 GMT</pubDate>
      <description><![CDATA[Introduction]]></description>
      <category>low</category>
      <source>SANS ISC</source>
    </item>
    <item>
      <title><![CDATA[Operation PowerOFF identifies 75k DDoS users, takes down 53 domains]]></title>
      <link>https://www.bleepingcomputer.com/news/security/operation-poweroff-identifies-75k-ddos-users-takes-down-53-domains/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/operation-poweroff-identifies-75k-ddos-users-takes-down-53-domains/</guid>
      <pubDate>Thu, 16 Apr 2026 22:26:34 GMT</pubDate>
      <description><![CDATA[The latest wave of "Operation PowerOFF," on April 13, 2026, targeted the distributed denial-of-service (DDoS) ecosystem and its users across 21 countries. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[ZionSiphon malware designed to sabotage water treatment systems]]></title>
      <link>https://www.bleepingcomputer.com/news/security/zionsiphon-malware-designed-to-sabotage-water-treatment-systems/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/zionsiphon-malware-designed-to-sabotage-water-treatment-systems/</guid>
      <pubDate>Thu, 16 Apr 2026 22:04:53 GMT</pubDate>
      <description><![CDATA[A new malware called ZionSiphon, specifically designed for operational technology, is targeting water treatment and desalination environments to sabotage their operations. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges]]></title>
      <link>https://www.bleepingcomputer.com/news/microsoft/new-microsoft-defender-redsun-zero-day-poc-grants-system-privileges/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/microsoft/new-microsoft-defender-redsun-zero-day-poc-grants-system-privileges/</guid>
      <pubDate>Thu, 16 Apr 2026 20:19:31 GMT</pubDate>
      <description><![CDATA[A researcher known as "Chaotic Eclipse" has published a proof-of-concept exploit for a second Microsoft Defender zero-day, dubbed "RedSun," in the past two weeks, protesting how the company works with cybersecurity researchers. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[&#x5b;Guest Diary&#x5d; Compromised DVRs and Finding Them in the Wild, (Thu, Apr 16th)]]></title>
      <link>https://isc.sans.edu/diary/rss/32886</link>
      <guid isPermaLink="true">https://isc.sans.edu/diary/rss/32886</guid>
      <pubDate>Thu, 16 Apr 2026 19:20:29 GMT</pubDate>
      <description><![CDATA[&#;x26;#;x5b;This is a Guest Diary by Alec Jaffe, an ISC intern as part of the SANS.edu Bachelor&#;x26;#;39;s Degree in Applied Cybersecurity (BACS) program &#;x26;#;x5b;1].]]></description>
      <category>low</category>
      <source>SANS ISC</source>
    </item>
    <item>
      <title><![CDATA[Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic]]></title>
      <link>https://thehackernews.com/2026/04/newly-discovered-powmix-botnet-hits.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/newly-discovered-powmix-botnet-hits.html</guid>
      <pubDate>Thu, 16 Apr 2026 17:52:00 GMT</pubDate>
      <description><![CDATA[Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025.
"PowMix employs randomized command-and-control (C2) beaconing intervals, rather than persistent connection to the C2 server, to evade the network signature detections," Cisco Talos]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Government Can’t Win the Cyber War Without the Private Sector]]></title>
      <link>https://www.securityweek.com/government-cant-win-the-cyber-war-without-the-private-sector/</link>
      <guid isPermaLink="true">https://www.securityweek.com/government-cant-win-the-cyber-war-without-the-private-sector/</guid>
      <pubDate>Thu, 16 Apr 2026 17:00:00 GMT</pubDate>
      <description><![CDATA[Securing national resilience now depends on faster, deeper partnerships with the private sector.
The post Government Can’t Win the Cyber War Without the Private Sector appeared first on SecurityWeek.]]></description>
      <category>low</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face]]></title>
      <link>https://www.bleepingcomputer.com/news/security/hackers-exploit-marimo-flaw-to-deploy-nkabuse-malware-from-hugging-face/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/hackers-exploit-marimo-flaw-to-deploy-nkabuse-malware-from-hugging-face/</guid>
      <pubDate>Thu, 16 Apr 2026 16:58:06 GMT</pubDate>
      <description><![CDATA[Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces. [...]]]></description>
      <category>critical</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[Google expands Gemini AI use to fight malicious ads on its platform]]></title>
      <link>https://www.bleepingcomputer.com/news/google/google-expands-gemini-ai-use-to-fight-malicious-ads-on-its-platform/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/google/google-expands-gemini-ai-use-to-fight-malicious-ads-on-its-platform/</guid>
      <pubDate>Thu, 16 Apr 2026 15:24:14 GMT</pubDate>
      <description><![CDATA[Google says it is increasingly using its Gemini AI models to detect and block harmful ads on its advertising platforms, as scammers and threat actors continue to evolve their tactics to evade detection. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal]]></title>
      <link>https://www.securityweek.com/openai-widens-access-to-cybersecurity-model-after-anthropics-mythos-reveal/</link>
      <guid isPermaLink="true">https://www.securityweek.com/openai-widens-access-to-cybersecurity-model-after-anthropics-mythos-reveal/</guid>
      <pubDate>Thu, 16 Apr 2026 14:27:06 GMT</pubDate>
      <description><![CDATA[GPT‑5.4‑Cyber is a model fine-tuned for defenders, lowering boundaries for legitimate cybersecurity work.
The post OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal appeared first on SecurityWeek.]]></description>
      <category>low</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[New ATHR vishing platform uses AI voice agents for automated attacks]]></title>
      <link>https://www.bleepingcomputer.com/news/security/new-athr-vishing-platform-uses-ai-voice-agents-for-automated-attacks/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/new-athr-vishing-platform-uses-ai-voice-agents-for-automated-attacks/</guid>
      <pubDate>Thu, 16 Apr 2026 14:09:11 GMT</pubDate>
      <description><![CDATA[A new cybercrime platform called ATHR can harvest credentials via fully automated voice phishing attacks that use both human operators and AI agents for the social engineering phase. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[Most "AI SOCs" Are Just Faster Triage. That's Not Enough.]]></title>
      <link>https://www.bleepingcomputer.com/news/security/most-ai-socs-are-just-faster-triage-thats-not-enough/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/most-ai-socs-are-just-faster-triage-thats-not-enough/</guid>
      <pubDate>Thu, 16 Apr 2026 14:02:12 GMT</pubDate>
      <description><![CDATA[AI-powered SOC tools promise automation, but most only speed up triage instead of reducing real workload. Tines shows how real gains come from end-to-end workflows that execute actions across systems, not just summarize alerts. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories]]></title>
      <link>https://thehackernews.com/2026/04/threatsday-bulletin-17-year-old-excel.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/threatsday-bulletin-17-year-old-excel.html</guid>
      <pubDate>Thu, 16 Apr 2026 13:05:00 GMT</pubDate>
      <description><![CDATA[You know that feeling when you open your feed on a Thursday morning and it's just... a lot? Yeah. This week delivered. We've got hackers getting creative in ways that are almost impressive if you ignore the whole "crime" part, ancient vulnerabilities somehow still ruining people's days, and enough supply chain drama to fill a season of television nobody asked for.
Not]]></description>
      <category>critical</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Data Breach at Tennessee Hospital Affects 337,000]]></title>
      <link>https://www.securityweek.com/data-breach-at-tennessee-hospital-affects-337000/</link>
      <guid isPermaLink="true">https://www.securityweek.com/data-breach-at-tennessee-hospital-affects-337000/</guid>
      <pubDate>Thu, 16 Apr 2026 12:40:36 GMT</pubDate>
      <description><![CDATA[Cookeville Regional Medical Center was targeted last year by the Rhysida ransomware group, which stole 500GB of data.
The post Data Breach at Tennessee Hospital Affects 337,000 appeared first on SecurityWeek.]]></description>
      <category>low</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[Artemis Emerges From Stealth With $70 Million in Funding]]></title>
      <link>https://www.securityweek.com/artemis-emerges-from-stealth-with-70-million/</link>
      <guid isPermaLink="true">https://www.securityweek.com/artemis-emerges-from-stealth-with-70-million/</guid>
      <pubDate>Thu, 16 Apr 2026 12:22:02 GMT</pubDate>
      <description><![CDATA[The startup is leveraging AI to prevent AI-powered attacks across applications, users, machines, and cloud workloads.
The post Artemis Emerges From Stealth With $70 Million in Funding appeared first on SecurityWeek.]]></description>
      <category>low</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[Cisco says critical Webex Services flaw requires customer action]]></title>
      <link>https://www.bleepingcomputer.com/news/security/cisco-says-critical-webex-services-flaw-requires-customer-action/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/cisco-says-critical-webex-services-flaw-requires-customer-action/</guid>
      <pubDate>Thu, 16 Apr 2026 12:01:42 GMT</pubDate>
      <description><![CDATA[Cisco has released security updates to patch four critical vulnerabilities, including a fixed improper certificate validation flaw in the company's cloud-based Webex Services platform that requires further customer action. [...]]]></description>
      <category>critical</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[[Webinar] Find and Eliminate Orphaned Non-Human Identities in Your Environment]]></title>
      <link>https://thehackernews.com/2026/04/webinar-find-and-eliminate-orphaned-non.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/webinar-find-and-eliminate-orphaned-non.html</guid>
      <pubDate>Thu, 16 Apr 2026 11:55:00 GMT</pubDate>
      <description><![CDATA[In 2024, compromised service accounts and forgotten API keys were behind 68% of cloud breaches. Not phishing. Not weak passwords. Unmanaged non-human identities that nobody was watching.
For every employee in your org, there are 40 to 50 automated credentials: service accounts, API tokens, AI agent connections, andOAuth grants. When projects end or employees leave, most]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Splunk Enterprise Update Patches Code Execution Vulnerability]]></title>
      <link>https://www.securityweek.com/splunk-enterprise-update-patches-code-execution-vulnerability/</link>
      <guid isPermaLink="true">https://www.securityweek.com/splunk-enterprise-update-patches-code-execution-vulnerability/</guid>
      <pubDate>Thu, 16 Apr 2026 11:51:39 GMT</pubDate>
      <description><![CDATA[The flaw allows low-privileged users to upload files to a temporary directory to achieve remote code execution.
The post Splunk Enterprise Update Patches Code Execution Vulnerability appeared first on SecurityWeek.]]></description>
      <category>low</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution]]></title>
      <link>https://thehackernews.com/2026/04/cisco-patches-four-critical-identity.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/cisco-patches-four-critical-identity.html</guid>
      <pubDate>Thu, 16 Apr 2026 11:27:00 GMT</pubDate>
      <description><![CDATA[Cisco has announced patches to address four critical security flaws impacting Identity Services and Webex Services that could result in arbitrary code execution and allow an attacker to impersonate any user within the service.
The details of the vulnerabilities are below -

CVE-2026-20184 (CVSS score: 9.8) - An improper certificate validation in the integration of single sign-on (SSO)]]></description>
      <category>critical</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Microsoft Paid Out $2.3 Million at Zero Day Quest 2026 Hacking Contest]]></title>
      <link>https://www.securityweek.com/microsoft-paid-out-2-3-million-at-zero-day-quest-2026-hacking-contest/</link>
      <guid isPermaLink="true">https://www.securityweek.com/microsoft-paid-out-2-3-million-at-zero-day-quest-2026-hacking-contest/</guid>
      <pubDate>Thu, 16 Apr 2026 11:21:27 GMT</pubDate>
      <description><![CDATA[Researchers found more than 80 high-impact cloud and AI vulnerabilities during the event, which had a $5 million prize pool.
The post Microsoft Paid Out $2.3 Million at Zero Day Quest 2026 Hacking Contest appeared first on SecurityWeek.]]></description>
      <category>high</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[NIST Prioritizes NVD Enrichment for CVEs in CISA KEV, Critical Software]]></title>
      <link>https://www.securityweek.com/nist-prioritizes-nvd-enrichment-for-cves-in-cisa-kev-critical-software/</link>
      <guid isPermaLink="true">https://www.securityweek.com/nist-prioritizes-nvd-enrichment-for-cves-in-cisa-kev-critical-software/</guid>
      <pubDate>Thu, 16 Apr 2026 10:47:14 GMT</pubDate>
      <description><![CDATA[To optimize management of CVE volume, entries that do not meet specific criteria will not be automatically enriched.
The post NIST Prioritizes NVD Enrichment for CVEs in CISA KEV, Critical Software appeared first on SecurityWeek.]]></description>
      <category>critical</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[Data breach at edtech giant McGraw Hill affects 13.5 million accounts]]></title>
      <link>https://www.bleepingcomputer.com/news/security/data-breach-at-edtech-giant-mcgraw-hill-affects-135-million-accounts/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/data-breach-at-edtech-giant-mcgraw-hill-affects-135-million-accounts/</guid>
      <pubDate>Thu, 16 Apr 2026 10:35:09 GMT</pubDate>
      <description><![CDATA[The ShinyHunters extortion group has leaked data from 13.5 million McGraw Hill user accounts, stolen after breaching the company's Salesforce environment earlier this month. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[Hidden Passenger? How Taboola Routes Logged-In Banking Sessions to Temu]]></title>
      <link>https://thehackernews.com/2026/04/hidden-passenger-how-taboola-routes.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/hidden-passenger-how-taboola-routes.html</guid>
      <pubDate>Thu, 16 Apr 2026 10:30:00 GMT</pubDate>
      <description><![CDATA[A bank approved a Taboola pixel. That pixel quietly redirected logged-in users to a Temu tracking endpoint. This occurred without the bank’s knowledge, without user consent, and without a single security control registering a violation.

Read the full technical breakdown in the Security Intelligence Brief. Download now →
The "First-Hop Bias" Blind Spot
Most&]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks]]></title>
      <link>https://thehackernews.com/2026/04/obsidian-plugin-abuse-delivers.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/obsidian-plugin-abuse-delivers.html</guid>
      <pubDate>Thu, 16 Apr 2026 10:20:00 GMT</pubDate>
      <description><![CDATA[A "novel" social engineering campaign has been observed abusing Obsidian, a cross-platform note-taking application, as an initial access vector to distribute a previously undocumented Windows remote access trojan called PHANTOMPULSE in attacks targeting individuals in the financial and cryptocurrency sectors.
Dubbed REF6598 by Elastic Security Labs, the activity has been found to leverage]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Cisco Patches Critical Vulnerabilities in Webex, ISE]]></title>
      <link>https://www.securityweek.com/cisco-patches-critical-vulnerabilities-in-webex-ise/</link>
      <guid isPermaLink="true">https://www.securityweek.com/cisco-patches-critical-vulnerabilities-in-webex-ise/</guid>
      <pubDate>Thu, 16 Apr 2026 10:04:31 GMT</pubDate>
      <description><![CDATA[The flaws can be exploited remotely to impersonate users or execute arbitrary commands on the underlying OS.
The post Cisco Patches Critical Vulnerabilities in Webex, ISE appeared first on SecurityWeek.]]></description>
      <category>critical</category>
      <source>SecurityWeek</source>
    </item>
    <item>
      <title><![CDATA[US nationals behind DPRK IT worker 'laptop farm' sent to prison]]></title>
      <link>https://www.bleepingcomputer.com/news/security/us-nationals-behind-north-korean-it-worker-laptop-farm-sent-to-prison/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/us-nationals-behind-north-korean-it-worker-laptop-farm-sent-to-prison/</guid>
      <pubDate>Thu, 16 Apr 2026 08:32:13 GMT</pubDate>
      <description><![CDATA[Two U.S. nationals have been sent to prison for helping North Korean remote information technology (IT) workers to pose as U.S. residents and get hired by over 100 companies across the country, including many Fortune 500 firms. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[Microsoft: April Windows Server 2025 update may fail to install]]></title>
      <link>https://www.bleepingcomputer.com/news/microsoft/microsoft-april-windows-server-2025-update-may-fail-to-install/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/microsoft/microsoft-april-windows-server-2025-update-may-fail-to-install/</guid>
      <pubDate>Thu, 16 Apr 2026 07:37:44 GMT</pubDate>
      <description><![CDATA[Microsoft is investigating an issue causing this month's KB5082063 security update to fail to install on some Windows Server 2025 systems. [...]]]></description>
      <category>low</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign]]></title>
      <link>https://thehackernews.com/2026/04/uac-0247-targets-ukrainian-clinics-and.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/uac-0247-targets-ukrainian-clinics-and.html</guid>
      <pubDate>Thu, 16 Apr 2026 06:20:00 GMT</pubDate>
      <description><![CDATA[The Computer Emergencies Response Team of Ukraine (CERT-UA) has disclosed details of a new campaign that has targeted governments and municipal healthcare institutions, mainly clinics and emergency hospitals, to deliver malware capable of stealing sensitive data from Chromium-based web browsers and WhatsApp.
The activity, which was observed between March and April]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[ISC Stormcast For Thursday, April 16th, 2026 https://isc.sans.edu/podcastdetail/9894, (Thu, Apr 16th)]]></title>
      <link>https://isc.sans.edu/diary/rss/32902</link>
      <guid isPermaLink="true">https://isc.sans.edu/diary/rss/32902</guid>
      <pubDate>Thu, 16 Apr 2026 02:00:03 GMT</pubDate>
      <description><![CDATA[]]></description>
      <category>low</category>
      <source>SANS ISC</source>
    </item>
    <item>
      <title><![CDATA[Critical Nginx UI auth bypass flaw now actively exploited in the wild]]></title>
      <link>https://www.bleepingcomputer.com/news/security/critical-nginx-ui-auth-bypass-flaw-now-actively-exploited-in-the-wild/</link>
      <guid isPermaLink="true">https://www.bleepingcomputer.com/news/security/critical-nginx-ui-auth-bypass-flaw-now-actively-exploited-in-the-wild/</guid>
      <pubDate>Wed, 15 Apr 2026 22:35:09 GMT</pubDate>
      <description><![CDATA[A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authentication. [...]]]></description>
      <category>critical</category>
      <source>Bleeping Computer</source>
    </item>
    <item>
      <title><![CDATA[n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails]]></title>
      <link>https://thehackernews.com/2026/04/n8n-webhooks-abused-since-october-2025.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/n8n-webhooks-abused-since-october-2025.html</guid>
      <pubDate>Wed, 15 Apr 2026 17:09:00 GMT</pubDate>
      <description><![CDATA[Threat actors have been observed weaponizing n8n, a popular artificial intelligence (AI) workflow automation platform, to facilitate sophisticated phishing campaigns and deliver malicious payloads or fingerprint devices by sending automated emails.
"By leveraging trusted infrastructure, these attackers bypass traditional security filters, turning productivity tools into delivery]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover]]></title>
      <link>https://thehackernews.com/2026/04/critical-nginx-ui-vulnerability-cve.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/critical-nginx-ui-vulnerability-cve.html</guid>
      <pubDate>Wed, 15 Apr 2026 12:56:00 GMT</pubDate>
      <description><![CDATA[A recently disclosed critical security flaw impacting nginx-ui, an open-source, web-based Nginx management tool, has come under active exploitation in the wild.
The vulnerability in question is CVE-2026-33032 (CVSS score: 9.8), an authentication bypass vulnerability that enables threat actors to seize control of the Nginx service. It has been codenamed MCPwn by Pluto Security.
"]]></description>
      <category>critical</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More]]></title>
      <link>https://thehackernews.com/2026/04/april-patch-tuesday-fixes-critical.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/april-patch-tuesday-fixes-critical.html</guid>
      <pubDate>Wed, 15 Apr 2026 12:37:00 GMT</pubDate>
      <description><![CDATA[A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases.
Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS score: 9.9) that could result in the execution of arbitrary database]]></description>
      <category>critical</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Deterministic + Agentic AI: The Architecture Exposure Validation Requires]]></title>
      <link>https://thehackernews.com/2026/04/deterministic-agentic-ai-architecture.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/deterministic-agentic-ai-architecture.html</guid>
      <pubDate>Wed, 15 Apr 2026 11:30:00 GMT</pubDate>
      <description><![CDATA[Few technologies have moved from experimentation to boardroom mandate as quickly as AI. Across industries, leadership teams have embraced its broader potential, and boards, investors, and executives are already pushing organizations to adopt it across operational and security functions. Pentera’s AI Security and Exposure Report 2026 reflects that momentum: every CISO surveyed]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities]]></title>
      <link>https://thehackernews.com/2026/04/microsoft-issues-patches-for-sharepoint.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/microsoft-issues-patches-for-sharepoint.html</guid>
      <pubDate>Wed, 15 Apr 2026 08:40:00 GMT</pubDate>
      <description><![CDATA[Microsoft on Tuesday released updates to address a record 169 security flaws across its product portfolio, including one vulnerability that has been actively exploited in the wild.
Of these 169 vulnerabilities, 157 are rated Important, eight are rated Critical, three are rated Moderate, and one is rated Low in severity. Ninety-three of the flaws are]]></description>
      <category>critical</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[OpenAI Launches GPT-5.4-Cyber with Expanded Access for Security Teams]]></title>
      <link>https://thehackernews.com/2026/04/openai-launches-gpt-54-cyber-with.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/openai-launches-gpt-54-cyber-with.html</guid>
      <pubDate>Wed, 15 Apr 2026 04:30:00 GMT</pubDate>
      <description><![CDATA[OpenAI on Tuesday unveiled GPT-5.4-Cyber, a variant of its latest flagship model, GPT‑5.4, that's specifically optimized for defensive cybersecurity use cases, days after rival Anthropic unveiled its own frontier model, Mythos.
"The progressive use of AI accelerates defenders – those responsible for keeping systems, data, and users safe – enabling them to find and fix problems]]></description>
      <category>low</category>
      <source>The Hacker News</source>
    </item>
    <item>
      <title><![CDATA[ISC Stormcast For Wednesday, April 15th, 2026 https://isc.sans.edu/podcastdetail/9892, (Wed, Apr 15th)]]></title>
      <link>https://isc.sans.edu/diary/rss/32900</link>
      <guid isPermaLink="true">https://isc.sans.edu/diary/rss/32900</guid>
      <pubDate>Wed, 15 Apr 2026 02:00:02 GMT</pubDate>
      <description><![CDATA[]]></description>
      <category>low</category>
      <source>SANS ISC</source>
    </item>
    <item>
      <title><![CDATA[Scanning for AI Models, (Tue, Apr 14th)]]></title>
      <link>https://isc.sans.edu/diary/rss/32896</link>
      <guid isPermaLink="true">https://isc.sans.edu/diary/rss/32896</guid>
      <pubDate>Wed, 15 Apr 2026 00:19:53 GMT</pubDate>
      <description><![CDATA[Starting March 10, 2026, my DShield sensor started getting probe for various AI models such as claude, openclaw, huggingface, etc. Reviewing the data already reported by other DShield sensors to ISC, the DShield database shows reporting of these probes started that day and has been active ever since.]]></description>
      <category>low</category>
      <source>SANS ISC</source>
    </item>
    <item>
      <title><![CDATA[Patch Tuesday, April 2026 Edition]]></title>
      <link>https://krebsonsecurity.com/2026/04/patch-tuesday-april-2026-edition/</link>
      <guid isPermaLink="true">https://krebsonsecurity.com/2026/04/patch-tuesday-april-2026-edition/</guid>
      <pubDate>Tue, 14 Apr 2026 21:47:59 GMT</pubDate>
      <description><![CDATA[Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.]]></description>
      <category>low</category>
      <source>Krebs on Security</source>
    </item>
    <item>
      <title><![CDATA[Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)]]></title>
      <link>https://isc.sans.edu/diary/rss/32898</link>
      <guid isPermaLink="true">https://isc.sans.edu/diary/rss/32898</guid>
      <pubDate>Tue, 14 Apr 2026 17:46:09 GMT</pubDate>
      <description><![CDATA[This month&#;x26;#;39;s Microsoft Patch Tuesday looks like a record one, but let&#;x26;#;39;s look at it a bit closer to understand what is happening]]></description>
      <category>low</category>
      <source>SANS ISC</source>
    </item>
    <item>
      <title><![CDATA[New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released]]></title>
      <link>https://thehackernews.com/2026/04/new-php-composer-flaws-enable-arbitrary.html</link>
      <guid isPermaLink="true">https://thehackernews.com/2026/04/new-php-composer-flaws-enable-arbitrary.html</guid>
      <pubDate>Tue, 14 Apr 2026 15:57:00 GMT</pubDate>
      <description><![CDATA[Two high-severity security vulnerabilities have been disclosed in Composer, a package manager for PHP, that, if successfully exploited, could result in arbitrary command execution.
The vulnerabilities have been described as command injection flaws affecting the Perforce VCS (version control software) driver. Details of the two flaws are below -

CVE-2026-40176 (CVSS]]></description>
      <category>high</category>
      <source>The Hacker News</source>
    </item>
  </channel>
</rss>