<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>ThreatNoir — All Content</title>
    <link>https://threatnoir.com</link>
	    <description><![CDATA[Curated cybersecurity news and analysis]]></description>
    <language>en</language>
    <copyright>ThreatNoir 2026</copyright>
    <atom:link href="https://threatnoir.com/api/feed.xml" rel="self" type="application/rss+xml"/>
    <lastBuildDate>Fri, 13 Nov 2026 22:21:35 GMT</lastBuildDate>
    <item>
      <title>North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto</title>
      <link>https://threatnoir.com/awareness/north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto</guid>
      <pubDate>Fri, 13 Nov 2026 22:21:35 GMT</pubDate>
      <description><![CDATA[North Korea-linked threat actors (Sapphire Sleet/APT38) successfully stole over $1.2 billion in cryptocurrency by exploiting the weakest link in security: human trust. The FaceStealer scheme leveraged AI-generated deepfakes and sophisticated social engineering to trick victims into installing malware, bypassing technical controls entirely. Critically, these same actors are now targeting open-source developers, poisoning the software supply chain and threatening organizations that consume communi...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>Internet-Connected Refrigeration Units Expose Critical Infrastructure to Root-Level Attacks</title>
      <link>https://threatnoir.com/awareness/internet-connected-refrigeration-units-expose-critical-infrastructure-to-root-level-attacks</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/internet-connected-refrigeration-units-expose-critical-infrastructure-to-root-level-attacks</guid>
      <pubDate>Fri, 13 Nov 2026 22:21:16 GMT</pubDate>
      <description><![CDATA[VulnCheck disclosed 14 vulnerabilities in Dixell/Copeland XWEB EVO refrigeration supervision systems, several rated high severity, with at least two actively exploited in the wild. The core problem is that operational technology (OT) devices like commercial refrigeration controllers are being exposed directly to the internet without adequate hardening, segmentation, or timely patching. These devices were not designed with modern threat models in mind, yet they are increasingly networked and reac...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>SCKit Worm Hijacks ScreenConnect Sessions to Compromise IT Technician Workstations</title>
      <link>https://threatnoir.com/awareness/sckit-worm-hijacks-screenconnect-sessions-to-compromise-it-technician-workstations</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/sckit-worm-hijacks-screenconnect-sessions-to-compromise-it-technician-workstations</guid>
      <pubDate>Fri, 13 Nov 2026 22:20:58 GMT</pubDate>
      <description><![CDATA[Threat actors exploited improperly secured or unpatched ConnectWise ScreenConnect instances to install unauthorized remote access clients and deploy the SCKit worm. The worm's RelayTrap component specifically targeted IT support technician sessions — a highly privileged attack surface — allowing attackers to piggyback on legitimate support workflows for lateral movement and payload distribution. This attack is particularly dangerous because it weaponizes trusted remote administration tooling, ma...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>AI-Powered Attack Tool Artex Enables Machine-Speed Intrusions by Low-Skill Actors</title>
      <link>https://threatnoir.com/awareness/ai-powered-attack-tool-artex-enables-machine-speed-intrusions-by-low-skill-actors</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/ai-powered-attack-tool-artex-enables-machine-speed-intrusions-by-low-skill-actors</guid>
      <pubDate>Fri, 13 Nov 2026 22:20:40 GMT</pubDate>
      <description><![CDATA[The proliferation of Artex, an open-source AI platform, dramatically lowers the barrier to entry for cybercriminals by automating complex attack chains in under three hours. Even the removal of the tool's GitHub repository has failed to contain its spread, illustrating how offensive AI tools, once released, cannot be un-published. This matters because traditional defenses calibrated to human-speed attacks are inadequate against automated, AI-driven intrusion campaigns. Organizations must assume ...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>FAA Communications Failure Halts All U.S. Flights</title>
      <link>https://threatnoir.com/awareness/faa-communications-failure-halts-all-us-flights</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/faa-communications-failure-halts-all-us-flights</guid>
      <pubDate>Fri, 13 Nov 2026 22:20:21 GMT</pubDate>
      <description><![CDATA[A communications failure affecting Air Route Traffic Control Centers prompted the FAA to issue a nationwide ground stop, grounding all departing flights across the U.S. While the root cause—whether technical failure or cyberattack—remained unclear at time of reporting, the incident exposed the fragility of critical aviation infrastructure when a single communications system fails. For safety-critical systems like air traffic control, any disruption has immediate, cascading consequences for publi...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>FAA Ground Stop Issued Due to ‘Extraordinary Circumstances’</title>
      <link>https://threatnoir.com/article/faa-ground-stop-issued-due-to-extraordinary-circumstances-068aac</link>
      <guid isPermaLink="true">https://threatnoir.com/article/faa-ground-stop-issued-due-to-extraordinary-circumstances-068aac</guid>
      <pubDate>Fri, 13 Nov 2026 21:33:27 GMT</pubDate>
      <description><![CDATA[FAA grounds all US flights due to communications disruption; cyberattack not ruled out.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’</title>
      <link>https://threatnoir.com/article/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed-637417</link>
      <guid isPermaLink="true">https://threatnoir.com/article/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed-637417</guid>
      <pubDate>Fri, 13 Nov 2026 21:32:00 GMT</pubDate>
      <description><![CDATA[FBI warns Artex AI tool automates cyberattacks at machine speed, targeting critical sectors.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>SCKit abuses ScreenConnect to deploy remote access and target technician sessions</title>
      <link>https://threatnoir.com/article/sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-36ece2</link>
      <guid isPermaLink="true">https://threatnoir.com/article/sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-36ece2</guid>
      <pubDate>Fri, 13 Nov 2026 21:31:44 GMT</pubDate>
      <description><![CDATA[SCKit malware abuses ScreenConnect to gain unauthorized remote access and target IT technicians.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>Actively Exploited Vulnerabilities Added to CISA KEV Catalog Demand Immediate Remediation</title>
      <link>https://threatnoir.com/awareness/actively-exploited-vulnerabilities-added-to-cisa-kev-catalog-demand-immediate-remediation</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/actively-exploited-vulnerabilities-added-to-cisa-kev-catalog-demand-immediate-remediation</guid>
      <pubDate>Fri, 13 Nov 2026 21:21:21 GMT</pubDate>
      <description><![CDATA[CISA's addition of CVE-2026-114713 and CVE-2026-123039 to the Known Exploited Vulnerabilities Catalog confirms that threat actors are actively leveraging these flaws against real targets, including federal systems. When known vulnerabilities remain unpatched on publicly exposed assets, organizations hand attackers a documented, low-effort path into their networks. The KEV Catalog exists precisely because patch backlogs and poor asset visibility routinely allow exploitable conditions to persist l...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>Exposed Camera Software Exploited to Mine Cryptocurrency Across 13 Organizations</title>
      <link>https://threatnoir.com/awareness/exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations</guid>
      <pubDate>Fri, 13 Nov 2026 21:21:00 GMT</pubDate>
      <description><![CDATA[Attackers leveraged publicly exposed GeoVision camera software—likely running outdated or unpatched versions—to gain a foothold across 13 organizations and deploy the XMRig cryptominer. The attack chain was sophisticated: PowerShell scripts attempted to disable Microsoft Defender via a kernel-mode driver and IFEO debugger hijacks, followed by a custom Golang loader to fetch and execute the miner. This incident highlights the danger of internet-facing legacy or IoT devices that are rarely patched...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>Researchers continue to find serious vulnerabilities in internet connected refrigerators</title>
      <link>https://threatnoir.com/article/researchers-continue-to-find-serious-vulnerabilities-in-internet-connected-refri-04d35e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/researchers-continue-to-find-serious-vulnerabilities-in-internet-connected-refri-04d35e</guid>
      <pubDate>Fri, 13 Nov 2026 21:20:51 GMT</pubDate>
      <description><![CDATA[14 vulnerabilities in Dixell refrigeration units grant root access, with some under active exploitation.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>CVE Volume Hits 100K: AI-Driven Discovery Outpaces Human Patching Capacity</title>
      <link>https://threatnoir.com/awareness/cve-volume-hits-100k-ai-driven-discovery-outpaces-human-patching-capacity</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/cve-volume-hits-100k-ai-driven-discovery-outpaces-human-patching-capacity</guid>
      <pubDate>Fri, 13 Nov 2026 21:20:43 GMT</pubDate>
      <description><![CDATA[The number of disclosed CVEs in 2026 has surpassed 100,000 — more than double the prior year — driven largely by AI-assisted vulnerability discovery by major CVE Numbering Authorities. While the raw exploit rate remains low, the danger lies in the shrinking window between patch release and weaponization, as adversaries also leverage AI to accelerate exploit development. Organizations that rely on manual triage and periodic patching cycles are increasingly exposed because they cannot keep pace wi...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>AI-Powered Pen Testing Tools Lower the Bar for Attackers</title>
      <link>https://threatnoir.com/awareness/ai-powered-pen-testing-tools-lower-the-bar-for-attackers</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/ai-powered-pen-testing-tools-lower-the-bar-for-attackers</guid>
      <pubDate>Fri, 13 Nov 2026 21:20:23 GMT</pubDate>
      <description><![CDATA[Legitimate penetration testing frameworks such as ARTEX, Hephaestus, PentAGI, and HexStrike AI are being repurposed by criminal actors to automate end-to-end attack chains at machine speed, dramatically reducing the expertise required to launch sophisticated intrusions. Because these tools chain together reconnaissance, exploitation, and lateral movement automatically, defenders face compressed timelines that traditional reactive controls cannot match. Organizations that rely on periodic vulnera...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure</title>
      <link>https://threatnoir.com/article/north-korea-s-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-6ebed0</link>
      <guid isPermaLink="true">https://threatnoir.com/article/north-korea-s-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-6ebed0</guid>
      <pubDate>Fri, 13 Nov 2026 21:19:30 GMT</pubDate>
      <description><![CDATA[DOJ seizes $1.2B in crypto, disrupts North Korean hacker infrastructure and FaceStealer scheme.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>ARTEX and beyond: AI-enabled penetration testing platforms</title>
      <link>https://threatnoir.com/article/artex-and-beyond-ai-enabled-penetration-testing-platforms-d59fa8</link>
      <guid isPermaLink="true">https://threatnoir.com/article/artex-and-beyond-ai-enabled-penetration-testing-platforms-d59fa8</guid>
      <pubDate>Fri, 13 Nov 2026 20:57:13 GMT</pubDate>
      <description><![CDATA[AI-enabled penetration testing frameworks like ARTEX are being misused by threat actors to accelerate intrusions.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>This year’s bug count just passed 100K</title>
      <link>https://threatnoir.com/article/this-year-s-bug-count-just-passed-100k-9b8800</link>
      <guid isPermaLink="true">https://threatnoir.com/article/this-year-s-bug-count-just-passed-100k-9b8800</guid>
      <pubDate>Fri, 13 Nov 2026 20:52:17 GMT</pubDate>
      <description><![CDATA[The number of disclosed software vulnerabilities in 2026 has surpassed 100,000, more than double last year's total.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>Microsoft 365 Outage Exposes Risks of Unvalidated Network Changes</title>
      <link>https://threatnoir.com/awareness/microsoft-365-outage-exposes-risks-of-unvalidated-network-changes</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/microsoft-365-outage-exposes-risks-of-unvalidated-network-changes</guid>
      <pubDate>Fri, 13 Nov 2026 20:20:57 GMT</pubDate>
      <description><![CDATA[A network capacity upgrade and recent configuration change caused a 24-hour global outage of Microsoft 365, impacting tens of millions of users across more than 70 countries. The root cause highlights how infrastructure changes — even those unrelated to security attacks — can cascade into major service disruptions when change management and rollback procedures are insufficient. Organizations relying on cloud-hosted productivity suites are reminded that upstream provider outages can paralyze thei...]]></description>
      <category>awareness</category>
    </item>
    <item>
      <title>City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents</title>
      <link>https://threatnoir.com/article/city-of-osaka-warns-of-data-breach-impacting-1-million-as-japan-reels-from-dozen-72ccdc</link>
      <guid isPermaLink="true">https://threatnoir.com/article/city-of-osaka-warns-of-data-breach-impacting-1-million-as-japan-reels-from-dozen-72ccdc</guid>
      <pubDate>Fri, 13 Nov 2026 19:43:00 GMT</pubDate>
      <description><![CDATA[City of Osaka discloses breach affecting 1M email addresses via compromised third-party platform.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>Trezor confirms crypto-stealing implants in three wallets, releases fix</title>
      <link>https://threatnoir.com/article/trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix-d29629</link>
      <guid isPermaLink="true">https://threatnoir.com/article/trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix-d29629</guid>
      <pubDate>Fri, 13 Nov 2026 19:38:36 GMT</pubDate>
      <description><![CDATA[Trezor confirms crypto-stealing implants in three Safe 5 wallets sold by CryptoBilis.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>Microsoft 365 Crawls Back to Life After a 24-Hour Outage</title>
      <link>https://threatnoir.com/article/microsoft-365-crawls-back-to-life-after-a-24-hour-outage-6b7a92</link>
      <guid isPermaLink="true">https://threatnoir.com/article/microsoft-365-crawls-back-to-life-after-a-24-hour-outage-6b7a92</guid>
      <pubDate>Fri, 13 Nov 2026 19:08:57 GMT</pubDate>
      <description><![CDATA[Microsoft 365 outage affecting 70+ countries caused by bad network update, not cyberattack.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>NYC to bar surveillance pricing as momentum for bans grows nationwide</title>
      <link>https://threatnoir.com/article/nyc-to-bar-surveillance-pricing-as-momentum-for-bans-grows-nationwide-1f0d7e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/nyc-to-bar-surveillance-pricing-as-momentum-for-bans-grows-nationwide-1f0d7e</guid>
      <pubDate>Fri, 13 Nov 2026 18:35:00 GMT</pubDate>
      <description><![CDATA[NYC bans surveillance pricing, allowing $1,000 fines per violation.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>German military drone operations disrupted by cyberattack</title>
      <link>https://threatnoir.com/article/german-military-drone-operations-disrupted-by-cyberattack-6ce23a</link>
      <guid isPermaLink="true">https://threatnoir.com/article/german-military-drone-operations-disrupted-by-cyberattack-6ce23a</guid>
      <pubDate>Fri, 13 Nov 2026 17:31:56 GMT</pubDate>
      <description><![CDATA[German drone maker Quantum Systems hit by cyberattack targeting update server.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>University of Texas at Arlington warns personal information stolen during cyberattack</title>
      <link>https://threatnoir.com/article/university-of-texas-at-arlington-warns-personal-information-stolen-during-cybera-ff3fa2</link>
      <guid isPermaLink="true">https://threatnoir.com/article/university-of-texas-at-arlington-warns-personal-information-stolen-during-cybera-ff3fa2</guid>
      <pubDate>Fri, 13 Nov 2026 17:26:00 GMT</pubDate>
      <description><![CDATA[University of Texas at Arlington confirms personal information stolen in cyberattack claimed by Qilin ransomware.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>The Microsoft Outage Is a Warning for the World</title>
      <link>https://threatnoir.com/article/the-microsoft-outage-is-a-warning-for-the-world-aa3046</link>
      <guid isPermaLink="true">https://threatnoir.com/article/the-microsoft-outage-is-a-warning-for-the-world-aa3046</guid>
      <pubDate>Fri, 13 Nov 2026 17:15:54 GMT</pubDate>
      <description><![CDATA[Microsoft 365 outage impacts Outlook, Teams, and Copilot globally for a second day.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>The Green Agent POV: Formulating the Fix for an Internet-Facing Container with Sensitive Data Access</title>
      <link>https://threatnoir.com/article/the-green-agent-pov-formulating-the-fix-for-an-internet-facing-container-with-se-43a4d5</link>
      <guid isPermaLink="true">https://threatnoir.com/article/the-green-agent-pov-formulating-the-fix-for-an-internet-facing-container-with-se-43a4d5</guid>
      <pubDate>Fri, 13 Nov 2026 17:05:02 GMT</pubDate>
      <description><![CDATA[Green Agent tool identifies and formulates fixes for internet-facing containers with vulnerabilities and sensitive data]]></description>
      <category>article</category>
    </item>
    <item>
      <title>The Take-Home Test That Runs on Your Work Laptop: Inside the AccuraSoftHire Fake Interview Campaign</title>
      <link>https://threatnoir.com/article/the-take-home-test-that-runs-on-your-work-laptop-inside-the-accurasofthire-fake-2d9b52</link>
      <guid isPermaLink="true">https://threatnoir.com/article/the-take-home-test-that-runs-on-your-work-laptop-inside-the-accurasofthire-fake-2d9b52</guid>
      <pubDate>Fri, 13 Nov 2026 17:04:34 GMT</pubDate>
      <description><![CDATA[Fake interview campaign uses poisoned npm packages to deliver malware to developer machines.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE</title>
      <link>https://threatnoir.com/article/postgresql-patches-52-flaws-including-22-year-old-bug-enabling-authenticated-rce-d8cc21</link>
      <guid isPermaLink="true">https://threatnoir.com/article/postgresql-patches-52-flaws-including-22-year-old-bug-enabling-authenticated-rce-d8cc21</guid>
      <pubDate>Fri, 13 Nov 2026 16:53:08 GMT</pubDate>
      <description><![CDATA[PostgreSQL patches 52 flaws, including a 22-year-old bug enabling authenticated RCE.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>German parliament passes law giving spy agencies hacking, sabotage powers</title>
      <link>https://threatnoir.com/article/german-parliament-passes-law-giving-spy-agencies-hacking-sabotage-powers-064bcd</link>
      <guid isPermaLink="true">https://threatnoir.com/article/german-parliament-passes-law-giving-spy-agencies-hacking-sabotage-powers-064bcd</guid>
      <pubDate>Fri, 13 Nov 2026 16:32:00 GMT</pubDate>
      <description><![CDATA[German parliament passes law granting spy agencies new hacking and sabotage powers.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper</title>
      <link>https://threatnoir.com/article/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper-97c01e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper-97c01e</guid>
      <pubDate>Fri, 13 Nov 2026 16:21:43 GMT</pubDate>
      <description><![CDATA[Check Point gateways exploited via PHP2Shell to deploy ESXi wiper in targeted attacks]]></description>
      <category>article</category>
    </item>
    <item>
      <title>DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018</title>
      <link>https://threatnoir.com/article/doj-gootloader-used-in-at-least-44-ransomware-attacks-costing-29-million-since-2-762fea</link>
      <guid isPermaLink="true">https://threatnoir.com/article/doj-gootloader-used-in-at-least-44-ransomware-attacks-costing-29-million-since-2-762fea</guid>
      <pubDate>Fri, 13 Nov 2026 15:59:00 GMT</pubDate>
      <description><![CDATA[DOJ details Gootloader's role in 44 ransomware attacks causing $29M in losses.]]></description>
      <category>article</category>
    </item>
    <item>
      <title>ThreatNoir Afternoon Brief — November 13</title>
      <link>https://threatnoir.com/podcast</link>
      <guid isPermaLink="false">2026-11-13-afternoon</guid>
      <pubDate>Fri, 13 Nov 2026 15:00:00 GMT</pubDate>
      <description><![CDATA[The IT security landscape continues to face escalating threats as attackers exploit unpatched systems and newly disclosed vulnerabilities with remarkable speed. Today's afternoon review highlights critical incidents affecting enterprise gateways, Windows systems, Android devices, and remote management platforms, underscoring the persistent risks posed by delayed patching and zero-day exploitation. Unpatched Check Point Security Gateways worldwide have fallen victim to coordinated attacks beginni...]]></description>
      <category>podcast</category>
      <enclosure url="https://cdn.threatnoir.com/podcasts/2026-11-13/threatnoir-afternoon-brief-2026-11-13.mp3" type="audio/mpeg"/>
    </item>
    <item>
      <title>Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now</title>
      <link>https://threatnoir.com/focus</link>
      <guid isPermaLink="false">f15d4dd4-3615-4fc2-9379-91f71a6f2841</guid>
      <pubDate>Fri, 13 Nov 2026 11:18:50 GMT</pubDate>
      <description><![CDATA[Attackers are chaining PHP2Shell (CVE-2026-109618/9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.]]></description>
      <category>focus</category>
    </item>
    <item>
      <title>4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped</title>
      <link>https://threatnoir.com/focus</link>
      <guid isPermaLink="false">51100b02-15cb-401e-813e-320603183fb6</guid>
      <pubDate>Fri, 13 Nov 2026 08:52:08 GMT</pubDate>
      <description><![CDATA[A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.]]></description>
      <category>focus</category>
    </item>
    <item>
      <title>ThreatNoir Morning Brief — November 13</title>
      <link>https://threatnoir.com/podcast</link>
      <guid isPermaLink="false">2026-11-13-morning</guid>
      <pubDate>Fri, 13 Nov 2026 05:00:00 GMT</pubDate>
      <description><![CDATA[The cybersecurity landscape continues to escalate with significant developments spanning nation-state operations, critical infrastructure vulnerabilities, and active zero-day exploitation. Today's briefing covers a major law enforcement action against North Korean threat actors, multiple critical vulnerabilities affecting widely deployed software, and urgent patching requirements across enterprise systems. Federal authorities have successfully seized infrastructure attributed to APT38, a North K...]]></description>
      <category>podcast</category>
      <enclosure url="https://cdn.threatnoir.com/podcasts/2026-11-13/threatnoir-morning-brief-2026-11-13.mp3" type="audio/mpeg"/>
    </item>
    <item>
      <title>Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords</title>
      <link>https://threatnoir.com/focus</link>
      <guid isPermaLink="false">1ae9a01b-70d9-4aa9-a030-0ee9ec72c514</guid>
      <pubDate>Thu, 12 Nov 2026 21:05:33 GMT</pubDate>
      <description><![CDATA[Researchers found that 94.7% of 37,571 apps built with Grok's app builder were publicly accessible without authentication, exposing sensitive data including patient medical records, employee rosters, plain-text passwords, and internal corporate information. The exposure affected organizations ranging from small contractors to Fortune 500 companies. The vulnerability resulted from overly permissive default access settings and the enumeration of app addresses through passive DNS records.]]></description>
      <category>focus</category>
    </item>
    <item>
      <title>ThreatNoir Afternoon Brief — November 12</title>
      <link>https://threatnoir.com/podcast</link>
      <guid isPermaLink="false">2026-11-12-afternoon</guid>
      <pubDate>Thu, 12 Nov 2026 15:00:00 GMT</pubDate>
      <description><![CDATA[Today's threat landscape reflects escalating risks across container infrastructure, software supply chains, and browser environments. Critical vulnerabilities in widely deployed platforms continue to drive urgent patching requirements while active exploitation campaigns demonstrate the speed at which attackers capitalize on security gaps. A critical vulnerability in Red Hat Quay has emerged that permits unauthenticated attackers to take control of container registry token signing. Tracked as CVE...]]></description>
      <category>podcast</category>
      <enclosure url="https://cdn.threatnoir.com/podcasts/2026-11-12/threatnoir-afternoon-brief-2026-11-12.mp3" type="audio/mpeg"/>
    </item>
    <item>
      <title>Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains</title>
      <link>https://threatnoir.com/focus</link>
      <guid isPermaLink="false">ba9b7a9e-b4bf-4806-915e-ba5935d116da</guid>
      <pubDate>Thu, 12 Nov 2026 08:02:16 GMT</pubDate>
      <description><![CDATA[Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.]]></description>
      <category>focus</category>
    </item>
    <item>
      <title>ThreatNoir Morning Brief — November 12</title>
      <link>https://threatnoir.com/podcast</link>
      <guid isPermaLink="false">2026-11-12-morning</guid>
      <pubDate>Thu, 12 Nov 2026 05:00:00 GMT</pubDate>
      <description><![CDATA[Today's threat landscape continues to evolve with multiple critical vulnerabilities and active threat actors demanding immediate attention from security teams. From compromised development platforms to unpatched zero-days, organizations face significant risks that require urgent remediation and defensive measures. A coordinated campaign leveraging compromised GitHub accounts is distributing a CI secret stealer malware across tens of thousands of repositories. The attack exploits stolen credentia...]]></description>
      <category>podcast</category>
      <enclosure url="https://cdn.threatnoir.com/podcasts/2026-11-12/threatnoir-morning-brief-2026-11-12.mp3" type="audio/mpeg"/>
    </item>
    <item>
      <title>ThreatNoir Afternoon Brief — November 11</title>
      <link>https://threatnoir.com/podcast</link>
      <guid isPermaLink="false">2026-11-11-afternoon</guid>
      <pubDate>Wed, 11 Nov 2026 15:00:00 GMT</pubDate>
      <description><![CDATA[The security landscape continues to face significant challenges across multiple fronts this afternoon, with certificate authority failures, AI platform misconfigurations, evolving malware tactics, and active exploitation of critical vulnerabilities dominating the threat environment. Organizations are urged to review their security postures in light of these emerging risks. eMudhra has revoked eight additional intermediate certificate authorities as part of an ongoing response to its October secu...]]></description>
      <category>podcast</category>
      <enclosure url="https://cdn.threatnoir.com/podcasts/2026-11-11/threatnoir-afternoon-brief-2026-11-11.mp3" type="audio/mpeg"/>
    </item>
    <item>
      <title>Weekly Threat Roundup 2026-W45 (2026-11-02 to 2026-11-08)</title>
      <link>https://threatnoir.com/weekly/2026-w45</link>
      <guid isPermaLink="true">https://threatnoir.com/weekly/2026-w45</guid>
      <pubDate>Sun, 08 Nov 2026 06:00:06 GMT</pubDate>
      <description><![CDATA[🔓 OpenSSH 'SSHole' (CVE-2026-123158) was exploited within hours of disclosure, granting root access on Alpine Linux and other musl-based systems — patch immediately. 🤖 The ARTEX AI hacking framework is now a full threat ecosystem: exposed on 1,465 public servers, used to breach South Korean banks, steal Apple code-signing certificates, and compromise WorkOS customer data after a sandbox escape. 🧊 OT security entered the grocery aisle: coordinated cyberattacks on European refrigeration control...]]></description>
      <category>weekly</category>
    </item>
    <item>
      <title>Weekly Threat Roundup 2026-W44 (2026-10-26 to 2026-11-01)</title>
      <link>https://threatnoir.com/weekly/2026-w44</link>
      <guid isPermaLink="true">https://threatnoir.com/weekly/2026-w44</guid>
      <pubDate>Sun, 01 Nov 2026 06:00:04 GMT</pubDate>
      <description><![CDATA[🤖 China's Vapor Panda used an AI pentesting framework to compromise 140 targets in 11 days, marking a new threshold in nation-state automation. 🔑 A single compromised DevOps laptop led to the largest crypto theft in history: $6.3B stolen from Binance, attributed to North Korea. 🧩 Supply chain attacks hit the AI developer ecosystem hard, with a malicious Claude Code extension planting SSH backdoors on up to 5,000 Cursor users. 🚨 CERT-EU issued a wave of critical advisories covering F5, Citrix...]]></description>
      <category>weekly</category>
    </item>
    <item>
      <title>Weekly Threat Roundup 2026-W43 (2026-10-19 to 2026-10-25)</title>
      <link>https://threatnoir.com/weekly/2026-w43</link>
      <guid isPermaLink="true">https://threatnoir.com/weekly/2026-w43</guid>
      <pubDate>Sun, 25 Oct 2026 06:00:01 GMT</pubDate>
      <description><![CDATA[🐚 PHP2Shell dominated the week: CVEs exploited before disclosure, millions of attempts, no confirmed compromises yet, but a third unpatched RCE arrived days later. 🤖 AI-accelerated attacks went mainstream: Storm-0940 used the Artex framework to compromise 300+ Entra tenants; ransomware affiliates deployed autonomous kill-chain agents; an AI agent tried to inject malware into a real GitHub repo. 🔗 Supply chain took two hits: LiteLLM 1.107.0 was backdoored via a leaked master key and served 49,...]]></description>
      <category>weekly</category>
    </item>
    <item>
      <title>Weekly Threat Roundup 2026-W42 (2026-10-12 to 2026-10-18)</title>
      <link>https://threatnoir.com/weekly/2026-w42</link>
      <guid isPermaLink="true">https://threatnoir.com/weekly/2026-w42</guid>
      <pubDate>Sun, 18 Oct 2026 05:00:05 GMT</pubDate>
      <description><![CDATA[🔓 Chinese APT Armory Castle exploited a BeyondTrust zero-day (CVE-2026-102764) since August, deploying custom webshells and credential harvesters across remote support infrastructure. 🏭 A ConnectWise Cloud Backup supply-chain compromise granted attackers admin access to 173 Microsoft 365 tenants by abusing service principals and bypassing MFA. 📡 Citizen Lab's AdFection research confirmed zero-click mercenary spyware delivered via ad networks, targeting Al Jazeera and entities including NATO a...]]></description>
      <category>weekly</category>
    </item>
    <item>
      <title>Weekly Threat Roundup 2026-W41 (2026-10-05 to 2026-10-11)</title>
      <link>https://threatnoir.com/weekly/2026-w41</link>
      <guid isPermaLink="true">https://threatnoir.com/weekly/2026-w41</guid>
      <pubDate>Sun, 11 Oct 2026 05:00:05 GMT</pubDate>
      <description><![CDATA[🔥 Critical vulnerabilities in NetScaler, SonicWall, AhsayCBS, and Atlassian are being actively exploited — patch windows are measured in hours, not days. 🕵️ Flax Typhoon dismantled: FBI seized 7 domains and disrupted MicroScan/FishHub tools linked to China's Integrity Technology Group. 🦠 Midnight Mimosa firmware malware ships preinstalled on budget Android devices across 150+ countries, enabling ad fraud and botnet operations at scale. 🤖 AI becomes both weapon and wildcard: ARTEX used agains...]]></description>
      <category>weekly</category>
    </item>
  </channel>
</rss>