{
  "schema_version": 3,
  "report_contract_version": 5,
  "report_plan": {
    "control_implications": [
      {
        "control_id": "access_management",
        "evidence_excerpt": "Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests…",
        "evidence_origin": "summary",
        "focus": "Authenticator app for Android",
        "priority": "medium",
        "source_ids": [
          1
        ]
      },
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory…",
        "evidence_origin": "summary",
        "focus": "recently patched PHP2Shell flaws",
        "priority": "high",
        "source_ids": [
          2
        ]
      },
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more…",
        "evidence_origin": "summary",
        "focus": "almost a dozen security vulnerabilities",
        "priority": "high",
        "source_ids": [
          4
        ]
      },
      {
        "control_id": "third_party_risk",
        "evidence_excerpt": "An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve…",
        "evidence_origin": "summary",
        "focus": "its hardware wallets",
        "priority": "medium",
        "source_ids": [
          6
        ]
      },
      {
        "control_id": "incident_response",
        "evidence_excerpt": "A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. \"The next steps that we took were to disconnect that Amadey controller from all those…",
        "evidence_origin": "summary",
        "focus": "criminal's operation's backend",
        "priority": "medium",
        "source_ids": [
          10
        ]
      },
      {
        "control_id": "data_protection",
        "evidence_excerpt": "French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners…",
        "evidence_origin": "summary",
        "focus": "French energy giant ENGIE",
        "priority": "high",
        "source_ids": [
          11
        ]
      }
    ],
    "executive_brief": {
      "decision_frame": "separate",
      "source_ids": [
        1,
        2,
        6
      ]
    },
    "industry_impacts": [],
    "regulatory_changes": []
  },
  "generated_at": "2026-10-27T18:21:33.936743Z",
  "feed_url": "https://ricomanifesto.github.io/SentryDigest/feed.xml",
  "feed_home_url": "https://ricomanifesto.github.io/SentryDigest/",
  "digest_issue_date": "2026-10-27",
  "digest_issue_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/",
  "requested_model": "openrouter/nvidia/nemotron-3-ultra-550b-a55b:free",
  "resolved_model": "nvidia/nemotron-3-ultra-550b-a55b:free",
  "sources": [
    {
      "title": "Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens",
      "url": "https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-b7d7e51c85e3",
      "cves": [
        "CVE-2026-80097"
      ],
      "snippet": "Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests… Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft trac",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests…",
          "text": "Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests…",
          "text": "Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution",
      "url": "https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-dc98d41511a1",
      "cves": [
        "CVE-2026-109618"
      ],
      "snippet": "CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory… The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The P",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory…",
          "text": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory…",
          "text": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw",
      "url": "https://thehackernews.com/2026/10/php-issues-second-windows-security.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-c85198bbddef",
      "cves": [
        "CVE-2026-111497"
      ],
      "snippet": "PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but… PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potential",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but…",
          "text": "PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but…",
          "text": "PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Tailscale warns of SSH flaws allowing root privilege escalation",
      "url": "https://www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-3fbb6d8c3278",
      "cves": [],
      "snippet": "Tailscale warns of SSH flaws allowing root privilege escalation The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more… The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more…",
          "text": "The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more…",
          "text": "The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest",
      "url": "https://www.bleepingcomputer.com/news/security/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-11f0e618d025",
      "cves": [],
      "snippet": "The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks… Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention ",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks…",
          "text": "Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks…",
          "text": "Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key",
      "url": "https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-c4255691bc04",
      "cves": [],
      "snippet": "Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve… An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit device",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve…",
          "text": "An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve…",
          "text": "An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "AI-Generated Fake Login Pages Are Making Account Takeovers Easier",
      "url": "https://thehackernews.com/2026/10/ai-generated-fake-login-pages-are.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-ee7d5cd794be",
      "cves": [],
      "snippet": "AI-Generated Fake Login Pages Are Making Account Takeovers Easier Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain… Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizat",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain…",
          "text": "Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain…",
          "text": "Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption",
      "url": "https://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-b434e7ad4a7b",
      "cves": [],
      "snippet": "Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up… The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and w",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up…",
          "text": "The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up…",
          "text": "The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Apple backports CoreGraphics zero-day patches to older iPhones",
      "url": "https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-a40721cff07a",
      "cves": [],
      "snippet": "Apple backports CoreGraphics zero-day patches to older iPhones ​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in \"extremely sophisticated\" targeted attacks on iOS devices… ​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in \"extremely sophisticated\" targeted attacks on iOS devices…",
      "article_evidence": [],
      "effective_date_evidence": null
    },
    {
      "title": "Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers",
      "url": "https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-eae2a3c7c621",
      "cves": [],
      "snippet": "Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. \"The next steps that we took were to disconnect that Amadey controller from all those… A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's oper",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. \"The next steps that we took were to disconnect that Amadey controller from all those…",
          "text": "A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. \"The next steps that we took were to disconnect that Amadey controller from all those…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. \"The next steps that we took were to disconnect that Amadey controller from all those…",
          "text": "A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. \"The next steps that we took were to disconnect that Amadey controller from all those…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Energy giant ENGIE discloses data breach affecting customers",
      "url": "https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-92e4740105c8",
      "cves": [],
      "snippet": "Energy giant ENGIE discloses data breach affecting customers French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners… French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners…",
          "text": "French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners…",
          "text": "French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections",
      "url": "https://thehackernews.com/2026/10/openai-compaction-flaw-let-researchers.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-27/#reporting-c6fd9c70afae",
      "cves": [],
      "snippet": "OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past… OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answ",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past…",
          "text": "OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past…",
          "text": "OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past…"
        }
      ],
      "effective_date_evidence": null
    }
  ]
}