<?xml version="1.0" encoding="UTF-8" standalone="no"?><rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" version="2.0">

<channel>
	<title>Unit 42</title>
	<atom:link href="https://unit42.paloaltonetworks.com/feed/?v=2" rel="self" type="application/rss+xml"/>
	<link>https://unit42.paloaltonetworks.com/</link>
	<description>Palo Alto Networks</description>
	<lastBuildDate>Tue, 20 Oct 2026 20:35:17 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.1.2</generator>

<image>
	<url>https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-Unit42-180x180-1.png</url>
	<title>Unit 42</title>
	<link>https://unit42.paloaltonetworks.com/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<itunes:explicit>no</itunes:explicit><itunes:subtitle>Palo Alto Networks</itunes:subtitle><item>
		<title>Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)</title>
		<link>https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/</link>
		
		<dc:creator><![CDATA[Andy Piazza and Unit 42]]></dc:creator>
		<pubDate>Tue, 20 Oct 2026 20:30:42 +0000</pubDate>
				<category><![CDATA[High Profile Threats]]></category>
		<category><![CDATA[Vulnerabilities]]></category>
		<category><![CDATA[CVE-2026-0257]]></category>
		<category><![CDATA[vulnerability]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=182026</guid>

					<description><![CDATA[<p>Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/">Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>5</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-300x300.jpg</featuredImage>
		<dcterms:extent>5</dcterms:extent>
		<enclosure length="1486607" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900.jpg"/>
			<itunes:explicit/><itunes:subtitle>Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42.</itunes:subtitle><itunes:summary>Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42.</itunes:summary><itunes:keywords>High Profile Threats, Vulnerabilities, CVE-2026-0257, vulnerability</itunes:keywords></item>
		<item>
		<title>Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026</title>
		<link>https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/</link>
		
		<dc:creator><![CDATA[Unit 42]]></dc:creator>
		<pubDate>Fri, 16 Oct 2026 17:47:54 +0000</pubDate>
				<category><![CDATA[General]]></category>
		<category><![CDATA[Insights]]></category>
		<category><![CDATA[Trend Reports]]></category>
		<category><![CDATA[Initial Access]]></category>
		<category><![CDATA[threat intelligence]]></category>
		<category><![CDATA[trends]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=188674</guid>

					<description><![CDATA[<p>Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/">Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>2</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Myth-Busting_Overview_1920x900-300x300.jpg</featuredImage>
		<dcterms:extent>2</dcterms:extent>
		<enclosure length="938745" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Myth-Busting_Overview_1920x900.jpg"/>
			<itunes:explicit/><itunes:subtitle>Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.</itunes:subtitle><itunes:summary>Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.</itunes:summary><itunes:keywords>General, Insights, Trend Reports, Initial Access, threat intelligence, trends</itunes:keywords></item>
		<item>
		<title>AI-Powered Espionage Campaign Targets Government Linux Infrastructure</title>
		<link>https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/</link>
		
		<dc:creator><![CDATA[Roey Porat and Tom Fakterman]]></dc:creator>
		<pubDate>Thu, 15 Oct 2026 22:00:09 +0000</pubDate>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[exfiltration]]></category>
		<category><![CDATA[LLM]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[payload]]></category>
		<category><![CDATA[Python]]></category>
		<category><![CDATA[Remote Access Trojan]]></category>
		<category><![CDATA[reverse shells]]></category>
		<category><![CDATA[web shells]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=188392</guid>

					<description><![CDATA[<p>Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/">AI-Powered Espionage Campaign Targets Government Linux Infrastructure</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>18</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734-300x300.jpg</featuredImage>
		<dcterms:extent>18</dcterms:extent>
		<enclosure length="1703786" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734.jpg"/>
			<itunes:explicit/><itunes:subtitle>Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft. The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure appeared first on Unit 42.</itunes:subtitle><itunes:summary>Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft. The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure appeared first on Unit 42.</itunes:summary><itunes:keywords>Malware, Threat Research, exfiltration, LLM, network security, payload, Python, Remote Access Trojan, reverse shells, web shells</itunes:keywords></item>
		<item>
		<title>Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant</title>
		<link>https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/</link>
		
		<dc:creator><![CDATA[Daniel Gott and Shawn Westfall]]></dc:creator>
		<pubDate>Wed, 14 Oct 2026 22:00:44 +0000</pubDate>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Apache]]></category>
		<category><![CDATA[CL-STA-0954]]></category>
		<category><![CDATA[logging]]></category>
		<category><![CDATA[network intrusion]]></category>
		<category><![CDATA[Network Sniffer]]></category>
		<category><![CDATA[payload]]></category>
		<category><![CDATA[reverse shells]]></category>
		<category><![CDATA[VPN]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=188095</guid>

					<description><![CDATA[<p>We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/">Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>14</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/09_Vulnerabilities_1920x900-300x300.jpg</featuredImage>
		<dcterms:extent>14</dcterms:extent>
		<enclosure length="983065" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/09_Vulnerabilities_1920x900.jpg"/>
			<itunes:explicit/><itunes:subtitle>We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.</itunes:subtitle><itunes:summary>We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.</itunes:summary><itunes:keywords>Malware, Threat Research, Apache, CL-STA-0954, logging, network intrusion, Network Sniffer, payload, reverse shells, VPN</itunes:keywords></item>
		<item>
		<title>The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk</title>
		<link>https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/</link>
		
		<dc:creator><![CDATA[Antonio Diaz and Ruben Castillo]]></dc:creator>
		<pubDate>Tue, 13 Oct 2026 22:00:04 +0000</pubDate>
				<category><![CDATA[Anatomy of an Attack]]></category>
		<category><![CDATA[Insights]]></category>
		<category><![CDATA[credential-based attacks]]></category>
		<category><![CDATA[incident response]]></category>
		<category><![CDATA[Reconnaissance]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=188247</guid>

					<description><![CDATA[<p>Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/">The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>3</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/07_Listicle_Category_1505x922-300x300.jpg</featuredImage>
		<dcterms:extent>3</dcterms:extent>
		<enclosure length="831759" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/07_Listicle_Category_1505x922.jpg"/>
			<itunes:explicit/><itunes:subtitle>Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats. The post The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk appeared first on Unit 42.</itunes:subtitle><itunes:summary>Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats. The post The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk appeared first on Unit 42.</itunes:summary><itunes:keywords>Anatomy of an Attack, Insights, credential-based attacks, incident response, Reconnaissance</itunes:keywords></item>
		<item>
		<title>Evolution of Web3 in Cloud Supply Chain Attacks</title>
		<link>https://unit42.paloaltonetworks.com/web3-cloud-supply-chain-attacks/</link>
		
		<dc:creator><![CDATA[Eyal Rafian]]></dc:creator>
		<pubDate>Wed, 07 Oct 2026 22:00:16 +0000</pubDate>
				<category><![CDATA[General]]></category>
		<category><![CDATA[Insights]]></category>
		<category><![CDATA[cloud configuration]]></category>
		<category><![CDATA[DPRK]]></category>
		<category><![CDATA[supply-chain attack]]></category>
		<category><![CDATA[Web3]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=187943</guid>

					<description><![CDATA[<p>Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/web3-cloud-supply-chain-attacks/">Evolution of Web3 in Cloud Supply Chain Attacks</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>8</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/10_Myth-Busting_Category_1505x922-300x300.jpg</featuredImage>
		<dcterms:extent>8</dcterms:extent>
		<enclosure length="740138" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/10_Myth-Busting_Category_1505x922.jpg"/>
			<itunes:explicit/><itunes:subtitle>Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42.</itunes:subtitle><itunes:summary>Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42.</itunes:summary><itunes:keywords>General, Insights, cloud configuration, DPRK, supply-chain attack, Web3</itunes:keywords></item>
		<item>
		<title>Blinder Tunnel Campaign Targets Iraqi Infrastructure</title>
		<link>https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/</link>
		
		<dc:creator><![CDATA[Unit 42]]></dc:creator>
		<pubDate>Tue, 06 Oct 2026 10:00:33 +0000</pubDate>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Advanced Persistent Threat]]></category>
		<category><![CDATA[Agent Serpens]]></category>
		<category><![CDATA[AppDomainManager]]></category>
		<category><![CDATA[GitHub]]></category>
		<category><![CDATA[Iran]]></category>
		<category><![CDATA[payload]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=187630</guid>

					<description><![CDATA[<p>Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/">Blinder Tunnel Campaign Targets Iraqi Infrastructure</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>23</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/05_Malware_Category_1920x900-1-300x300.jpg</featuredImage>
		<dcterms:extent>23</dcterms:extent>
		<enclosure length="611893" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/05_Malware_Category_1920x900-1.jpg"/>
			<itunes:explicit/><itunes:subtitle>Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.</itunes:subtitle><itunes:summary>Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.</itunes:summary><itunes:keywords>Malware, Threat Research, Advanced Persistent Threat, Agent Serpens, AppDomainManager, GitHub, Iran, payload</itunes:keywords></item>
		<item>
		<title>Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)</title>
		<link>https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/</link>
		
		<dc:creator><![CDATA[Unit 42]]></dc:creator>
		<pubDate>Wed, 30 Sep 2026 20:00:04 +0000</pubDate>
				<category><![CDATA[High Profile Threats]]></category>
		<category><![CDATA[Vulnerabilities]]></category>
		<category><![CDATA[Citrix]]></category>
		<category><![CDATA[CVE-2026-88771]]></category>
		<category><![CDATA[CVE-2026-88772]]></category>
		<category><![CDATA[denial of service]]></category>
		<category><![CDATA[Remote Code Execution]]></category>
		<category><![CDATA[zero-day]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=187874</guid>

					<description><![CDATA[<p>Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. </p>
<p>The post <a href="https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/">Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>9</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/06_Vulnerabilities_1920x900-5-300x300.jpg</featuredImage>
		<dcterms:extent>9</dcterms:extent>
		<enclosure length="1645038" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/06_Vulnerabilities_1920x900-5.jpg"/>
			<itunes:explicit/><itunes:subtitle>Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) appeared first on Unit 42.</itunes:subtitle><itunes:summary>Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) appeared first on Unit 42.</itunes:summary><itunes:keywords>High Profile Threats, Vulnerabilities, Citrix, CVE-2026-88771, CVE-2026-88772, denial of service, Remote Code Execution, zero-day</itunes:keywords></item>
		<item>
		<title>OperTraitors: How Kubernetes Operators Betray Your Security Posture</title>
		<link>https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/</link>
		
		<dc:creator><![CDATA[Lior Yakim]]></dc:creator>
		<pubDate>Tue, 29 Sep 2026 10:00:48 +0000</pubDate>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[AI]]></category>
		<category><![CDATA[AI agents]]></category>
		<category><![CDATA[API]]></category>
		<category><![CDATA[GitHub]]></category>
		<category><![CDATA[identity]]></category>
		<category><![CDATA[Vulnerabilities]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=187565</guid>

					<description><![CDATA[<p>We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/">OperTraitors: How Kubernetes Operators Betray Your Security Posture</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>8</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_652069707-1-300x300.jpg</featuredImage>
		<dcterms:extent>8</dcterms:extent>
		<enclosure length="1523818" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_652069707-1.jpg"/>
			<itunes:explicit/><itunes:subtitle>We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities. The post OperTraitors: How Kubernetes Operators Betray Your Security Posture appeared first on Unit 42.</itunes:subtitle><itunes:summary>We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities. The post OperTraitors: How Kubernetes Operators Betray Your Security Posture appeared first on Unit 42.</itunes:summary><itunes:keywords>Malware, Threat Research, AI, AI agents, API, GitHub, identity, Vulnerabilities</itunes:keywords></item>
		<item>
		<title>3 Consulting Myths Debunked by Unit 42 Experts</title>
		<link>https://unit42.paloaltonetworks.com/3-consulting-myths-debunked-by-unit-42-experts/</link>
		
		<dc:creator><![CDATA[Unit 42]]></dc:creator>
		<pubDate>Fri, 25 Sep 2026 23:00:28 +0000</pubDate>
				<category><![CDATA[Insights]]></category>
		<category><![CDATA[Myth Busting]]></category>
		<category><![CDATA[AI]]></category>
		<category><![CDATA[privilege escalation]]></category>
		<category><![CDATA[Unit 42 Incident Response Report]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=187627</guid>

					<description><![CDATA[<p>Unit 42 security experts address critical cybersecurity misconceptions, offering practical insights to help your organization reinforce its enterprise defenses.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/3-consulting-myths-debunked-by-unit-42-experts/">3 Consulting Myths Debunked by Unit 42 Experts</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>4</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/01_Listicle_Category_1505x922-300x300.jpg</featuredImage>
		<dcterms:extent>4</dcterms:extent>
		<enclosure length="547369" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/01_Listicle_Category_1505x922.jpg"/>
			<itunes:explicit/><itunes:subtitle>Unit 42 security experts address critical cybersecurity misconceptions, offering practical insights to help your organization reinforce its enterprise defenses. The post 3 Consulting Myths Debunked by Unit 42 Experts appeared first on Unit 42.</itunes:subtitle><itunes:summary>Unit 42 security experts address critical cybersecurity misconceptions, offering practical insights to help your organization reinforce its enterprise defenses. The post 3 Consulting Myths Debunked by Unit 42 Experts appeared first on Unit 42.</itunes:summary><itunes:keywords>Insights, Myth Busting, AI, privilege escalation, Unit 42 Incident Response Report</itunes:keywords></item>
		<item>
		<title>From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies</title>
		<link>https://unit42.paloaltonetworks.com/detecting-exposed-aws-iam-credentials/</link>
		
		<dc:creator><![CDATA[Margaret Kelley]]></dc:creator>
		<pubDate>Mon, 21 Sep 2026 10:00:13 +0000</pubDate>
				<category><![CDATA[Cloud Cybersecurity Research]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[AWS]]></category>
		<category><![CDATA[AWS CloudTrail]]></category>
		<category><![CDATA[bedrock]]></category>
		<category><![CDATA[cloud compute]]></category>
		<category><![CDATA[GitHub]]></category>
		<category><![CDATA[JSON]]></category>
		<category><![CDATA[logging]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=186917</guid>

					<description><![CDATA[<p>We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail monitoring strategies.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/detecting-exposed-aws-iam-credentials/">From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>14</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Cloud_cybersecurity_research_Overview_1920x900-300x300.jpg</featuredImage>
		<dcterms:extent>14</dcterms:extent>
		<enclosure length="1339704" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Cloud_cybersecurity_research_Overview_1920x900.jpg"/>
			<itunes:explicit/><itunes:subtitle>We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail monitoring strategies. The post From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies appeared first on Unit 42.</itunes:subtitle><itunes:summary>We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail monitoring strategies. The post From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies appeared first on Unit 42.</itunes:summary><itunes:keywords>Cloud Cybersecurity Research, Threat Research, AWS, AWS CloudTrail, bedrock, cloud compute, GitHub, JSON, logging</itunes:keywords></item>
		<item>
		<title>A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity</title>
		<link>https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/</link>
		
		<dc:creator><![CDATA[Niv Rabin]]></dc:creator>
		<pubDate>Fri, 18 Sep 2026 10:00:36 +0000</pubDate>
				<category><![CDATA[Cloud Cybersecurity Research]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Agentic AI]]></category>
		<category><![CDATA[AWS]]></category>
		<category><![CDATA[Cloud]]></category>
		<category><![CDATA[exfiltration]]></category>
		<category><![CDATA[IAM]]></category>
		<category><![CDATA[Sandbox]]></category>
		<category><![CDATA[shell tool]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=187347</guid>

					<description><![CDATA[<p>Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure your agents.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/">A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>16</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/03_Cloud_cybersecurity_research_Overview_1920x900-300x300.jpg</featuredImage>
		<dcterms:extent>16</dcterms:extent>
		<enclosure length="1441564" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/03_Cloud_cybersecurity_research_Overview_1920x900.jpg"/>
			<itunes:explicit/><itunes:subtitle>Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure your agents. The post A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity appeared first on Unit 42.</itunes:subtitle><itunes:summary>Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure your agents. The post A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity appeared first on Unit 42.</itunes:summary><itunes:keywords>Cloud Cybersecurity Research, Threat Research, Agentic AI, AWS, Cloud, exfiltration, IAM, Sandbox, shell tool</itunes:keywords></item>
		<item>
		<title>Inside the Modern SOC: Defending the Cross-Environment Pivot</title>
		<link>https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/</link>
		
		<dc:creator><![CDATA[Sharon Maydar]]></dc:creator>
		<pubDate>Thu, 17 Sep 2026 22:00:33 +0000</pubDate>
				<category><![CDATA[Inside the Modern SOC]]></category>
		<category><![CDATA[Insights]]></category>
		<category><![CDATA[AI]]></category>
		<category><![CDATA[attack surface]]></category>
		<category><![CDATA[Unit 42 Incident Response Report]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=187343</guid>

					<description><![CDATA[<p>Cross-environment attacks demand a new approach to security operations. Learn how Unit 42 Managed XSIAM helps SOC teams investigate complete attack paths.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/">Inside the Modern SOC: Defending the Cross-Environment Pivot</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>3</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/01_Myth-Busting_Overview_1920x900_Resized-300x300.jpg</featuredImage>
		<dcterms:extent>3</dcterms:extent>
		<enclosure length="1518417" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/01_Myth-Busting_Overview_1920x900_Resized.jpg"/>
			<itunes:explicit/><itunes:subtitle>Cross-environment attacks demand a new approach to security operations. Learn how Unit 42 Managed XSIAM helps SOC teams investigate complete attack paths. The post Inside the Modern SOC: Defending the Cross-Environment Pivot appeared first on Unit 42.</itunes:subtitle><itunes:summary>Cross-environment attacks demand a new approach to security operations. Learn how Unit 42 Managed XSIAM helps SOC teams investigate complete attack paths. The post Inside the Modern SOC: Defending the Cross-Environment Pivot appeared first on Unit 42.</itunes:summary><itunes:keywords>Inside the Modern SOC, Insights, AI, attack surface, Unit 42 Incident Response Report</itunes:keywords></item>
		<item>
		<title>Atomic macOS (AMOS) Stealer Activity</title>
		<link>https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/</link>
		
		<dc:creator><![CDATA[Bradley Duncan]]></dc:creator>
		<pubDate>Wed, 16 Sep 2026 10:00:06 +0000</pubDate>
				<category><![CDATA[General]]></category>
		<category><![CDATA[Insights]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[macOS]]></category>
		<category><![CDATA[threat intelligence]]></category>
		<category><![CDATA[Unit 42]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=187032</guid>

					<description><![CDATA[<p>Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/">Atomic macOS (AMOS) Stealer Activity</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>7</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-300x300.jpg</featuredImage>
		<dcterms:extent>7</dcterms:extent>
		<enclosure length="1173612" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900.jpg"/>
			<itunes:explicit/><itunes:subtitle>Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42.</itunes:subtitle><itunes:summary>Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42.</itunes:summary><itunes:keywords>General, Insights, Malware, macOS, threat intelligence, Unit 42</itunes:keywords></item>
		<item>
		<title>Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection</title>
		<link>https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/</link>
		
		<dc:creator><![CDATA[Osher Jacob]]></dc:creator>
		<pubDate>Mon, 14 Sep 2026 10:00:01 +0000</pubDate>
				<category><![CDATA[Cloud Cybersecurity Research]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[AWS CloudTrail]]></category>
		<category><![CDATA[cloud detection]]></category>
		<category><![CDATA[DevOps]]></category>
		<category><![CDATA[IAM]]></category>
		<category><![CDATA[SQL]]></category>
		<guid isPermaLink="false">https://unit42.paloaltonetworks.com/?p=186821</guid>

					<description><![CDATA[<p>We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries.</p>
<p>The post <a href="https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/">Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection</a> appeared first on <a href="https://unit42.paloaltonetworks.com">Unit 42</a>.</p>
]]></description>
		
		
		
		<readTime>12</readTime>
		<featuredImage>https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Cloud_cybersecurity_research_Overview_1920x900-2-300x300.jpg</featuredImage>
		<dcterms:extent>12</dcterms:extent>
		<enclosure length="1163529" type="image/jpeg" url="https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Cloud_cybersecurity_research_Overview_1920x900-2.jpg"/>
			<itunes:explicit/><itunes:subtitle>We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42.</itunes:subtitle><itunes:summary>We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42.</itunes:summary><itunes:keywords>Cloud Cybersecurity Research, Threat Research, AWS CloudTrail, cloud detection, DevOps, IAM, SQL</itunes:keywords></item>
	</channel>
</rss>