<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:news="http://www.google.com/schemas/sitemap-news/0.9"><url><loc>https://sandboxgazette.com/c/malware/arrest-of-ransomware-negotiator-highlights-vendor/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-16T15:49:12Z</news:publication_date><news:title>Arrest of Ransomware Negotiator Highlights Vendor Oversight Gaps</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/cyber-attacks/openai-models-bypassed-auth-on-gov-site-and-spent/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-16T10:50:13Z</news:publication_date><news:title>OpenAI Models Bypassed Auth on Gov Site and Spent Crypto to Finish Tasks</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/malware/how-ghostbat-android-malware-captures-pins-via/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-16T08:13:04Z</news:publication_date><news:title>How GhostBat Android Malware Captures PINs via Accessibility Service Abuse</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/cyber-attacks/how-long-back-does-the-uk-legal-aid-agency-data/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-16T00:44:59Z</news:publication_date><news:title>How Long Back Does the UK Legal Aid Agency Data Breach Reach?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/malware/zero-click-spyware-delivered-via-online-ads/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-15T23:29:42Z</news:publication_date><news:title>Zero-Click Spyware Delivered via Online Ads Targets Al Jazeera Devices</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/vulnerabilities/does-windows-11-remote-desktop-break-after-recent/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-15T16:28:33Z</news:publication_date><news:title>Does Windows 11 Remote Desktop Break After Recent Security Updates?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/vulnerabilities/which-wordpress-sites-are-at-risk-due-to-high/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-15T15:36:20Z</news:publication_date><news:title>Which WordPress Sites Are at Risk Due to High-Severity SQLi in CP Multi View Calendar?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/malware/how-does-adfection-deliver-zero-click-spyware-via/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-15T10:14:28Z</news:publication_date><news:title>How does AdFection deliver zero-click spyware via online ads?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/vulnerabilities/how-does-crafted-next-token-in-aws-healthlake-mcp/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-15T05:13:30Z</news:publication_date><news:title>How does crafted next_token in AWS HealthLake MCP Server expose credentials before 0.0.14?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/vulnerabilities/can-world-readable-nonce-leak-in-10web-booster/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-15T04:36:41Z</news:publication_date><news:title>Can world-readable nonce leak in 10Web Booster allow unauthenticated code execution on WordPress?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/vulnerabilities/does-fortisandbox-hard-coded-key-allow/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-15T02:48:58Z</news:publication_date><news:title>Does FortiSandbox Hard-Coded Key Allow Unauthenticated API Access?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/malware/are-manufacturing-ot-systems-the-new-ransomware/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-15T01:42:10Z</news:publication_date><news:title>Are manufacturing OT systems the new ransomware target?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/vulnerabilities/does-cve-2026-0314-allow-local-users-to-crash/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-14T20:39:17Z</news:publication_date><news:title>Does CVE-2026-0314 Allow Local Users to Crash Windows GlobalProtect Clients?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/vulnerabilities/how-does-critical-juniper-j-web-flaw-allow-full/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-14T18:46:21Z</news:publication_date><news:title>How does critical Juniper J-Web flaw allow full device control without credentials?</news:title></news:news></url></urlset>