malware.news

https://malware.news

Discourse forum auto-syndicating multiple vendor security-research RSS feeds verbatim (added 2026-08-19 as this run's single new candidate). Value is as a RECOVERY TRANSPORT, not an original source: wordfence.com refuses every transport available to this pipeline (WebFetch returns an empty body, the direct bridge an HTTP 202 anti-bot challenge shell, and the reader pool is credit-exhausted), and this host reproduces Wordfence Intelligence posts in full, mechanism text, researcher credit, bounty amount and disclosure timeline. Verified this run character-for-character against the CVE descriptions Wordfence supplied as CNA for CVE-2026-15748 and CVE-2026-15826. FETCH -> webfetch the per-topic /t/<slug>/<id> URL. CAUTION: the forum interleaves its own affiliate-marketing text into syndicated posts, so quote only from the syndicated body. Aggregator/mirror, so reliability C and never a substitute for the originating publisher when that publisher is reachable. Promote to active after 3 contributing runs. | 2026-09-22 intel run: promoted candidate -> active per tools/run_summary.py sources.promotion_due (3 contributing runs, 2026-09-21T0410Z-intel among them). | 2026-09-29: content check flagged the homepage as a JS shell (Discourse Ember app; extract 528 B). Working recipe: python3 tools/fetch_source.py feed https://malware.news/latest.rss 15 (native Discourse RSS, 15 items, newest same day, direct transport, no reader needed), then extract <item /t/<slug>/<id> link> for the full syndicated body. Category-scoped feeds: /c/news.rss, /c/malwareanalysis.rss. fetch_method webfetch -> rss. (2026-09-29T2134Z-audit)