AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
18 Aug 2026, 7:30 PM	The Hacker News	6.5	One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025 Research by agent security platform Reco identifies a single server (158.220.87.79 on a Contabo VPS in Germany) that has been scraping Salesforce Experience Cloud and ServiceNow Service Portal sites since at least March 2025, targeting telecoms, banks, enterprise software vendors, and public sector portals. The attacker uses a compiled Go program (fingerprinted via net/http default user agent) that goes beyond known Aura guest-access abuse by also hitting Salesforce's Lightning Web Runtime UI-API across versions v56.0–v66.0 and an undocumented ServiceNow endpoint POST /api/now/sp/search. One target logged over 560,000 events from the same IP. Why: If your organization runs a Salesforce Experience Cloud site or ServiceNow Service Portal with a public-facing guest user, audit that guest profile's object and field permissions now—Reco's findings show the guest identity is the common exploit vector across all techniques, and it can only be restricted, not deleted. Malaysian banks, telecoms, and government portals are in the target profile, so local teams using these platforms should verify guest access is scoped to only what the public site actually needs. security salesforce servicenow guest-access data-scraping

Date

Provider

Score

Summary

18 Aug 2026, 7:30 PM

The Hacker News

6.5

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

Research by agent security platform Reco identifies a single server (158.220.87.79 on a Contabo VPS in Germany) that has been scraping Salesforce Experience Cloud and ServiceNow Service Portal sites since at least March 2025, targeting telecoms, banks, enterprise software vendors, and public sector portals. The attacker uses a compiled Go program (fingerprinted via net/http default user agent) that goes beyond known Aura guest-access abuse by also hitting Salesforce's Lightning Web Runtime UI-API across versions v56.0–v66.0 and an undocumented ServiceNow endpoint POST /api/now/sp/search. One target logged over 560,000 events from the same IP.

Why: If your organization runs a Salesforce Experience Cloud site or ServiceNow Service Portal with a public-facing guest user, audit that guest profile's object and field permissions now—Reco's findings show the guest identity is the common exploit vector across all techniques, and it can only be restricted, not deleted. Malaysian banks, telecoms, and government portals are in the target profile, so local teams using these platforms should verify guest access is scoped to only what the public site actually needs.