The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 1 to 36 of 240 briefings

Today

Threat Intel26 Oct 2026

Kali Linux 2026.3 adds six tools and kernel 7.1.5; Kali's pages list all six only under the 'everything' set

What Kali's 2026.3 post states and leaves out: six tools listed only under the everything metapackage, a screenshot dated 24 September, images built 9 October, and how Kali says to verify a download.

Threat Intel26 Oct 2026

Fortinet says critical and high severity fixes are out for five product lines, with advisories held to 10 November

What Fortinet's announcement, change logs and policy establish about its hardening release: the 17 fixed versions, the 19 day gap, what the release notes list, and the upgrade steps to take before the advisories arrive.

Threat Intel26 Oct 2026

Dutch police say a caller's app relayed victims' card chip data to an accomplice: 170 victims, about 380,000 euros

What the Dutch police release states about the NFC card scan fraud, what it leaves out, the arithmetic behind 380,000 euros and 170 victims, where SecurityWeek differs from the primary, how NFC relay works at defender level, and a ranked checklist for customers and bank fraud teams.

Threat Intel26 Oct 2026

Researcher reports 35 Apache shell starts on three PHP2Shell honeypots running PHP 8.4.26, three days after the fix

What the honeypot report establishes about PHP2Shell exploitation and what it does not, the claims retracted before it, the fixed versions, defender detections as printed, and a ranked checklist.

Yesterday

Threat Intel25 Oct 2026

Tailworm claims 11 flaws in Tailscale and headscale: no CVE or fixed release, 18 code changes merged

What the Tailworm report, Tailscale, headscale and their repositories print about eleven claimed flaws: the chain at defender level, the dated record, the friendly names, the technical artifacts and a ranked checklist.

Threat Intel25 Oct 2026

CISA lists shared hardcoded root CA key and missing authorization flaw in Moxa AIG-302 gateways

CISA's advisory ICSA-26-293-03 lists two Moxa AIG-302 flaws fixed in firmware 1.4.1: a shared hardcoded root CA private key (CVSS 4.0 8.6) and a missing authorization check (6.9). Adjacent network access is required.

Threat Intel25 Oct 2026

Ruby Onigmo briefing withdrawn: it misstated who assigned the CVEs, GitLab's fix dates and the defender advice

Why this Ruby Onigmo briefing was withdrawn and what Ruby's post and GitLab's patch releases say.

Threat Intel25 Oct 2026

Linux kernel maintainers scramble after KSMBD remote execution flaws leak to LKML

Dual CVSS 9.0 remote code execution vulnerabilities in the Linux kernel in-tree SMB server KSMBD leaked to public mailing lists, exposing hosts to pre-auth protocol confusion and heap memory corruption.

Threat Intel25 Oct 2026

Cisco patches maximum-severity root remote code execution in Expressway Series

Cisco discloses CVE-2026-76466, a critical CVSS 9.8 remote code execution flaw in Expressway-C and Expressway-E clustered database services allowing unauthenticated root OS control with no workarounds.

Saturday 24 October

Threat Intel24 Oct 2026

Postiz fixes three critical file-read and token-forgery flaws across two releases

A version-by-version guide to three Postiz CVEs, the file and token trust boundaries they break, and what operators should check.

Threat Intel24 Oct 2026

Third PHP flaw briefing withdrawn: it duplicated another briefing and invented scores, versions and a mechanism

Why this briefing on the third PHP2Shell flaw was withdrawn and where the corrected account is.

Threat Intel24 Oct 2026

Operation IXIM: Eye Security says it served over 2 million updates that disabled an abandoned Popcorn Time updater

What Eye Security reported at Hack.lu on 22 October 2026 about Operation IXIM: how it found the abandoned Time4Popcorn updater (CVE-2026-30612), what its update did and did not do, why a download count is not a device count, and what defenders should check.

Page 2

Saturday 24 October

Threat Intel24 Oct 2026

Collabora CODE CVSS 9.2 command injection added to CISA KEV

Technical autopsy of Nextcloud Collabora Online Built-in CODE Server CVE-2026-110447: CVSS 9.2 command injection in proxy.php, three-day CISA KEV remediation order, webshell deployment, and password vault scraping.

Threat Intel24 Oct 2026

Kaspersky says BlackX bootkit, similar to BlackLotus, bypassed Secure Boot on patched PCs without PCA 2011 revocation

What Kaspersky GReAT reports about BlackX, a UEFI bootkit that exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys on fully patched Windows machines, what it does not state, and which Microsoft revocation steps defenders have to run themselves.

Friday 23 October

Threat Intel23 Oct 2026

CISA adds Plex2Shell unauthenticated RCE chain to Known Exploited Vulnerabilities catalog

Technical autopsy of the Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656): loopback token theft, x264 dump-yuv carrier video writes, unsigned codec dlopen execution, and CISA KEV listing.

Threat Intel23 Oct 2026

GitLab issues emergency patches for maximum severity CVSS 10.0 integer overflow RCE

Technical breakdown of GitLab emergency release: CVSS 10.0 integer overflow CVE-2026-110264, Ruby Onigmo regex compiler heap corruption, 4,535-day exposure window, and seven-train backport matrix.

Threat Intel23 Oct 2026

Microsoft says Storm-0940 used ARTEX AI agents to try sign-ins at more than 2,250 tenants via ConnectWise

What Microsoft says Storm-0940 did with the ARTEX AI framework after the ConnectWise Cloud Backup compromise: sign-in attempts to more than 2,250 tenants, a password spray that peaked at 2,900 failures a minute, and what is not established.

Threat Intel23 Oct 2026

LiteLLM supply chain attack poisons official PyPI and Docker builds with Python startup backdoor

LiteLLM version 1.107.0 compromised on PyPI and Docker Hub via stolen GitHub CLI OAuth tokens, injecting a Python startup backdoor and credential stealer.

Threat Intel23 Oct 2026

HPE Aruba patches 72 vulnerabilities in wireless operating systems including eight CVSS 10.0 RCE flaws

HPE Aruba bulletin HPESBNW05162 patches 72 flaws across AOS-8 and AOS-10 wireless operating systems, including eight CVSS 10.0 remote code execution vulnerabilities.

Threat Intel23 Oct 2026

Threat actor k0t breaches enterprise firewalls exposing 70,000 credentials for ransomware gangs

Group-IB and NyxLab expose threat actor k0t compromising Fortinet and Palo Alto firewalls to harvest 70,000 credentials feeding Qilin and The Gentlemen ransomware.

Threat Intel23 Oct 2026

Russia-aligned UAC-0099 and Sandworm hid a backdoor's C2 in the Yggdrasil mesh before a data wipe in Ukraine, ESET reports

ESET's account of an intrusion at a Ukrainian grain logistics company: UAC-0099 initial access, a Go backdoor with its command server inside the Yggdrasil mesh, and a Sandworm wipe two months later.

Threat Intel23 Oct 2026

Microsoft 365 token spraying compromises 79 organisations across 70 days without passwords

What Huntress reported on 22 October 2026: a ten-week Microsoft 365 token-spraying campaign, at least 497 successful sign-ins at 79 organisations, rogue Entra devices, replaced MFA methods and hidden inbox rules, and what Huntress advises defenders to do.

Threat Intel23 Oct 2026

PHP advisory on CVE-2026-115560: an unlikely session upload RCE vector, with the fix due in the next regular release

What PHP's informational advisory on CVE-2026-115560 says and leaves out: the conditions it names, the one-line setting it suggests, the missing versions, severity score and release date, and what The Register, The Hacker News and Cloudflare add.

Threat Intel23 Oct 2026

Node2Shell Brotli briefing withdrawn: it duplicated another briefing and named Node.js versions that do not exist

Why this Node.js Brotli briefing was withdrawn and where the account of CVE-2026-111497 is.

Page 3

Friday 23 October

Threat Intel23 Oct 2026

Arista VeloCloud CVE-2026-114625: any authenticated user can gain operator rights; CISA lists it as exploited

What Arista's CVE record and CISA's catalogue state about CVE-2026-114625: affected and fixed releases, the minimum role, the two earlier exploited VeloCloud Orchestrator flaws, and what the record leaves out.

Thursday 22 October

Threat Intel22 Oct 2026

Storm-0940 ARTEX briefing withdrawn: it duplicated another briefing and invented dates and notifications

Why this Storm-0940 briefing was withdrawn and where the corrected account is.

Threat Intel22 Oct 2026

UK government services briefing withdrawn: it joined two unrelated stories and carried unsupported detail

Why this UK government briefing was withdrawn, what the BBC and the NCSC say about the PHP shutdowns, and where the AI pilot figures come from.

Threat Intel22 Oct 2026

Mozilla says eight eMudhra intermediate CA private keys were below 256; Chrome and Firefox blocked them

What Mozilla, Google, Apple, CERT-In and eMudhra state about eight eMudhra intermediate CA keys below 256, what each has blocked, and what non-browser software must still update.

Threat Intel22 Oct 2026

Signal RingRTC zero-day flaw exposes ambient audio after hang-up

Technical analysis of Signal RingRTC CVE-2026-113380: FSM queue saturation, decoupling of UI dismissal from WebRTC audio hardware teardown, and the 2.72.0 fail-forward patch.

Threat Intel22 Oct 2026

INTERPOL says Operation Serengeti III led to 1,462 arrests and over USD 105 million recovered

What INTERPOL's release says about Operation Serengeti III: 1,462 arrests, 10,909 disrupted networks, more than USD 105 million recovered, the cases it names in Uganda, Angola, Nigeria, Tanzania and Gabon, and what it does not state.

Threat Intel22 Oct 2026

Kaspersky says Lazarus malware uses ML-KEM-1024 key exchange in Operation FlashHole against South Korea

What the Securelist report on Operation FlashHole says about ML-KEM-1024 in LPEClient, the infection chain, victims and indicators, checked against the report, the Kaspersky release and NIST FIPS 203.

Threat Intel22 Oct 2026

SafePay advisory AA26-293A briefing withdrawn: most of its figures and technical detail are not in the advisory

Why this SafePay briefing was withdrawn, and what the CISA and FBI advisory AA26-293A actually says.

Wednesday 21 October

Threat Intel21 Oct 2026

PHP issues emergency fixes for two critical RCE flaws: CISA and UK NCSC issue urgent alerts

What PHP's advisory, the NCSC and CISA say about the PHP2Shell flaws: the four fixed releases, the stopgaps PHP prints, who is affected, and a corrected update checklist.

Threat Intel21 Oct 2026

PHP patches two critical RCE flaws: mod_php highest risk, FPM needs attention too

Two PHP 9.2 flaws can lead to unauthenticated code execution. The official advisories distinguish mod_php and FPM exploit evidence, fixed versions and interim controls.

Threat Intel21 Oct 2026

SafePay: agencies count at least 600 victims, but the access route varies

The joint SafePay warning identifies at least 600 victims and two distinct access families. Here is how to test each exposure without treating the campaign as one fixed attack chain.

Threat Intel21 Oct 2026

The order email passed authentication. The planted helpline was the attack

In Talos's samples, the sender passed checks while a fake support number appeared in shipping or billing fields. We trace that boundary, the 1,400-message denominator and two related notification routes.