The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 1 to 72 of 240 briefings

Today

Threat Intel26 Oct 2026

Kali Linux 2026.3 adds six tools and kernel 7.1.5; Kali's pages list all six only under the 'everything' set

What Kali's 2026.3 post states and leaves out: six tools listed only under the everything metapackage, a screenshot dated 24 September, images built 9 October, and how Kali says to verify a download.

A dark room with three flat pale grey rack mounted network appliances stacked in an open black rack, each with a blank recessed plate, a row of empty ports and a few black cables. In front, on a steel shelf, lies a closed slate grey document folder held shut by a blue band. The left half is empty dark blue, with the headline and a stat drawn over it: 19 days.

Threat Intel26 Oct 2026

Fortinet says critical and high severity fixes are out for five product lines, with advisories held to 10 November

What Fortinet's announcement, change logs and policy establish about its hardening release: the 17 fixed versions, the 19 day gap, what the release notes list, and the upgrade steps to take before the advisories arrive.

A bare hand holds a plain dark blue bank card with only a gold chip square against the back of a matte graphite smartphone in a rainy dusk street, with a thin cyan glow between them. A cash machine is out of focus at upper right. The left half is dark and carries the headline, 170 victims and a one line note.

Threat Intel26 Oct 2026

Dutch police say a caller's app relayed victims' card chip data to an accomplice: 170 victims, about 380,000 euros

What the Dutch police release states about the NFC card scan fraud, what it leaves out, the arithmetic behind 380,000 euros and 170 victims, where SecurityWeek differs from the primary, how NFC relay works at defender level, and a ranked checklist for customers and bank fraud teams.

A dark laboratory bench in dim blue light. Three identical black rack servers with blank recessed label plates stand stacked in an open steel rack on the right. A silver open laptop in front shows a navy window of blank grey bars and one short block. The left half is empty dark blue, with the headline and a stat drawn over it: 35 shells.

Threat Intel26 Oct 2026

Researcher reports 35 Apache shell starts on three PHP2Shell honeypots running PHP 8.4.26, three days after the fix

What the honeypot report establishes about PHP2Shell exploitation and what it does not, the claims retracted before it, the fixed versions, defender detections as printed, and a ranked checklist.

Yesterday

A dark room with one slim server rack on the right holding five identical servers, the top one with a red indicator, the second amber and the rest pale, joined by a single black cable. The left half is empty dark blue and carries the headline, Tailworm: 11 claimed flaws in Tailscale and headscale, no CVE, no fixed release, and the stat 18 changes: SSH and serve code merged since Saturday, none released.

Threat Intel25 Oct 2026

Tailworm claims 11 flaws in Tailscale and headscale: no CVE or fixed release, 18 code changes merged

What the Tailworm report, Tailscale, headscale and their repositories print about eleven claimed flaws: the chain at defender level, the dated record, the friendly names, the technical artifacts and a ranked checklist.

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Threat Intel25 Oct 2026

CISA lists shared hardcoded root CA key and missing authorization flaw in Moxa AIG-302 gateways

CISA's advisory ICSA-26-293-03 lists two Moxa AIG-302 flaws fixed in firmware 1.4.1: a shared hardcoded root CA private key (CVSS 4.0 8.6) and a missing authorization check (6.9). Adjacent network access is required.

A dark panel with a notice that this briefing has been withdrawn for rewriting.

Threat Intel25 Oct 2026

Ruby Onigmo briefing withdrawn: it misstated who assigned the CVEs, GitLab's fix dates and the defender advice

Why this Ruby Onigmo briefing was withdrawn and what Ruby's post and GitLab's patch releases say.

Threat Intel25 Oct 2026

Linux kernel maintainers scramble after KSMBD remote execution flaws leak to LKML

Dual CVSS 9.0 remote code execution vulnerabilities in the Linux kernel in-tree SMB server KSMBD leaked to public mailing lists, exposing hosts to pre-auth protocol confusion and heap memory corruption.

Threat Intel25 Oct 2026

Cisco patches maximum-severity root remote code execution in Expressway Series

Cisco discloses CVE-2026-76466, a critical CVSS 9.8 remote code execution flaw in Expressway-C and Expressway-E clustered database services allowing unauthenticated root OS control with no workarounds.

Saturday 24 October

An editorial image of a laptop with a blank social publishing calendar, headed Postiz Security, Files and Tokens, with version 2.25.3 highlighted.

Threat Intel24 Oct 2026

Postiz fixes three critical file-read and token-forgery flaws across two releases

A version-by-version guide to three Postiz CVEs, the file and token trust boundaries they break, and what operators should check.

Threat Intel24 Oct 2026

Third PHP flaw briefing withdrawn: it duplicated another briefing and invented scores, versions and a mechanism

Why this briefing on the third PHP2Shell flaw was withdrawn and where the corrected account is.

Threat Intel24 Oct 2026

Operation IXIM: Eye Security says it served over 2 million updates that disabled an abandoned Popcorn Time updater

What Eye Security reported at Hack.lu on 22 October 2026 about Operation IXIM: how it found the abandoned Time4Popcorn updater (CVE-2026-30612), what its update did and did not do, why a download count is not a device count, and what defenders should check.

Page 2

Saturday 24 October

Enterprise cloud storage server racks illuminated with subtle amber and cool blue telemetry indicators, surrounded by floating translucent document silhouettes.

Threat Intel24 Oct 2026

Collabora CODE CVSS 9.2 command injection added to CISA KEV

Technical autopsy of Nextcloud Collabora Online Built-in CODE Server CVE-2026-110447: CVSS 9.2 command injection in proxy.php, three-day CISA KEV remediation order, webshell deployment, and password vault scraping.

Threat Intel24 Oct 2026

Kaspersky says BlackX bootkit, similar to BlackLotus, bypassed Secure Boot on patched PCs without PCA 2011 revocation

What Kaspersky GReAT reports about BlackX, a UEFI bootkit that exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys on fully patched Windows machines, what it does not state, and which Microsoft revocation steps defenders have to run themselves.

Friday 23 October

Enterprise media server rack illuminated with neon amber and cyan data streams, network packets flowing into internal loopback routing and transcoder frames converting into ELF shared objects.

Threat Intel23 Oct 2026

CISA adds Plex2Shell unauthenticated RCE chain to Known Exploited Vulnerabilities catalog

Technical autopsy of the Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656): loopback token theft, x264 dump-yuv carrier video writes, unsigned codec dlopen execution, and CISA KEV listing.

$A luminous geometric orange and violet polygon with spidering crimson fractures floating above enterprise server racks and cascading regular expression code syntax.$

Threat Intel23 Oct 2026

GitLab issues emergency patches for maximum severity CVSS 10.0 integer overflow RCE

Technical breakdown of GitLab emergency release: CVSS 10.0 integer overflow CVE-2026-110264, Ruby Onigmo regex compiler heap corruption, 4,535-day exposure window, and seven-train backport matrix.

Threat Intel23 Oct 2026

Microsoft says Storm-0940 used ARTEX AI agents to try sign-ins at more than 2,250 tenants via ConnectWise

What Microsoft says Storm-0940 did with the ARTEX AI framework after the ConnectWise Cloud Backup compromise: sign-in attempts to more than 2,250 tenants, a password spray that peaked at 2,900 failures a minute, and what is not established.

Dark data centre racks with glowing cabling and a cluster of crystalline nodes, with the headline and the version 1.107.0.

Threat Intel23 Oct 2026

LiteLLM supply chain attack poisons official PyPI and Docker builds with Python startup backdoor

LiteLLM version 1.107.0 compromised on PyPI and Docker Hub via stolen GitHub CLI OAuth tokens, injecting a Python startup backdoor and credential stealer.

Abstract high-tech 3D network topology visualization of glowing enterprise wireless mobility controllers and radio access points transmitting illuminated data packets.

Threat Intel23 Oct 2026

HPE Aruba patches 72 vulnerabilities in wireless operating systems including eight CVSS 10.0 RCE flaws

HPE Aruba bulletin HPESBNW05162 patches 72 flaws across AOS-8 and AOS-10 wireless operating systems, including eight CVSS 10.0 remote code execution vulnerabilities.

Abstract geometric visualization of glowing perimeter firewall gateway nodes subjected to automated exploit scanning and data exfiltration pipelines.

Threat Intel23 Oct 2026

Threat actor k0t breaches enterprise firewalls exposing 70,000 credentials for ransomware gangs

Group-IB and NyxLab expose threat actor k0t compromising Fortinet and Palo Alto firewalls to harvest 70,000 credentials feeding Qilin and The Gentlemen ransomware.

Threat Intel23 Oct 2026

Russia-aligned UAC-0099 and Sandworm hid a backdoor's C2 in the Yggdrasil mesh before a data wipe in Ukraine, ESET reports

ESET's account of an intrusion at a Ukrainian grain logistics company: UAC-0099 initial access, a Go backdoor with its command server inside the Yggdrasil mesh, and a Sandworm wipe two months later.

Threat Intel23 Oct 2026

Microsoft 365 token spraying compromises 79 organisations across 70 days without passwords

What Huntress reported on 22 October 2026: a ten-week Microsoft 365 token-spraying campaign, at least 497 successful sign-ins at 79 organisations, rogue Entra devices, replaced MFA methods and hidden inbox rules, and what Huntress advises defenders to do.

Threat Intel23 Oct 2026

PHP advisory on CVE-2026-115560: an unlikely session upload RCE vector, with the fix due in the next regular release

What PHP's informational advisory on CVE-2026-115560 says and leaves out: the conditions it names, the one-line setting it suggests, the missing versions, severity score and release date, and what The Register, The Hacker News and Cloudflare add.

Threat Intel23 Oct 2026

Node2Shell Brotli briefing withdrawn: it duplicated another briefing and named Node.js versions that do not exist

Why this Node.js Brotli briefing was withdrawn and where the account of CVE-2026-111497 is.

Page 3

Friday 23 October

Threat Intel23 Oct 2026

Arista VeloCloud CVE-2026-114625: any authenticated user can gain operator rights; CISA lists it as exploited

What Arista's CVE record and CISA's catalogue state about CVE-2026-114625: affected and fixed releases, the minimum role, the two earlier exploited VeloCloud Orchestrator flaws, and what the record leaves out.

Thursday 22 October

Threat Intel22 Oct 2026

Storm-0940 ARTEX briefing withdrawn: it duplicated another briefing and invented dates and notifications

Why this Storm-0940 briefing was withdrawn and where the corrected account is.

Threat Intel22 Oct 2026

UK government services briefing withdrawn: it joined two unrelated stories and carried unsupported detail

Why this UK government briefing was withdrawn, what the BBC and the NCSC say about the PHP shutdowns, and where the AI pilot figures come from.

Threat Intel22 Oct 2026

Mozilla says eight eMudhra intermediate CA private keys were below 256; Chrome and Firefox blocked them

What Mozilla, Google, Apple, CERT-In and eMudhra state about eight eMudhra intermediate CA keys below 256, what each has blocked, and what non-browser software must still update.

Conceptual visualization of encrypted telecommunications and acoustic surveillance showing active audio waveforms flowing across cybernetic processor circuits.

Threat Intel22 Oct 2026

Signal RingRTC zero-day flaw exposes ambient audio after hang-up

Technical analysis of Signal RingRTC CVE-2026-113380: FSM queue saturation, decoupling of UI dismissal from WebRTC audio hardware teardown, and the 2.72.0 fail-forward patch.

Threat Intel22 Oct 2026

INTERPOL says Operation Serengeti III led to 1,462 arrests and over USD 105 million recovered

What INTERPOL's release says about Operation Serengeti III: 1,462 arrests, 10,909 disrupted networks, more than USD 105 million recovered, the cases it names in Uganda, Angola, Nigeria, Tanzania and Gabon, and what it does not state.

Threat Intel22 Oct 2026

Kaspersky says Lazarus malware uses ML-KEM-1024 key exchange in Operation FlashHole against South Korea

What the Securelist report on Operation FlashHole says about ML-KEM-1024 in LPEClient, the infection chain, victims and indicators, checked against the report, the Kaspersky release and NIST FIPS 203.

Threat Intel22 Oct 2026

SafePay advisory AA26-293A briefing withdrawn: most of its figures and technical detail are not in the advisory

Why this SafePay briefing was withdrawn, and what the CISA and FBI advisory AA26-293A actually says.

Wednesday 21 October

A cinematic data center at night with rows of metallic server racks and illuminated green and cyan fiber optic status indicators on the right. The left half is darkened with overlay headline text describing the emergency PHP remote code execution fixes and a stat highlighting 22.6 million exposed hosts.

Threat Intel21 Oct 2026

PHP issues emergency fixes for two critical RCE flaws: CISA and UK NCSC issue urgent alerts

What PHP's advisory, the NCSC and CISA say about the PHP2Shell flaws: the four fixed releases, the stopgaps PHP prints, who is affected, and a corrected update checklist.

Editorial illustration of an unbranded server maintenance desk with empty update rows on two screens. The headline states that PHP has two critical security fixes, each rated 9.2 out of 10.

Threat Intel21 Oct 2026

PHP patches two critical RCE flaws: mod_php highest risk, FPM needs attention too

Two PHP 9.2 flaws can lead to unauthenticated code execution. The official advisories distinguish mod_php and FPM exploit evidence, fixed versions and interim controls.

Editorial illustration of an unbranded enterprise firewall and backup storage rack at night. The headline says SafePay, 600 victims and the two entry routes.

Threat Intel21 Oct 2026

SafePay: agencies count at least 600 victims, but the access route varies

The joint SafePay warning identifies at least 600 victims and two distinct access families. Here is how to test each exposure without treating the campaign as one fixed attack chain.

Editorial image of an unbranded laptop with a generic blank order receipt and a phone beside it. Text says a genuine sender can carry a planted phone lure, noting Talos's roughly 1,400-message sample.

Threat Intel21 Oct 2026

The order email passed authentication. The planted helpline was the attack

In Talos's samples, the sender passed checks while a fake support number appeared in shipping or billing fields. We trace that boundary, the 1,400-message denominator and two related notification routes.

Page 4

Wednesday 21 October

Editorial illustration of network servers with a blue route diverted through a red intermediary node, representing reported SSH interception at Tor exit relays. Headline identifies 333 measured exits and 12 interception servers.

Threat Intel21 Oct 2026

333 Tor exits redirected SSH: the host-key warning was the decisive boundary

The 333 measured SSH redirects, the 377 policy matches, the Ebury case on one operator's servers and the exact point at which a host-key warning matters.

Tuesday 20 October

Editorial illustration of a cracked intermediate certificate in a chain, with a protective barrier before a browser window.

Threat Intel20 Oct 2026

Eight eMudhra CA keys were recoverable from tiny numbers. Firefox blocked them; 30,000 certificates may need migration

Mozilla found eight recoverable eMudhra intermediate keys. Firefox blocked them; root distrust now puts about 30,000 certificates into migration, according to eMudhra.

A dark engineering workstation at night. One monitor shows an installer-style window with blank list rows and a half-filled progress bar beside a folder window of identical blank file tiles, one tile outlined in amber and tilted. A desk lamp glows amber at the right edge. The headline and figure are added by the site.

Threat Intel20 Oct 2026

Siemens Software Center CVE-2026-110936: fix added 17 October, exploitation noted 19 October

What Siemens's advisory, blog and CVE records state about CVE-2026-110936, the four days before exploitation was noted, two scores, what Romulus is, what UK guidance reads, and a ranked defender checklist. Defender level only.

Monday 19 October

A dark room with a black server rack holding two brushed steel rack servers with blank recessed plates, and in front of it an open laptop on a black flight case. The laptop screen shows a list of five blank pale rows, the top three marked with amber dots and the bottom two with blue dots. The left half is empty dark blue, carrying the headline: five NGINX flaws, fixed 14 Oct, nginx.org rates all five medium, and the stat 3 of 5.

Threat Intel19 Oct 2026

Five NGINX flaws fixed 14 October: nginx.org says all medium, F5's CVSS 4.0 rates three critical

The labels on five NGINX flaws (nginx.org medium, F5 CVSS 4.0 critical for three), what each flaw needs, which press claims the records support, what the distribution trackers showed on 19 October, and the UK 5 day and 14 day clocks.

A small charcoal four-bay network storage box with blank drive-bay doors and one tiny blue standby light stands on a worn oak shelf in a dark room, a coil of plain grey network cable beside it. The left half is empty dark blue, with the headline and a stat drawn over it: fixed 4 August, exploitation seen 17 October, 74 days, as of 19 October.

Threat Intel19 Oct 2026

Plex2Shell: a honeypot saw exploitation 1 day after the write-up and 74 days after Plex's fix

What Plex's release notes, the CVE records, CISA and the two researchers' pages establish about Plex2Shell as of 19 October: the dates to scale, four scores that miss the chain, the build that is actually fixed, what UK guidance requires, and a ranked checklist. Defender level only.

A dark control room wall carrying a grid of about twelve columns of blank, softly backlit frosted tiles under empty rounded heading pills, with one tile outlined in indigo and two neighbours dimmer. The grid sits on the right; the left is empty dark blue carrying the headline and the stat 6 of 9 drawn over it.

Threat Intel19 Oct 2026

MITRE ATT&CK v20 adds 9 Enterprise techniques; in v20 neither prompt injection one has a detection strategy

A computed diff of MITRE's version 19.2 and 20.0 STIX data: nine new Enterprise entries, six detection strategies, SecurityWeek's claims checked, the water and Mexico campaigns against their cited sources, how NCSC pages use ATT&CK, and a ranked checklist.

A matte white home broadband router stands on an oak shelf in a dark hallway, with four faint cyan rings of light around it and one softly lit indicator. The left half is empty dark navy, carrying the headline Broadcom Wi-Fi setup flaw, no CVE on 19 October, and the stat 90 days.

Threat Intel19 Oct 2026

Broadcom WPS flaw: no CVE on 19 October, 90 days after the report; Broadcom cites a 2018 replacement

What the researcher's write-up, slides and project page state about the Broadcom WPS flaw, what Broadcom and the CVE records do not, the dated 90 days, and what the UK's PSTI regime, Telecoms Security Code and Cyber Essentials require and do not. Defender level only.

A dark data-centre aisle at night. A long row of identical black server cabinets with perforated doors recedes along the right of the frame, each door carrying a blank rounded label well. One door near the front stands slightly ajar and cold blue light spills out across the polished floor. The left half is empty dark navy, with the headline and a stat drawn over it: 3 of 7.

Threat Intel19 Oct 2026

PwnEscape (CVE-2026-99999): fixed upstream in 7 kernel series; Red Hat, Ubuntu, SUSE listed no fix on 19 October

What the CVE record, the kernel changelogs and each distributor's own page say is fixed and where, why one flaw carries 9.3 and 8.8, what is and is not established about exposure and exploitation, the UK guidance as read, and a ranked checklist. Defender level only.

Saturday 17 October

A dark server hall in cool blue light. A row of identical black rack servers with perforated mesh fronts and small round status lights fills the right of the frame. On the middle server a strip of plain pale tape lies across the handle, blank. A slim console tray below it holds a small lit screen showing only an empty rounded pill and one block cursor. The left half is empty dark blue, with the headline and a stat drawn over it: 168+ days.

Threat Intel17 Oct 2026

Unit 42 says AI-generated code hit government Linux servers, but gives no count of victims, countries or scripts

What Unit 42's report on CL-UNK-1211 states and does not, the AI claim rung by rung, the labels that carry it, the planted red-team markers, what NCSC guidance and Cyber Essentials cover and where they stop, and a ranked checklist. Defender level only.

A dim server room in dark blue. A slim monitor on a dark desk shows a pale blank session window made of empty rounded slots, with no text or icons. Behind it, a dark equipment rack holds slim unmarked metal appliance panels and loose black cables. The left half is empty dark blue, with the headline and a stat drawn over it: 47 days from first known exploit to advisory.

Threat Intel17 Oct 2026

BeyondTrust Remote Support: first known exploit 29 August, advisory 47 days later, two victims stated

The dates behind the BeyondTrust Remote Support zero-day, what the record does not establish (victims, Privileged Remote Access, the patch), nine labels read against the primaries, four UK clocks, and ordered checklists for a service desk, an MSP and a CISO. Defender level only.

Friday 16 October

Conceptual law-enforcement evidence desk with closed laptop and folders

Threat Intel16 Oct 2026

INTERPOL reports 95 arrests across 17 countries in child-abuse material operations

The scope, investigative methods, safeguarding result and evidence limits behind INTERPOL's 15 October announcement.

Conceptual server-room illustration with a document icon on a rack display and a red line reaching it

Threat Intel16 Oct 2026

Nextcloud built-in CODE Server attacks: what CVE-2026-110447 exposed and who needs to act

A source-led breakdown of CVE-2026-110447, observed webshell activity, the affected built-in CODE Server mode and practical incident-response checks.

Page 5

Friday 16 October

Illustrative desktop contrasting a verified source archive with a warned install script; all on-screen file names are fictional.

Threat Intel16 Oct 2026

Fake Arch AUR helper hid a root-level install script behind genuine yay source code

How the fake yyay package used a valid source archive as cover, what the .install script changed, what is confirmed about removal, and practical checks for Arch users.

Illustration of a laptop login screen beside an office network access point; no actual Windows configuration is shown.

Threat Intel16 Oct 2026

Windows October update changes NTLMv1-derived SSO default: check MS-CHAPv2 Wi-Fi and VPN before users lose access

A precise before-and-after comparison, affected versions, NTLM event IDs 4024 and 4025, a scoped temporary exception and the migration path for Wi-Fi, Ethernet and VPN.

Illustrative photograph of network edge devices in a home office; no victim device is shown.

Threat Intel16 Oct 2026

GreyNoise finds 143 proxyjacked edge devices; a separate intrusion shows why residential IPs complicate detection

The skynox7 proxyjacking campaign, affected device classes and CVEs, the separate Entra ID investigation, observed TTPs and defender checks.

Conceptual dark server rack and gateway representing a remote support appliance; no real BeyondTrust system is shown.

Threat Intel16 Oct 2026

BeyondTrust Remote Support zero-day: the patch is urgent, but the appliance may not tell the whole story

What happened, which Remote Support versions need BT26-05-RS, the observed SAWFLY and BARECLAW tradecraft, and where defenders should look when on-device logs have been erased.

Thursday 15 October

Infoblox-published example of a fraudulent Microsoft-themed support warning over a browser, with a fake support number. This is a scam example, not a real Microsoft alert.

Threat Intel15 Oct 2026

Infoblox links 20,000 Cloudflare Pages domains to Help TDS; a browser scare becomes a remote-access lure

Help TDS and Hotejka: what Infoblox observed, what 20,000 domains cannot count, and practical controls against fake support and remote-access scams.

AI-generated editorial illustration of a green NGINX gateway in a server room with a metal protective panel being fitted.

Threat Intel15 Oct 2026

NGINX fixes five flaws in 1.30.6 and 1.31.7; configuration determines exposure

NGINX 1.30.6 and 1.31.7 patch five issues. A CVE-by-CVE table, version ranges and practical checks for HTTP/3, TLS tickets, rewrites and AIO.

A dark desk with a closed plain silver laptop at the back right, a ring of brass keys with blank round bows in front of it, and a fan of blank white hotel-style key cards, one card stood up on the key ring. The left half is empty dark blue, with the headline and a stat drawn over it: 9 PRODUCTS.

Threat Intel15 Oct 2026

Symantec names 9 AI products in Aoki infostealer's targets; victims, sample dates and delivery are not stated

What Symantec's report establishes about Aoki and AI assistant credentials, what it leaves out, the dated record, vendor statements on storage, lifetime and revocation, what UK guidance covers, and ordered checklists. Defender level only.

A matte graphite laptop and a plain black smartphone on a dark desk in a night office, each showing a page of empty grey bars with one bright rectangular advertising slot holding a blank panel and an amber empty button. Behind them a row of identical dark monitors recedes. The left half is empty dark blue, with the headline and a stat drawn over it: at least 45.

Threat Intel15 Oct 2026

AdFection: Citizen Lab says ads helped Candiru target at least 45 Al Jazeera devices, no infection count

What Citizen Lab's AdFection report and Confiant's post establish, what they leave out, why the 45 devices and the 441,954,291 impressions cannot be divided, what the ad platforms said, what UK guidance covers and where it stops, and three ordered checklists. Defender level only.

A dark equipment room with a black server rack on the right and its mesh door swung open. Six identical grey servers carry blank pill-shaped nameplate wells, and a pull-out console shows a dim admin screen made only of empty rows and one indigo button. The left half is empty dark blue, with the headline: a critical Drupal flaw, its team said exploits might come in hours or days, and the figure 28.5%, of reporting sites, affected branch, no fix.

Threat Intel15 Oct 2026

Drupal's critical Field UI flaw has no fix for 28.5% of reporting sites; its team said exploits may take hours or days

What the Drupal Security Team's advisory and release notes state and do not state about CVE-2026-108097, the arithmetic behind 28.5 per cent, the May exploitation precedent, UK controls and where they stop, and a ranked checklist for three kinds of owner. Defender level only.

A dark equipment room. In a black rack, a flat unmarked network appliance with a row of empty sockets has one grey cable plugged into its left socket, and a small blank paper tag tied to the cable. The left half is empty dark blue, with the headline and a stat drawn over it: 561 to 590 days.

Threat Intel15 Oct 2026

Unit 42 dates its FortiGate implant case to September 2024; the flaw behind the implant was published in April 2026

What Unit 42's PEERSTITCH report states and leaves out, the fix dates for four Fortinet flaws, why patching the FortiManager does not return stolen keys, what the NCSC, Cyber Essentials and the ICO say, and a ranked checklist. Defender level only.

A dark server room, the left half empty dark blue with the headline and a stat drawn over it: 3 DAYS. On the right a flat grey rack-mount firewall appliance in a black rack, its faceplate unmarked, with a small separate two-jack panel at one end lit by a single cyan light. A plain blank off-white access card lies on the shelf below it.

Threat Intel15 Oct 2026

PAN-OS CVE-2026-0322: CISA gave 3 days, and Palo Alto gives no count for 'very limited' exploitation

What Palo Alto's advisory, CISA's entry and the NCSC's pages establish about CVE-2026-0322: a 3-day window against Cyber Essentials' 14, which PAN-OS builds are fixed, ten open questions, UK controls and an ordered checklist. Defender level only.

Wednesday 14 October

A dark spare room. On a plain steel wall shelf stand eight identical closed silver laptops, each with a tiny cyan status light on the shelf's front edge, above a bare desk with a black power strip and an empty black office chair. The left half is empty dark blue, with the headline and a stat drawn over it: 40+ Texas residences searched, 14 charged in Ohio, overlap not stated, and $3M.

Threat Intel14 Oct 2026

Over 40 Texas residences searched, 14 charged in Ohio, and no stated overlap between the two DOJ actions

What the DOJ releases and the 58-page indictment state about the 40-plus Texas residences, the 14 charged, the $3 million and the 70-plus companies, where five news stories count differently, what UK law asks of an employer hiring remote developers, and an ordered checklist.

Page 6

Wednesday 14 October

A dark server rack in cold blue light. A glass-fronted rack stands open on the right with plain grey servers, and one server tray is slid forward. In it sits a smaller matte black box with a hairline crack across its lid that runs out over the grey floor of the tray, with a thin cyan light along the line. The left half is empty dark blue, with the headline and a stat drawn over it: 2 OF 5.

Threat Intel14 Oct 2026

Vghost: kernel fix dated 3 August, demos 12 October, and 2 of 5 tested distributions still without a fix

What the kernel commit, the CVE record and the vendor trackers establish about Vghost, what found by AI does and does not say, how seven raters score it from 6.4 to 8.8, which of 26 releases have a fix, the UK clocks and a ranked checklist. Defender level only.

A dark equipment cabinet in cool light. A large brass screw-threaded coupling with a visible thread and a backed-off nut hangs in a dense sweep of cables in cyan, blue, white, grey, red and amber that all run into it. Blank recessed plates sit on unmarked rack units behind. The left half is empty dark blue, with the headline and a stat drawn over it: 616 days.

Threat Intel14 Oct 2026

curl's first High flaw in 1,099 days was in 13 releases; curl lists eight conditions for code execution

The arithmetic behind curl's High flaw, what its advisory states and leaves out, where libcurl hides, what the distributions had fixed on 14 October, the UK patch clocks as read, and a ranked checklist. Defender level only.

A plain black rack-mounted network appliance with two blank pill-shaped recesses on its bezel takes in a line of five blank cream envelopes on a steel roller conveyor. The envelope nearest the viewer carries one blank red wax seal. The left half is empty dark blue, with the headline and a stat drawn over it: 30 days.

Threat Intel14 Oct 2026

Cisco's second exploited email gateway flaw in 30 days: its two fixed builds were named on 14 September

What Cisco's 14 October advisory for CVE-2026-76519 states and leaves out, the two conditions and the scanner update that fixes it, the 16.0 gap, what Shadowserver's count can and cannot say, what NCSC, Cyber Essentials and the ICO say as read, and an ordered checklist. Defender level only.

A dark print shop. On the right, four taut cords hold rows of identical pale paper sheets, each printed with the same blank page layout of empty rounded bars and boxes and no writing. One sheet in the front row has been ripped away, leaving a ragged strip in two wooden pegs and a crumpled scrap on the floor. The left half is empty dark blue, with the headline and a stat drawn over it: 34 names.

Threat Intel14 Oct 2026

Microsoft's temporary order moves 34 names under five domains; its billion messages are not a victim count

What Microsoft's announcement, its sworn declarations and the court order actually count: 34 names moved, a billion messages with no stated method, 1.1 million dollars traced against tens of millions claimed, and what UK organisations should do.

A dark small-shop back room. A row of plain white and grey boxes with blank label wells sits on a shelf above a counter holding a switched-off terminal screen on a stand and a pale grey card reader, with a dark server tower at the far right. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 177 listed.

Threat Intel14 Oct 2026

Adobe's October bulletins list 177 flaws; every one rated critical sits in AEM, ColdFusion or Commerce

What Adobe's 11 bulletin pages establish and do not, why 176 is 177 entries and 175 ids, how priority 2 and 3 compare with the Cyber Essentials and NCSC clocks, the Commerce hotfix beside a no exploits line, and a ranked checklist. Defender level only.

A dark desk after hours. On the right, three tall stacks of grey bound ledgers with blank label plates stand beside a closed silver laptop, and a cream folder with one red paper clip lies on the laptop. The left is empty dark navy with the headline and stat drawn over it: seven totals for one release, one exploited CVE, 7 TOTALS.

Threat Intel14 Oct 2026

Microsoft's October Patch Tuesday has seven totals, 1,407 to 1,417, and one exploited CVE, not three zero-days

Which rule produces each outlet's total and Critical count, what zero-day did and did not mean, what Microsoft states about the exploited Windows Shell bug, why its risk cohorts omit it, and the UK clocks and an ordered checklist, and September's release set beside it.

A dark desk in cold blue light. An unmarked pale grey desktop document scanner holds a stack of blank white sheets in its input tray and feeds one blank sheet out of the front. Behind it a flat monitor shows a grid of twelve blank page thumbnails, one outlined in cyan. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 10,240.

Threat Intel14 Oct 2026

Ghostscript CVE-2026-39919: two exploits failed 10,240 times on other builds and worked on the matching one

What Wordfence's post establishes about a Ghostscript PDF flaw, where BleepingComputer's wording departs from it, what 0 of 10,240 does and does not say, which distributions have a fix, the UK patching clocks, and a ranked checklist. Defender level only.

Tuesday 13 October

A dark equipment rack holding one plain grey rack-mounted network appliance, with a row of empty network jacks and a blank rounded plate on its faceplate, black blanking panels above and below, and a pale blue network cable hanging in a coil from a hook on the rack post. The left half is empty dark blue, with the headline and a stat drawn over it: Fully patched, still exploited, 2 of 3.

Threat Intel13 Oct 2026

A fully patched Ivanti VPN gave an attacker root through a three-flaw chain; two flaws are fixed, one is not

What Ivanti, Volexity, NVD and CISA each state about the Connect Secure chain, the fixed builds and their dates, what the record does not establish, the UK clocks and duties, and an ordered checklist. Defender level only.

A dark corporate server room in cool blue light. On the right stands a tall black rack of enterprise servers whose faceplates carry blank pill-shaped recesses, with grey cables down its side. In front of it a stainless steel service cart carries a flat monitor showing an empty form made only of blank rounded fields and an empty button. The left half is dark and carries the headline, SAP's 10.0 flaw sits in a library you must upgrade yourself, and the stat 53 days.

Threat Intel13 Oct 2026

SAP's October 10.0 is a library customers must upgrade, with a fixed build dated 53 days before the advisory

What SAP's 13 October overview and GitHub advisory state about the 10.0 OAuth2 SSRF in the Cloud SDK for Python, the 22 rows counted, who acts on each Critical row, the UK clocks to 27 October and an ordered checklist. Defender level only.

A dark data-centre aisle in cool blue light. A black rack on the right is filled with network switches whose faceplates carry empty port openings and blank pill-shaped recesses, with bundles of grey and teal patch cables falling in loops. One small amber port light glows on one switch. The left half is dark and empty and carries the headline, Cisco's October bundle, 16 of 35 CVEs score 9.0 or more, and the stat 20 of 35.

Threat Intel13 Oct 2026

Cisco's October bundle: 16 of 35 CVEs score 9.0 or more, 7 in NX-OS, and 20 are umbrella IDs with no bug count

What Cisco's 14 advisories state and do not: the count by product and score, what a 'hardening release' is, five critical NX-OS flaws gated by features, fixed releases per train, the UK 14-day clock to 21 October, and an ordered checklist. Defender level only.

A dark data centre aisle. On the right, a black server rack holds four matching pale grey rack servers above a row of blank black drives, with a flat black status panel at the top, switched off and blank, and one small amber light at its corner. More racks recede into the dark. The left half is empty dark blue, with the headline and a stat drawn over it: 32 DAYS.

Threat Intel13 Oct 2026

Progress published 31 MarkLogic flaws 32 days after the fixes shipped, and the August fixes miss them

What Progress's bulletin, release notes and CVE records establish about 31 MarkLogic flaws, what they leave out, the arithmetic behind 32 days, the Cyber Essentials clock, UK guidance and an ordered checklist. Defender level only.

Monday 12 October

A dark server room corner in cool blue light. A pale grey rack-mounted backup appliance with rows of blank black drive bays and a dark blank status display stands in an open black rack beside a tall graphite tape library whose smoked window shows shelves of plain black cartridges with empty pale label windows. The left half is empty dark blue, with the headline and a stat drawn over it: 9.4.

Threat Intel12 Oct 2026

Veeam CVE-2025-64393: a Backup Viewer can run code on the backup server, in version 12 only

What Veeam's advisories establish about the Backup Viewer flaw and the Cloud Connect file read, what they leave out, the fixed build for each version line, the evidence on exploitation, what UK guidance and Cyber Essentials say, and a ranked checklist. Defender level only.

Show 12 more