The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 109 to 132 of 240 briefings

Monday 5 October

Threat Intel5 Oct 2026

Microsoft shipped September's Exchange update twice, 24 days apart, and only the second fixes CVE-2026-96940

The first September update is listed as affected, one of nine CVEs is rated Exploitation More Likely, and the cloud fix has no date. What the record states, what it leaves out, and a UK checklist.

Sunday 4 October

Threat Intel4 Oct 2026

CISA lists a third exploited NetScaler flaw seven days after two others, and Citrix calls it denial of service

A third NetScaler flaw in seven days, scored 8.7 against 9.5 for the first two. What the record states, what it leaves out, why denial of service is not the mild category on a gateway, and where the word patched stops being true.

Threat Intel4 Oct 2026

SConnect was fixed in the app stores 55 days before its CVE, but the desktop host is a separate install

The SConnect token middleware was fixed in the browser stores on 7 August and given a CVE on 1 October. SWIFT's notice says the extension updates itself but the desktop host does not. CISA's coordinator recorded no exploitation on 2 October.

Threat Intel4 Oct 2026

Fortra's BoKS 9.9 advisory names no fixed version, and the update does not secure passwords already generated

The advisory page for BoKS CVE-2026-79901 names no affected version and no fix. The CVE record names both, says the update leaves existing AD service-account passwords unsafe, and gives no 8.1 fix. What is stated, what is not, and what UK teams should do.

Threat Intel4 Oct 2026

Linux implants copy mail appliance names and port 25 traffic. Rapid7's 12 hashes do not say how they got in

Rapid7's 2 October report lists 12 hashes for Linux implants that imitate Korean and Taiwanese mail security appliances, with a payload file that exists for ten seconds. Entry route, victims, first-seen dates and UK exposure are not stated.

Threat Intel4 Oct 2026

At least seven victim actions, no named vulnerability: CloudSyncD launches on a typed password

A fake Zoom disk image runs its backdoor on a password the victim types. Jamf names no vulnerability, victim, actor or delivery route, and never saw the cloudsyncd daemon in use.

Saturday 3 October

Threat Intel3 Oct 2026

Microsoft's median weaponisation time, 'well below 24 hours', comes with no sample, period or source

The headline speed claim cannot be checked from the report. Its other pages give 5.3 hours, single-digit days, about five days and 30 to 60 days for other clocks, and CISA's catalogue gives a median of 3 days for new flaws, 1 day lately.

Threat Intel3 Oct 2026

CVE-2026-61500 was fixed on 13 July. Exploitation was reported 80 days later, within 39 hours of a write-up

The fix is 80 days old, six CVEs shipped with it, CISA's catalogue does not list the flaw, and the exploitation evidence is one firm's sensors. What the record establishes, what it leaves open, and what UK teams running HFS should do.

Threat Intel3 Oct 2026

Antino polls an Outlook mailbox every 10 seconds, over Microsoft hostnames enterprises commonly allow

By Talos’s intervals one Antino implant makes about 10,080 Graph requests a day, to hostnames enterprises commonly allow. What the report states, what it leaves out, and which controls fit a channel whose mailbox the actor owns.

Threat Intel3 Oct 2026

Symantec says Warlock attacked a water utility and a telecom, and names no 2026 SharePoint flaw

Warlock's latest victims include a water utility and a telecom provider. The report names only the 2025 ToolShell flaws, so a build number and a hunt for stolen machine keys matter more than any CVE list.

Threat Intel3 Oct 2026

Dell's CSM advisory has two 10.0 flaws among 13. The 'root on nodes' one is a 9.9 needing low privileges

The two 10.0 flaws are unauthenticated and sit in CSM Authorization, the proxy that holds the array credentials. Root on nodes is a different 9.9 in the operator. Dell names one fix, 1.18.0, and says nothing on exploitation.

Threat Intel3 Oct 2026

FortiMail's exploited flaw has no fixed build in any of four branches, and CISA's deadline is 4 October

No FortiMail build named in the advisory's four branches is fixed on the page as read on 3 October. Fortinet's own records disagree on which builds are affected, and the advisory page lost its file indicators without a revision note.

Page 11

Thursday 1 October

Threat Intel1 Oct 2026

Fake AI committee, borrowed names: all three sender addresses Proofpoint lists are consumer webmail

All three attacker sender addresses in Proofpoint's July list are consumer webmail. A reading of its 1 October report on TA419: what it states, what it leaves out, why MFA and DMARC miss the chain, and an ordered checklist for UK organisations.

Threat Intel1 Oct 2026

MI5 names one Chinese funder and over 100 UK-linked academics, but no university, project or case

The alert is one page and about 470 words. It asserts the funding chain at both ends, says nothing about what UK work gave China's MSS, and asks institutions to establish a funder that NPSA's own collaboration checklist never asks about.

Threat Intel1 Oct 2026

Sucuri says the SC WordPress backdoor lives in at least eight places. Its own report names eleven

Eight files, a database row, a shared-memory segment and scheduled tasks: eleven places in Sucuri's own account of a WordPress backdoor that returns within seconds. What the report states, what it leaves out, and the order to clear it.

Threat Intel1 Oct 2026

A genuine, signed MSP360 installer, disguised as invites and updates, installed a second remote tool

One signed MSP360 installer, five example filenames, a second remote tool, and 60 to 90 days between Microsoft's July sightings and its post. The signer was real; whether you approved it is the control.

Threat Intel1 Oct 2026

TeamViewer's five patched flaws: one scored remote, four local, none known exploited

Five flaws, one fixed build, zero days between release and bulletin. A client updated in August is still listed as affected, and for UK organisations the Cyber Essentials 14-day clock on these fixes ends on 13 October.

Threat Intel1 Oct 2026

LevelBlue adds a fourth NetScaler web shell disguise. Citrix says an update is not a cleanup

Six vendor reports describe four disguises for a NetScaler web shell, and LevelBlue's is the newest. What it states, what it leaves out, why one vendor's file names will not find another's, and what an update does not do.

Threat Intel1 Oct 2026

Entra ID will refuse injected scripts from mid-October, and Microsoft names one impact test: a browser console

From mid-October 2026 the Entra sign-in page will run only Microsoft scripts. Users can still sign in, so a failing tool raises no outage, and Microsoft describes no tenant report. The policy also guards one page only.

Threat Intel1 Oct 2026

CoreGraphics flaw: a public crash test 46 hours after Apple's CVE record, and no proof of a WhatsApp route

A public CoreGraphics crash test is not proof of exploitation, and the WhatsApp path rests on a line the researchers removed. CISA had already moved to active a day earlier. What UK teams should do about iPhones and Macs.

Wednesday 30 September

Threat Intel30 Sept 2026

Zimbra's CVE ID came 24 days after the patch. Microsoft's earliest dated probing is day 8

The dates, the score and the versions checked against Zimbra, NVD, CISA and Microsoft. What a patch does not remove from a hit mail server, the one victim count that exists, and a defender checklist.

Threat Intel30 Sept 2026

A new MikroTik RouterOS flaw is not the exploited one, and CISA changed its fix version from 7.23 to 7.24

CVE-2026-84411 is new, scored 9.8 and not reported exploited. CISA now names 7.24 as the fix, above the newest long-term build 7.23.7, and MikroTik has published no advisory.

Threat Intel30 Sept 2026

Cisco dates the SD-WAN Manager attacks only as 'September', and omits five trains its May table listed

CISA set a federal deadline of Saturday 3 October. What Cisco states and does not, the fix table set against its May one, four names for one flaw, what the UK record says, and a defender checklist.

Threat Intel30 Sept 2026

543,699 working credentials in public GitHub code: at least 63% predate default push protection

What the Truffle Security count establishes, what its dates probably mean, and the gap it names itself: GitHub can block some secrets at push time, but only the issuer can make a leaked key stop working.