The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 133 to 144 of 240 briefings

Wednesday 30 September

Threat Intel30 Sept 2026

Nine of 13 Star Blizzard campaigns are event invitations, and the invitation usually has no attachment

A count of Microsoft's own timeline, an invitation with nothing to scan, and six labels that reassure without controlling anything: what the RedFlick report establishes about Star Blizzard, and what it leaves open.

Threat Intel30 Sept 2026

Spectre BTR: a Linux root hash in 3 to 5 minutes on two Intel chips, with the kernel fix public since July

VUSec and Sant'Anna's Branch Target Reuse attack read a root hash at 8 bytes per second on two Intel chips. Stale predictor entries were reusable on AMD and Arm too, but nothing leaked there. The kernel fix dates from July.

Threat Intel30 Sept 2026

Citrix NetScaler was exploited at least 22 days before the patch. The three-day federal clock ends today

Mandiant, eSentire and GreyNoise now date NetScaler exploitation to before the 27 September bulletin. What Mandiant observed and what it did not, how the exploited pair compares with briefing 143, and what to hunt and harden.

Threat Intel30 Sept 2026

OpenSSL's DTLS leak is scored 8.2 by CISA and 7.4 by Red Hat, and the gap is what OpenSSL did not say

A DTLS retransmission bug can send OpenSSL heap memory to the other side or crash the process. Fixes are public for four branches, premium-only for three and absent for 3.1 to 3.3. No exploitation is reported and no leak size is stated.

Threat Intel30 Sept 2026

Two of at least 40 ClickFix incidents came through a custom GPT, and the chatgpt.com address proved nothing

A confirmed share of at most 5 per cent, four comforting labels and one command the person ran themselves: what Huntress's 28 September report establishes about custom GPTs used as ClickFix lures, and what it leaves open.

Tuesday 29 September

Threat Intel29 Sept 2026

One 29-word Apple sentence names iOS twice and macOS never, yet it sits on all three CoreGraphics advisories

Apple's exploitation notice for CVE-2026-86950 is one 29-word sentence about iOS, repeated on both macOS advisories. Older iOS and macOS lines have no listed fix, and Lockdown Mode cannot be set by MDM.

Monday 28 September

Threat Intel28 Sept 2026

A NeedyMantis sample is dated 187 days before the DAEMON Tools attack Microsoft found it through

Microsoft's earliest dated NeedyMantis sample was first seen on 3 October 2025, 187 days before DAEMON Tools installers were trojanised. The malware hard-codes a Firefox 21 user agent, a browser released in May 2013.

Threat Intel28 Sept 2026

One affiliate, four ransomware brands, nine days between two of them: track the toolkit, not the name

Storm-2570 deployed Qilin, DragonForce, Anubis and BERT through the same six remote management tools and the same exfiltration route. The brand on the ransom note is the part that changes.

Threat Intel28 Sept 2026

852 of 1,235 Meta ads led to 17 toll fraud apps, and Google's takedown did not stop the billing server

A store takedown is a distribution control, not remediation. CERT Polska's toll fraud analysis shows the billing server outliving the Google Play removal, and why a UK premium rate bar may not cover the route this operation used.

Threat Intel28 Sept 2026

The WAF rule blocked one spelling of the path. ShinyHunters used another, 107 days after Oracle's patch

A rule that matches the text of a path is a control on one spelling of an endpoint, not on the endpoint. The attackers read the published guidance and aimed at the organisations that followed half of it.

Threat Intel28 Sept 2026

Citrix fixed eight NetScaler flaws in one bulletin. The three-day federal clock covers two, and neither is the highest scored on NVD's scale

KEV is a list of what is exploited, not a ranking of what is worst, and a three-day deadline makes it very easy to forget that. The Citrix bulletin of 27 September is a clean example of the difference.

Threat Intel28 Sept 2026

CISA's weekly vulnerability bulletin ends today. The largest section of the final edition has no severity at all

CISA is not retiring the bulletin because it failed. It is retiring a faithful record of a model that stopped working, and the final edition shows exactly where it stopped.