The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 133 to 180 of 241 briefings

Wednesday 30 September

Threat Intel30 Sept 2026

543,699 working credentials in public GitHub code: at least 63% predate default push protection

What the Truffle Security count establishes, what its dates probably mean, and the gap it names itself: GitHub can block some secrets at push time, but only the issuer can make a leaked key stop working.

Editorial illustration for the briefing: Nine of 13 Star Blizzard campaigns are event invitations, and the invitation usually has no attachment

Threat Intel30 Sept 2026

Nine of 13 Star Blizzard campaigns are event invitations, and the invitation usually has no attachment

A count of Microsoft's own timeline, an invitation with nothing to scan, and six labels that reassure without controlling anything: what the RedFlick report establishes about Star Blizzard, and what it leaves open.

Threat Intel30 Sept 2026

Spectre BTR: a Linux root hash in 3 to 5 minutes on two Intel chips, with the kernel fix public since July

VUSec and Sant'Anna's Branch Target Reuse attack read a root hash at 8 bytes per second on two Intel chips. Stale predictor entries were reusable on AMD and Arm too, but nothing leaked there. The kernel fix dates from July.

Editorial illustration for the briefing: Citrix NetScaler was exploited at least 22 days before the patch. The three-day federal clock ends today

Threat Intel30 Sept 2026

Citrix NetScaler was exploited at least 22 days before the patch. The three-day federal clock ends today

Mandiant, eSentire and GreyNoise now date NetScaler exploitation to before the 27 September bulletin. What Mandiant observed and what it did not, how the exploited pair compares with briefing 143, and what to hunt and harden.

Threat Intel30 Sept 2026

OpenSSL's DTLS leak is scored 8.2 by CISA and 7.4 by Red Hat, and the gap is what OpenSSL did not say

A DTLS retransmission bug can send OpenSSL heap memory to the other side or crash the process. Fixes are public for four branches, premium-only for three and absent for 3.1 to 3.3. No exploitation is reported and no leak size is stated.

Editorial illustration for the briefing: Two of at least 40 ClickFix incidents came through a custom GPT, and the chatgpt.com address proved nothing

Threat Intel30 Sept 2026

Two of at least 40 ClickFix incidents came through a custom GPT, and the chatgpt.com address proved nothing

A confirmed share of at most 5 per cent, four comforting labels and one command the person ran themselves: what Huntress's 28 September report establishes about custom GPTs used as ClickFix lures, and what it leaves open.

Tuesday 29 September

Editorial illustration for the briefing: One 29-word Apple sentence names iOS twice and macOS never, yet it sits on all three CoreGraphics advisories

Threat Intel29 Sept 2026

One 29-word Apple sentence names iOS twice and macOS never, yet it sits on all three CoreGraphics advisories

Apple's exploitation notice for CVE-2026-86950 is one 29-word sentence about iOS, repeated on both macOS advisories. Older iOS and macOS lines have no listed fix, and Lockdown Mode cannot be set by MDM.

Monday 28 September

Threat Intel28 Sept 2026

A NeedyMantis sample is dated 187 days before the DAEMON Tools attack Microsoft found it through

Microsoft's earliest dated NeedyMantis sample was first seen on 3 October 2025, 187 days before DAEMON Tools installers were trojanised. The malware hard-codes a Firefox 21 user agent, a browser released in May 2013.

Threat Intel28 Sept 2026

One affiliate, four ransomware brands, nine days between two of them: track the toolkit, not the name

Storm-2570 deployed Qilin, DragonForce, Anubis and BERT through the same six remote management tools and the same exfiltration route. The brand on the ransom note is the part that changes.

Threat Intel28 Sept 2026

852 of 1,235 Meta ads led to 17 toll fraud apps, and Google's takedown did not stop the billing server

A store takedown is a distribution control, not remediation. CERT Polska's toll fraud analysis shows the billing server outliving the Google Play removal, and why a UK premium rate bar may not cover the route this operation used.

Threat Intel28 Sept 2026

The WAF rule blocked one spelling of the path. ShinyHunters used another, 107 days after Oracle's patch

A rule that matches the text of a path is a control on one spelling of an endpoint, not on the endpoint. The attackers read the published guidance and aimed at the organisations that followed half of it.

Editorial illustration for the briefing: Citrix fixed eight NetScaler flaws in one bulletin. The federal three-day clock covers two, and neither is the highest scored

Threat Intel28 Sept 2026

Citrix fixed eight NetScaler flaws in one bulletin. The three-day federal clock covers two, and neither is the highest scored on NVD's scale

KEV is a list of what is exploited, not a ranking of what is worst, and a three-day deadline makes it very easy to forget that. The Citrix bulletin of 27 September is a clean example of the difference.

Page 13

Monday 28 September

Editorial illustration for the briefing: CISA's weekly vulnerability bulletin ends today. The largest section of the final edition has no severity at all

Threat Intel28 Sept 2026

CISA's weekly vulnerability bulletin ends today. The largest section of the final edition has no severity at all

CISA is not retiring the bulletin because it failed. It is retiring a faithful record of a model that stopped working, and the final edition shows exactly where it stopped.

Saturday 26 September

Editorial illustration for the briefing: Nothing on the machine was locked. Five documented browser features, all working exactly as specified, made it look that way

Threat Intel26 Sept 2026

Nothing on the machine was locked. Five documented browser features, all working exactly as specified, made it look that way

There is no malware in this chain and nothing on the computer is affected. The product being manufactured is panic, and the delivery is ordinary paid advertising through uncompromised publishers.

Threat Intel26 Sept 2026

The marketplace listed 321,372 products to 18,000 users. In nine years it made 7,600 sales and $232,000

A listing is not a sale and a registered account is not a customer. The Rydox court record contains both measures, and the gap between them is the story that the word marketplace hides.

Editorial illustration for the briefing: Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

Threat Intel26 Sept 2026

Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

A clean result from an automated check is not an observation about the site. It is a decision the operator made about the checker, and this chain makes that decision at three independent points.

Threat Intel26 Sept 2026

Every link in this chain is a legitimate paid service. The only malicious artefact is a configuration

The impersonated products do not exist: none of the three payroll platforms ships a desktop app. Allure Security counted 291 downloads and said plainly that some of them were researchers.

Editorial illustration for the briefing: Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Threat Intel26 Sept 2026

Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Nobody in this story was slow. The flaw is a CSRF check that skips validation whenever a literal string appears anywhere in the request URI, and the query string is written by whoever composes the link.

Editorial illustration for the briefing: The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

Threat Intel26 Sept 2026

The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

What eventually forced the backport was a ransomware gang's leak site being defaced. Grav shipped a 1.7 fix the day after the details became public, 144 days after the advisory.

Editorial illustration for the briefing: Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

Threat Intel26 Sept 2026

Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

The flaw that gains the most, 8.1 to 9.2, is a firmware verification weakness on a dashcam with no fix, from a vendor that has not responded to CISA. A robot vacuum is filed under Information Technology.

Threat Intel26 Sept 2026

The catalogue calls it path traversal. Its own CWE, and both sources it cites, say authentication bypass

The structured data is right and the prose is wrong, which is the failure mode of every hand-written label sitting beside machine-readable fields. A team triaging by name goes hunting for the wrong thing.

Threat Intel26 Sept 2026

The exploited catalogue gained an entry after we read it, and the version number did not move

Anything that caches on the version saw no change. The third entry is a WordPress Core remote file inclusion flagged for forensic triage, and a day later the trade press was still reporting two.

Threat Intel26 Sept 2026

Canada says this flaw is being exploited. CISA's own machine-readable record, three days later, says none

Two allied national cyber bodies, one CVE, three days apart, opposite conclusions. Neither is reading a sensor. Both are reasoning over the same thin public record, which is the part worth understanding.

Friday 25 September

Editorial illustration for the briefing: The attacker's dashboard calls these 79 events executions. The researchers who found it refuse the word

Threat Intel25 Sept 2026

The attacker's dashboard calls these 79 events executions. The researchers who found it refuse the word

A fake verification page that verifies nothing, measured by a panel that counts interface progress and labels it execution. The gap between an event and the thing it is named after is the entire story.

Page 14

Friday 25 September

Editorial illustration for the briefing: Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Threat Intel25 Sept 2026

Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Two controls are not implemented at all, one is a stub that reports success without reading anything, and the self destruct does not uninstall or undo the damage. Your own device management console is read exactly the same way.

Editorial illustration for the briefing: Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

Threat Intel25 Sept 2026

Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

An indicator of compromise is a retrospective artefact. Publishing one says compromise is possible and checkable. Every tool that triages on the exploitation field saw nothing for 47 days.

Editorial illustration for the briefing: Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Threat Intel25 Sept 2026

Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Neither vendor says they are the same thing, and a shared builder sold as a service would explain it too. Either way, a defender reading one report and not the other is missing half the indicators.

Threat Intel25 Sept 2026

The TeamCity entry did not change on Wednesday. One field did, and it is the one your tooling drops

Shadowserver counts about 160 exposed TeamCity servers still unpatched, down from roughly 700. The remaining ones hold build credentials and sign artefacts.

Threat Intel25 Sept 2026

Both of today's additions to the exploited catalogue were public for weeks. The deadline is three days

September now stands at 38 additions to the catalogue, 30 of them on a three day clock. The clock starts when CISA notices, not when the flaw became dangerous.

Threat Intel25 Sept 2026

Roundcube fixed eight flaws in one release and named none of them. The exploited one was line three

Roundcube has eleven entries in the CISA exploited catalogue, more than any other webmail. This one is not among them, four days after a national cyber centre warned about it.

Editorial illustration for the briefing: Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

Threat Intel25 Sept 2026

Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

A watch on the root of C: reports filesystem events across every user, with filenames, regardless of permissions. That was enough to identify which of the top 1,000 sites another user was visiting, with an F1 score of 97.8 per cent.

Threat Intel25 Sept 2026

Two CISA advisories, 17 CVEs each scored twice, and the number at the top of both pages is the lower one

Both advisories put a v3 score in their summary table. One of them headlines 8.8 high while the page below it contains a 9.2 critical.

Threat Intel25 Sept 2026

The KEV entry says path traversal. Its own CWE, and both sources it cites, say JWT signature bypass

A defender triaging by the catalogue's own words would hunt for a file upload path. The flaw hands over an administrator session to anyone who signs a token with an algorithm the server never supported.

Thursday 24 September

Threat Intel24 Sept 2026

CISA added 34 flaws to the exploited catalogue in September, and 26 came with a three day deadline

September is the busiest month of 2026 in the Known Exploited Vulnerabilities catalogue, at 1.48 additions a day against a yearly mean of 0.89. The deadline never varies with how hard the change is.

Threat Intel24 Sept 2026

The password spray failed. Seven accounts fell, and not one of them belonged to a person

Six of the seven fell inside seven minutes, which is not guessing. It is one provisioning default, used repeatedly, on accounts nobody had looked at in years.

Threat Intel24 Sept 2026

MikroTik withheld the details for a day. The patch had already published them

CERT Polska has published the full MikroTrick chain. The interesting part is not the bug. It is how little time withholding the details actually bought anyone.

Page 15

Thursday 24 September

Editorial illustration for the briefing: A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Threat Intel24 Sept 2026

A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Reserved names exist so copied example code cannot reach a live host. Somebody used a real domain instead. Every outbound request to it is now both an exposure and, usefully, a near zero false positive detection.

Editorial illustration for the briefing: CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Threat Intel24 Sept 2026

CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Yesterday the advisory gave defenders nothing to search for. Today there are request, response and file indicators, all of them from two firms selling protection. The vendor, the CISA KEV catalogue and the NVD record still say nothing happened.

Threat Intel24 Sept 2026

Entra never sends the password to an external MFA provider. A rogue one can simply ask again

The TrustSink technique does not extract passwords from Entra. It asks users for them a second time, on a full page a third party draws inside a trusted sign-in, and Entra validates only the token that comes back.

Threat Intel24 Sept 2026

A Defender update block with no CVE, and a health report that reads green for seven days

Microsoft says it typically publishes definitions three times a day, and its device health report treats a signature build as current for seven days. A blocked machine can therefore sit about twenty releases behind and still read as protected.

Threat Intel24 Sept 2026

GitLab's issue by email address is a credential, and GitLab presents it as an address

The token inside a GitLab issue by email address does not expire, covers every project the account can reach, and is exempt from IP restrictions. Seven properties, six documentation pages, and one copy button.

Wednesday 23 September

Threat Intel23 Sept 2026

A fake Claude Max giveaway harvests Google logins: the pretext is new, the phishing is not

The only precise figure the fake Claude Max giveaway publishes is 92.5 per cent of slots gone, and it is generated in the visitor's browser. What the research does not establish matters more than what it does.

Threat Intel23 Sept 2026

WordPress patched every branch twice in five days: 7.1.2 fixes an include flaw scored 9.2 and 8.1

The second WordPress core security release in five days fixes an unauthenticated path traversal that selects a PHP file to run, not to read. Two preconditions must hold, and the hardening constant that mattered last week does nothing here.

Threat Intel23 Sept 2026

Four KEV entries, one 61 day gap: Check Point's management server was attacked in July, fixed in September

Two of the four new KEV entries name Check Point, but only one is the management server. The take that fixes the other is the top of the vulnerable range for it. What the four advisories do not state matters more than what they do.

Tuesday 22 September

Editorial illustration for the briefing: Four of CISA's nine new ICS advisories are about borrowed code, and the lwIP fixes have no release

Threat Intel22 Sept 2026