The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 157 to 180 of 240 briefings

Friday 25 September

Threat Intel25 Sept 2026

Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

An indicator of compromise is a retrospective artefact. Publishing one says compromise is possible and checkable. Every tool that triages on the exploitation field saw nothing for 47 days.

Threat Intel25 Sept 2026

Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Neither vendor says they are the same thing, and a shared builder sold as a service would explain it too. Either way, a defender reading one report and not the other is missing half the indicators.

Threat Intel25 Sept 2026

The TeamCity entry did not change on Wednesday. One field did, and it is the one your tooling drops

Shadowserver counts about 160 exposed TeamCity servers still unpatched, down from roughly 700. The remaining ones hold build credentials and sign artefacts.

Threat Intel25 Sept 2026

Both of today's additions to the exploited catalogue were public for weeks. The deadline is three days

September now stands at 38 additions to the catalogue, 30 of them on a three day clock. The clock starts when CISA notices, not when the flaw became dangerous.

Threat Intel25 Sept 2026

Roundcube fixed eight flaws in one release and named none of them. The exploited one was line three

Roundcube has eleven entries in the CISA exploited catalogue, more than any other webmail. This one is not among them, four days after a national cyber centre warned about it.

Threat Intel25 Sept 2026

Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

A watch on the root of C: reports filesystem events across every user, with filenames, regardless of permissions. That was enough to identify which of the top 1,000 sites another user was visiting, with an F1 score of 97.8 per cent.

Threat Intel25 Sept 2026

Two CISA advisories, 17 CVEs each scored twice, and the number at the top of both pages is the lower one

Both advisories put a v3 score in their summary table. One of them headlines 8.8 high while the page below it contains a 9.2 critical.

Threat Intel25 Sept 2026

The KEV entry says path traversal. Its own CWE, and both sources it cites, say JWT signature bypass

A defender triaging by the catalogue's own words would hunt for a file upload path. The flaw hands over an administrator session to anyone who signs a token with an algorithm the server never supported.

Thursday 24 September

Threat Intel24 Sept 2026

CISA added 34 flaws to the exploited catalogue in September, and 26 came with a three day deadline

September is the busiest month of 2026 in the Known Exploited Vulnerabilities catalogue, at 1.48 additions a day against a yearly mean of 0.89. The deadline never varies with how hard the change is.

Threat Intel24 Sept 2026

The password spray failed. Seven accounts fell, and not one of them belonged to a person

Six of the seven fell inside seven minutes, which is not guessing. It is one provisioning default, used repeatedly, on accounts nobody had looked at in years.

Threat Intel24 Sept 2026

MikroTik withheld the details for a day. The patch had already published them

CERT Polska has published the full MikroTrick chain. The interesting part is not the bug. It is how little time withholding the details actually bought anyone.

Threat Intel24 Sept 2026

A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Reserved names exist so copied example code cannot reach a live host. Somebody used a real domain instead. Every outbound request to it is now both an exposure and, usefully, a near zero false positive detection.

Page 15

Thursday 24 September

Threat Intel24 Sept 2026

CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Yesterday the advisory gave defenders nothing to search for. Today there are request, response and file indicators, all of them from two firms selling protection. The vendor, the CISA KEV catalogue and the NVD record still say nothing happened.

Threat Intel24 Sept 2026

Entra never sends the password to an external MFA provider. A rogue one can simply ask again

The TrustSink technique does not extract passwords from Entra. It asks users for them a second time, on a full page a third party draws inside a trusted sign-in, and Entra validates only the token that comes back.

Threat Intel24 Sept 2026

A Defender update block with no CVE, and a health report that reads green for seven days

Microsoft says it typically publishes definitions three times a day, and its device health report treats a signature build as current for seven days. A blocked machine can therefore sit about twenty releases behind and still read as protected.

Threat Intel24 Sept 2026

GitLab's issue by email address is a credential, and GitLab presents it as an address

The token inside a GitLab issue by email address does not expire, covers every project the account can reach, and is exempt from IP restrictions. Seven properties, six documentation pages, and one copy button.

Wednesday 23 September

Threat Intel23 Sept 2026

A fake Claude Max giveaway harvests Google logins: the pretext is new, the phishing is not

The only precise figure the fake Claude Max giveaway publishes is 92.5 per cent of slots gone, and it is generated in the visitor's browser. What the research does not establish matters more than what it does.

Threat Intel23 Sept 2026

WordPress patched every branch twice in five days: 7.1.2 fixes an include flaw scored 9.2 and 8.1

The second WordPress core security release in five days fixes an unauthenticated path traversal that selects a PHP file to run, not to read. Two preconditions must hold, and the hardening constant that mattered last week does nothing here.

Threat Intel23 Sept 2026

Four KEV entries, one 61 day gap: Check Point's management server was attacked in July, fixed in September

Two of the four new KEV entries name Check Point, but only one is the management server. The take that fixes the other is the top of the vulnerable range for it. What the four advisories do not state matters more than what they do.

Tuesday 22 September

Threat Intel22 Sept 2026

Four of CISA's nine new ICS advisories are about borrowed code, and the lwIP fixes have no release

Nine ICS advisories, six of them republished Siemens notices, one flaw already on the known exploited list since May, and two fixes that no vendor can simply install. A prioritisation guide for UK OT owners.

Threat Intel22 Sept 2026

D-Link DIR-822A scored 10.0 with a public exploit, and D-Link still cannot say if a fix is coming

D-Link has acknowledged two critical DIR-822A flaws with public exploit code, but the bulletin confirms no hardware revision, no lifecycle status and no firmware fix. The UK PSTI regime would not have helped the owners either.

Threat Intel22 Sept 2026

An ARM64 KVM escape sat in shipping kernels for 348 days, but only nested hosts are exposed

A guest to host escape in Linux KVM on ARM64 reached shipping kernels on 28 September 2025 and was fixed in stable on 11 September 2026. Who is exposed comes down to one boot parameter.

Threat Intel22 Sept 2026

SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Microsoft relabelled CVE-2026-65660 from spoofing (6.5) to remote code execution (8.8) 16 days after release. The fix was always in the August updates; the risk is teams that sorted by the first label.

Threat Intel22 Sept 2026

Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

A second exploited CVSS 10.0 flaw in on-premises VeloCloud Orchestrator in 57 days. Here is how to tell if you are exposed, the patch path by release train, and what Arista says to look for in your logs.