The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 157 to 241 of 241 briefings

Friday 25 September

Editorial illustration for the briefing: Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Threat Intel25 Sept 2026

Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Two controls are not implemented at all, one is a stub that reports success without reading anything, and the self destruct does not uninstall or undo the damage. Your own device management console is read exactly the same way.

Editorial illustration for the briefing: Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

Threat Intel25 Sept 2026

Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

An indicator of compromise is a retrospective artefact. Publishing one says compromise is possible and checkable. Every tool that triages on the exploitation field saw nothing for 47 days.

Editorial illustration for the briefing: Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Threat Intel25 Sept 2026

Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Neither vendor says they are the same thing, and a shared builder sold as a service would explain it too. Either way, a defender reading one report and not the other is missing half the indicators.

Threat Intel25 Sept 2026

The TeamCity entry did not change on Wednesday. One field did, and it is the one your tooling drops

Shadowserver counts about 160 exposed TeamCity servers still unpatched, down from roughly 700. The remaining ones hold build credentials and sign artefacts.

Threat Intel25 Sept 2026

Both of today's additions to the exploited catalogue were public for weeks. The deadline is three days

September now stands at 38 additions to the catalogue, 30 of them on a three day clock. The clock starts when CISA notices, not when the flaw became dangerous.

Threat Intel25 Sept 2026

Roundcube fixed eight flaws in one release and named none of them. The exploited one was line three

Roundcube has eleven entries in the CISA exploited catalogue, more than any other webmail. This one is not among them, four days after a national cyber centre warned about it.

Editorial illustration for the briefing: Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

Threat Intel25 Sept 2026

Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

A watch on the root of C: reports filesystem events across every user, with filenames, regardless of permissions. That was enough to identify which of the top 1,000 sites another user was visiting, with an F1 score of 97.8 per cent.

Threat Intel25 Sept 2026

Two CISA advisories, 17 CVEs each scored twice, and the number at the top of both pages is the lower one

Both advisories put a v3 score in their summary table. One of them headlines 8.8 high while the page below it contains a 9.2 critical.

Threat Intel25 Sept 2026

The KEV entry says path traversal. Its own CWE, and both sources it cites, say JWT signature bypass

A defender triaging by the catalogue's own words would hunt for a file upload path. The flaw hands over an administrator session to anyone who signs a token with an algorithm the server never supported.

Thursday 24 September

Threat Intel24 Sept 2026

CISA added 34 flaws to the exploited catalogue in September, and 26 came with a three day deadline

September is the busiest month of 2026 in the Known Exploited Vulnerabilities catalogue, at 1.48 additions a day against a yearly mean of 0.89. The deadline never varies with how hard the change is.

Threat Intel24 Sept 2026

The password spray failed. Seven accounts fell, and not one of them belonged to a person

Six of the seven fell inside seven minutes, which is not guessing. It is one provisioning default, used repeatedly, on accounts nobody had looked at in years.

Threat Intel24 Sept 2026

MikroTik withheld the details for a day. The patch had already published them

CERT Polska has published the full MikroTrick chain. The interesting part is not the bug. It is how little time withholding the details actually bought anyone.

Page 15

Thursday 24 September

Editorial illustration for the briefing: A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Threat Intel24 Sept 2026

A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Reserved names exist so copied example code cannot reach a live host. Somebody used a real domain instead. Every outbound request to it is now both an exposure and, usefully, a near zero false positive detection.

Editorial illustration for the briefing: CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Threat Intel24 Sept 2026

CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Yesterday the advisory gave defenders nothing to search for. Today there are request, response and file indicators, all of them from two firms selling protection. The vendor, the CISA KEV catalogue and the NVD record still say nothing happened.

Threat Intel24 Sept 2026

Entra never sends the password to an external MFA provider. A rogue one can simply ask again

The TrustSink technique does not extract passwords from Entra. It asks users for them a second time, on a full page a third party draws inside a trusted sign-in, and Entra validates only the token that comes back.

Threat Intel24 Sept 2026

A Defender update block with no CVE, and a health report that reads green for seven days

Microsoft says it typically publishes definitions three times a day, and its device health report treats a signature build as current for seven days. A blocked machine can therefore sit about twenty releases behind and still read as protected.

Threat Intel24 Sept 2026

GitLab's issue by email address is a credential, and GitLab presents it as an address

The token inside a GitLab issue by email address does not expire, covers every project the account can reach, and is exempt from IP restrictions. Seven properties, six documentation pages, and one copy button.

Wednesday 23 September

Threat Intel23 Sept 2026

A fake Claude Max giveaway harvests Google logins: the pretext is new, the phishing is not

The only precise figure the fake Claude Max giveaway publishes is 92.5 per cent of slots gone, and it is generated in the visitor's browser. What the research does not establish matters more than what it does.

Threat Intel23 Sept 2026

WordPress patched every branch twice in five days: 7.1.2 fixes an include flaw scored 9.2 and 8.1

The second WordPress core security release in five days fixes an unauthenticated path traversal that selects a PHP file to run, not to read. Two preconditions must hold, and the hardening constant that mattered last week does nothing here.

Threat Intel23 Sept 2026

Four KEV entries, one 61 day gap: Check Point's management server was attacked in July, fixed in September

Two of the four new KEV entries name Check Point, but only one is the management server. The take that fixes the other is the top of the vulnerable range for it. What the four advisories do not state matters more than what they do.

Tuesday 22 September

Threat Intel22 Sept 2026

Four of CISA's nine new ICS advisories are about borrowed code, and the lwIP fixes have no release

Nine ICS advisories, six of them republished Siemens notices, one flaw already on the known exploited list since May, and two fixes that no vendor can simply install. A prioritisation guide for UK OT owners.

Threat Intel22 Sept 2026

D-Link DIR-822A scored 10.0 with a public exploit, and D-Link still cannot say if a fix is coming

D-Link has acknowledged two critical DIR-822A flaws with public exploit code, but the bulletin confirms no hardware revision, no lifecycle status and no firmware fix. The UK PSTI regime would not have helped the owners either.

Threat Intel22 Sept 2026

An ARM64 KVM escape sat in shipping kernels for 348 days, but only nested hosts are exposed

A guest to host escape in Linux KVM on ARM64 reached shipping kernels on 28 September 2025 and was fixed in stable on 11 September 2026. Who is exposed comes down to one boot parameter.

Editorial illustration for the briefing: SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Threat Intel22 Sept 2026

SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Microsoft relabelled CVE-2026-65660 from spoofing (6.5) to remote code execution (8.8) 16 days after release. The fix was always in the August updates; the risk is teams that sorted by the first label.

Page 16

Tuesday 22 September

Editorial illustration for the briefing: Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

Threat Intel22 Sept 2026

Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

A second exploited CVSS 10.0 flaw in on-premises VeloCloud Orchestrator in 57 days. Here is how to tell if you are exposed, the patch path by release train, and what Arista says to look for in your logs.

Threat Intel22 Sept 2026

A Microsoft-signed driver kills 145 security tools, and Microsoft's own blocklist did not stop it

Alinubx.sys carries a 2023 Microsoft hardware signature, kills 145 AV and EDR processes, and was not on Microsoft's vulnerable driver blocklist at publication. What the blocklist, HVCI and the ASR rule do and do not cover.

A closed laptop and a paper comment card on a desk beside a brass padlock and a sealed envelope, lit by a desk lamp

Threat Intel22 Sept 2026

WordPress fixed Comment2Shell in 25 releases on one day; check yours is one of them, and that no plugin arrived first

WordPress core shipped 25 security releases on 17 September for a comment XSS that can reach an administrator's session. What to confirm, which wp-config setting actually blocks plugin upload, and why updating does not remove a plugin already added.

Editorial illustration for the briefing: Defender can report protected while its updates stall: how to prove signatures are current across an estate

Threat Intel22 Sept 2026

Defender can report protected while its updates stall: how to prove signatures are current across an estate

BigDiskBuster, released on 19 to 20 September 2026, keeps Defender on whatever signatures it already has. Microsoft's own reports can call a device up to date for seven days. Here is how to measure currency, not status.

Editorial illustration for the briefing: Only the Zyxel switch flaw is in CISA's KEV; the Veeam agent exploitation claim rests on one vendor headline

Threat Intel22 Sept 2026

Only the Zyxel switch flaw is in CISA's KEV; the Veeam agent exploitation claim rests on one vendor headline

CVE-2026-7273 in Zyxel GS1900 switches entered KEV on 21 September with a 24 September deadline after GreyNoise documented data theft from 996 switches. CVE-2026-32996 in Veeam Agent for Windows has a public PoC but no KEV entry.

Threat Intel22 Sept 2026

Talos's CLOSEDQUORUM lets four LLMs vote on an implant's next move, but the only public build is inert

CLOSEDQUORUM asks DeepSeek, Qwen, Mistral and Gemini which of four attack actions to take, then acts on the plurality. Talos found placeholder keys, no confirmed victims and a narrower first than the headline suggests.

Monday 21 September

Threat Intel21 Sept 2026

A Windows privilege fix that held 28 days: Project Zero on dangling COM registrations

A COM class that points at a DLL that does not exist is not harmless. Project Zero shows how a dangling registration in a writable path becomes SYSTEM, and how to audit your estate for the same pattern.

Editorial illustration for the briefing: Fake interviews target Rust maintainers' publishing rights, and arrayref showed what one stolen account does

Threat Intel21 Sept 2026

Fake interviews target Rust maintainers' publishing rights, and arrayref showed what one stolen account does

Rust maintainers are being lured onto video calls to install a fake audio codec or paste a command. The arrayref release of 20 August, downloaded 2,285 times in 86 minutes, shows why their accounts are the prize.

Threat Intel21 Sept 2026

ChainScript's operator moved its C2 twice for a quarter of a cent, and the blockchain logged both moves

ChainScript turns a pasted Win+R command into a per-user MSI, a hidden Node.js agent and a C2 address stored on the Polygon blockchain. Here is the chain step by step, why the pointer survives takedown, and the controls that still work.

Editorial illustration for the briefing: North Korea's TraderTraitor put macOS backdoors on an Indian IT provider, and the delivery was never proven

Threat Intel21 Sept 2026

North Korea's TraderTraitor put macOS backdoors on an Indian IT provider, and the delivery was never proven

The same two Jade Sleet backdoors that helped take 292 million dollars from KelpDAO turned up on an Indian IT provider with no crypto ties. What the vendor established, what it did not, and what UK firms that outsource to Indian MSPs should ask this week.

Threat Intel21 Sept 2026

Google's mole inside TeamPCP saw 500,000 stolen credentials and a gang that could barely cash them

TeamPCP stole more than 500,000 credentials but, by Google's estimate, made only tens of thousands of dollars. What an undercover analyst saw, what rests only on one researcher's account, and what UK engineering teams should change.

Threat Intel21 Sept 2026

TASK#STOMP: a PowerShell backdoor hiding in native Windows tools that already log it

TASK#STOMP relies almost entirely on wscript, PowerShell, Task Scheduler and the .NET compiler, so it leaves no conventional executable to catch. It also leaves a script block log, a task creation event and an AMSI scan behind at every step. The report does not name a victim, sector or attacker.

Page 17

Monday 21 September

Editorial illustration for the briefing: PAYLOAD ransomware hit a whole Windows domain through two Group Policy objects and no endpoint malware

Threat Intel21 Sept 2026

PAYLOAD ransomware hit a whole Windows domain through two Group Policy objects and no endpoint malware

Two GPOs, six settings, no Windows malware: how PAYLOAD used Group Policy for domain-wide extortion, what Kaspersky could not establish, and the Microsoft audit events that would have seen it.

Sunday 20 September

A smartphone sits on a mobile forensics bench with a hidden debugging connection extending beyond the app.

Threat Intel20 Sept 2026

RatHat pairs with its own Android Debug Bridge. Uninstalling the APK can leave the shell behind

A step-by-step analysis of RatHat's Accessibility abuse, local ADB self-pairing, native persistence, credential theft and defensive controls.

An engineer compares three conflicting software component manifests beside a dependency graph.

Threat Intel20 Sept 2026

Three SBOM tools scanned the same projects and disagreed. CRA compliance cannot be a generator checkbox

The new SBOM study quantifies tool disagreement and shows what manufacturers should validate before the Cyber Resilience Act applies in full.

Two hostile server clusters exchange warning signals across a dark network as one leak portal is overtaken.

Threat Intel20 Sept 2026

ShinyHunters defaced Clop’s leak site. The page proves write access, not stolen onion keys

The Clop defacement is confirmed at the presentation layer. The evidence does not yet establish server root, victim-data access or control of the onion identity.

Saturday 19 September

Threat Intel19 Sept 2026

Fake interviews exploited at least 30,000 PCs in eight months, and the wallets were the cheap part

A joint advisory of 18 September 2026 puts at least 30,000 exploited PCs and over 7,000 drained cryptocurrency wallets behind a fake recruitment campaign. The arithmetic says the access, not the crypto, was the product. No UK victim is named.

Threat Intel19 Sept 2026

GitHub removed the fake LastPass repositories. Four of the six Rapuncel domains still resolve

Fake GitHub organisations impersonating LastPass Authenticator ranked in search and delivered an infostealer behind a Microsoft signed driver that terminates 145 security products. The repositories are gone. Most of the delivery chain is not.

Threat Intel19 Sept 2026

A leaver's OAuth token copied about 170 CrowdSec private repositories, and the audit log never saw it

About 170 private CrowdSec repositories were cloned in nine minutes and four seconds on 22 May 2026, using the account of a developer who had just left. GitHub's own documentation explains why the organisation audit log was empty.

Threat Intel19 Sept 2026

WordPress Click2Shell: the forced theme install still needs an administrator to open the link

The forced theme install is real, the chain to code execution is real, and both run on an administrator's session. Here is what WordPress fixed, in which versions, and what its own release notes do not say.

Threat Intel19 Sept 2026

CISA's three Linux kernel KEV entries and the four public root exploits are seven different flaws

Three Linux kernel CVEs entered CISA's KEV catalogue on 18 September 2026 and four others got public local root exploits the same day. No CVE appears on both lists, and the patch state differs sharply between them.

Threat Intel19 Sept 2026

Conductor's 9.8 was patched 27 days before it had a CVE, and CISA's exploited list still has no entry

CVE-2026-58138 lets anyone who can reach an unpatched Conductor server run operating system commands on it. The open-source build has no authentication to bypass, and the orchestrator holds credentials for everything it orchestrates.

Friday 18 September

Editorial illustration for the briefing: WeaselBiscuit ran on import, not install, so ignore-scripts would not have stopped any of the 17 npm packages

Threat Intel18 Sept 2026

WeaselBiscuit ran on import, not install, so ignore-scripts would not have stopped any of the 17 npm packages

WeaselBiscuit executed on import rather than install, so the standard ignore-scripts control sat at the wrong gate. Every package is now gone from npm, median takedown under 13 hours. Here is what it could actually reach.

Threat Intel18 Sept 2026

Unauthenticated root on a Check Point management server, triggered by an over-long username at login

CVE-2026-91843 lets an unauthenticated attacker run code as root on Check Point Security Management, Multi-Domain and Log Servers. The advisory names eleven affected version bands and offers four packages. No exploitation is reported and one indicator is published.

Page 18

Thursday 17 September

A tall stack of printed listings with a red tab and a long printout spilling off a desk beside a calendar and a laptop.

Threat Intel17 Sept 2026

CISA ends its weekly vulnerability bulletin, a CVSS-sorted digest that never flagged exploitation

CISA retires its weekly Vulnerability Bulletin on 28 September. We parsed 70 issues: it was a CVSS-sorted copy of CVE records, with no exploitation signal, long gaps and a "Not Yet Assigned" table that hid CVSS 10.0 exploited flaws.

A brass seal stamp and a broken red wax seal on papers beside a laptop and a key on a dark desk.

Threat Intel17 Sept 2026

KREMLIN forges Chrome's integrity check to load an extension the user never approved

KREMLIN copies an extension into Chrome and Edge, enables developer mode and regenerates the Secure Preferences integrity MACs so the browser loads it as approved. It changes what an ExtensionSettings allowlist can and cannot promise.

A phone standing in a charging rack of devices, with a SIM card and another phone, below a wall calendar marked in red.

Threat Intel17 Sept 2026

Exploited Pixel modem flaw is rated High, not Critical, and Google has not said who was targeted

The Pixel modem zero-day is real and fixed at patch level 2026-09-05. The record names no targets, no attacker and no chain, and CISA's CVSS score moved from 8.0 to 8.8 within a day with nothing new from Google.

A grey network appliance, a lanyard ID badge, an hourglass and a laptop on a steel shelf beside a dimly lit server aisle.

Threat Intel17 Sept 2026

Cisco ISE needs no login, the Acronis cPanel flaw needs a foothold: one KEV deadline, two different risks

An unauthenticated root path into Cisco ISE and a local privilege escalation in Acronis's cPanel backup plugin entered KEV together. What each attacker needs first, what fixes it, and what the three-day clock means in the UK.

A rack-mounted mail appliance pulled out of its rack in a data centre aisle, its amber beacon lit and envelopes spilling across the floor.

Threat Intel17 Sept 2026

Cisco's exploited email gateway flaw: three days to patch, and patching starts the investigation

CVE-2026-76461 lets a crafted email run root commands on Cisco Secure Email Gateway. The KEV deadline is today. The upgrade closes the hole; it does not tell you whether the gateway, and the credentials it holds, were already taken.

Wednesday 16 September

A kitchen table at night used as a desk: an open personal laptop with a dark screen lit by a single warm lamp, a phone face up beside it, and at the far edge in cold light a closed corporate laptop in a sleeve with a coiled security cable and a lanyard.

Threat Intel16 Sept 2026

When the managed device holds, this spyware asks for the personal one

Read from the joint advisory in full. A unique Telegram bot per victim removes the pivot defenders rely on, and the escalation to personal devices lands outside every control on the asset register.

Monday 14 September

An intelligence analysis room linking public photographs to broad map probability rings, human review and a simulated drone.

Threat Intel14 Sept 2026

Anthropic's models can geolocate a photograph and write simulated drone guidance. The missing number is human uplift

A careful reading of Anthropic's targeting and conventional-weapons evaluations, including the 37 km geolocation result, simulated strike rates, limitations and practical controls.

Sunday 13 September

AI-generated editorial scene of an invoice awaiting approval beside a laptop and desk telephone in a finance office at night.

Threat Intel13 Sept 2026

Microsoft traced more than 1 million executive-impersonation emails. The payment control still failed off-screen.

Microsoft details a million-message executive impersonation campaign built around fake invoices and payment requests.

AI-generated editorial photograph of an unbranded VPN gateway, certificate card and key in a dark network operations room.

Threat Intel13 Sept 2026

Check Point patches two VPN flaws that can enable unauthenticated RCE. It reports no exploitation.

Check Point has remediated two critical VPN-related flaws and says it has no indication of active exploitation.

AI-generated editorial photograph of an unbranded firewall management appliance with an open panel and red warning light.

Threat Intel13 Sept 2026

Cisco confirms exploitation of CVE-2026-20079. An FMC web request can lead to root.

Cisco confirms active exploitation of a critical Secure FMC authentication bypass that can provide root access.

AI-generated security editorial scene of a protected document escaping from a locked repository archive drawer.

Threat Intel13 Sept 2026

GitLab fixes a CVSS 10 file-read flaw. Internet probes appeared one day later.

GitLab’s critical patch closes an unauthenticated arbitrary-file-read route in the repository commits API.

$AI-generated threat-intelligence still life of three fractured security layers surrounded by four evidence cases.$

Threat Intel13 Sept 2026

BlueMoon chains 3 zero-days across Chrome and Windows. Four espionage groups adopted it in days.

Four espionage groups adopted BlueMoon, a shared chain joining two Chrome V8 vulnerabilities with a Windows kernel elevation flaw.

Page 19

Wednesday 9 September

Threat Intel9 Sept 2026

Two Tanium report permissions can become code execution. Three release branches need checking.

Comply has two distinct access paths in these advisories. The fixed module versions matter more than a platform-level update checkbox.

Tuesday 8 September

An empty out-of-hours IT operations desk during a night maintenance window: two dark switched-off monitors, a keyboard pushed askew, a mug of tea with a spoon, a clipboard holding a printed checklist with lines ticked in biro, headphones and a notepad, lit by a single desk lamp, with a server rack of amber and green standby lights visible through a glass partition behind.

Threat Intel8 Sept 2026

Two perfect scores in this Patch Tuesday need no action. The two being exploited score 7.8.

Read from Microsoft's own CVRF. Nothing is publicly disclosed, the 1,170 figure is a month's accumulation, and the field to check is Customer Action Required.

A small online retailer's despatch bench at night after closing: three sealed plain cardboard parcels stacked under a caged work lamp, a small thermal label printer with a curl of blank labels spilling onto the bench, a black card payment terminal with a dark screen, a roll of packing tape and scissors, with racking of plain stock cartons receding into shadow behind.

Threat Intel8 Sept 2026

Adobe told Commerce merchants to rotate their payment gateway keys. The coverage stopped at the patch.

Read from Adobe's own bulletin, the NVD record and CISA's catalogue. A fully patched store was still taken, and the catalogue has not moved since Friday.

Monday 7 September

A small unbranded network router with external aerials on a steel bench at night, its lid removed to expose a green circuit board, yellow and blue patch leads looping from its ports, an amber status light lit, with a blurred terminal display behind it.

Threat Intel7 Sept 2026

A national CERT found six RouterOS flaws with a cyber model, and wrote down exactly what the model did not do

MikroTrick, the indicators of compromise, and the methodology section almost nobody quoted. The vendor's own detection marker does not prove a device is clean, and CERT Polska say so.

An unbranded rack-mounted network appliance pulled half out of a dark server rack on its slide rails, network cables hanging loose beneath it, lit by a hard torch beam from the right.

Threat Intel7 Sept 2026

SonicWall's exploited SMA 1000 flaws need four remediation steps, and almost everyone reported one

Vendor-confirmed exploitation, a KEV deadline that expired on Saturday, and a remediation procedure that assumes you may already be compromised.

Saturday 5 September

A grid of dark stained wooden library card catalogue drawers photographed at a raking angle, each with a tarnished brass label frame catching the light. Every label frame is empty.

Threat Intel5 Sept 2026

Cisco found these with frontier AI models, grouped them into seven umbrella CVEs, and never said how many bugs there are

The most consequential sentence in the IOS XR advisory is the one about how the flaws were found, and almost every write-up removed it. What follows from it is a counting problem.

A pair of heavy brushed-steel doors standing almost closed in a dark concrete room, with a narrow vertical sliver of hard white light spilling through the gap and laying a thin bright wedge across the floor.

Threat Intel5 Sept 2026

The KEV remediation window fell from 21 days to three, and the 60-day tier everyone quotes has never existed

A directive reported as reducing the patching burden coincides with the most aggressive tier becoming the default on three quarters of new entries. Two opposite errors are circulating about it.

Thursday 3 September

A single deep crimson wax seal, freshly pressed and glossy, on a sheet of near-black paper, lit by a cold white rim light from the right. The seal is smooth and unstamped, carrying no crest, monogram or mark of any kind.

Threat Intel3 Sept 2026

A BGP hijack delivered a malicious Virtualizor update, and the TLS certificate on it was genuine

AS62390 announced a Hetzner /24 for 33 hours, diverting Softaculous update traffic. Let's Encrypt issued a valid certificate because its own domain validation was routed through the hijack.

A single small blank white index card lying on a vast matte charcoal surface, lit by a cold rim light from the right, the left half of the frame falling away into near-black. The card is entirely unprinted.

Threat Intel3 Sept 2026

The whole public evidence base for this morning's Falcon zero-day is 744 characters, and two of its sentences did not survive the retelling.

Exploit code for an unpatched local privilege escalation in CrowdStrike Falcon Sensor appeared at 02:48 UTC. The README contains two qualifications the coverage has dropped.

Wednesday 2 September

A machined dark aluminium cube sectioned open to reveal a second shell inside it, then a third, and at the centre a small crimson-lit core, on a dark surface.

Threat Intel2 Sept 2026

CISA catalogued three exploited flaws this evening that nobody has reported. Two of them cannot be found by vendor name.

Kestra, LiteLLM and Starlette joined the KEV catalogue at 16:54 UTC with no coverage at all. All three were months old, and the titles misdescribe two of them.

An ornate brass keyhole escutcheon on a dark aged wooden door, with a thin beam of warm light escaping through the open keyhole into the darkness, lit by a crimson rim light.

Threat Intel2 Sept 2026

A Chinese-speaking crew turned Brazilian .gov sites into SEO infrastructure. Their Apache module strips the CSP on three paths and leaves the rest correct.

Check Point Research documents Gambling Goblin compromising Brazilian government web servers since mid-2025. The module reverse-proxies three hardcoded prefixes and strips their Content-Security-Policy.

An antique brass klaxon alarm horn lying on a dark surface, its flared bell facing the camera, lit by a crimson rim light with the left half of the frame falling away into near black.

Threat Intel2 Sept 2026

SonicWall, JFrog and Langflow were reported exploited on one source each. CISA catalogued two of them eight hours later.

Read from the KEV feed and the NVD API on 2 September 2026: three loud exploitation claims, none catalogued, and a substitution trap where searching KEV by product name clears the wrong identifier.

Page 20

Tuesday 1 September

A small sealed brown cardboard shipping carton on a dark matte surface, its shipping label torn away leaving a pale rectangle of adhesive residue, lit by a cold indigo rim light.

Threat Intel1 Sept 2026

Packagist removed thirteen malicious Composer themes. A fourteenth from the same operator is still listed.

Thirteen trojanised theme packages were pulled after Socket published. Checked by hand today: a sibling package Socket named as a sleeper is still installable, and the malicious jQuery is still on GitHub.

A blank manila envelope on a dark wooden desk, one corner slightly lifted to reveal darkness inside, lit by a cold indigo rim light.

Threat Intel1 Sept 2026

A fake coding test forbade AI assistants. The researchers say an AI would have caught the malware.

Kaspersky documents a recruitment lure whose README bans AI code review, declares the trojanised file bug-free, and ships a malicious package inside the archive so no scanner ever sees it.

A brass key blank lying on a dark workbench beside a pile of identical uncut blanks, lit by a cold indigo rim light against black.

Threat Intel1 Sept 2026

A 9.8 JFrog Artifactory bypass was exploited four days after disclosure. The patch shipped on day one.

CVE-2026-82329 lets an unauthenticated attacker reach admin on Artifactory. JFrog fixed it the same day it was published, its advisory misstates the 7.146 fix, and the exploitation claim rests on one firm.

A single strip of yellow and black striped hazard tape stretched across a dark open doorway, with the empty unlit room clearly visible beyond it.

Threat Intel1 Sept 2026

UAC-0099 hid a nuclear weapons essay in malware to stop AI analysis. Nobody has tested whether it works.

ESET disclosed an inert comment block designed to make AI analysis refuse. The whole primary source is three posts on X, nobody tested it, and Endor Labs documented the same trick in June.

Monday 31 August

Two identical blank sheets of heavy cream paper on a dark desk, the top one curling to reveal the copy beneath, captioned DoJ corrected one copy, the other still says victims, one of two, and 17 articles never corrected at all

Threat Intel31 Aug 2026

DoJ corrected its China hacking claim. It fixed one copy of two, and 17 articles still carry the original

A correction that reaches one of two identical documents has not been made. Both copies are live on justice.gov and they say different things.

Sunday 30 August

A single glass tick box glowing cyan on a black background, captioned: eight stages in, not one is a CVE. 0 CVEs, no patch exists, because nothing is broken.

Threat Intel30 Aug 2026

TerminalFix chains eight stages from a fake CAPTCHA to a reverse tunnel, and never touches a CVE. There is nothing to patch

Every stage uses documented Windows behaviour, so there is no patch, no KEV deadline and no scanner finding. The controls that reach it had to be set before the lure arrived.

Monday 17 August

A brass pipe T-junction with one branch sealed by a blank cap, macro close-up against dark industrial pipework, the pipes edge-lit in cyan and the capped branch catching crimson light.

Threat Intel17 Aug 2026

Four CVEs let agent tools run without the model running at all. The guardrails were not bypassed, they were never asked

Black Hat 2026 research with four identifiers, one unpatched open-source path AWS has assigned to the customer, and the reason prompt hardening measured the wrong component.

Friday 14 August

A recessed circular power button ringed in crimson light on the dark brushed-metal front panel of a rack-mounted server, macro close-up, with a cyan edge light down the left side of the chassis.

Threat Intel14 Aug 2026

An Akira affiliate rebooted a host into Safe Mode to blind EDR. Defender named the ransomware and could not remove it for 28 minutes

Huntress documents the first Akira use of Safe Mode boot. The full technique chain contains no exploit at all, the encryptor starved of virtual memory and failed, and the victim is still extortable.

A single brass key resting on a stack of dark rectangular plates, macro close-up on a near-black surface, lit cyan along one side of the stack and crimson along the other.

Threat Intel14 Aug 2026

Jewelbug ran espionage and crypto fraud from one panel, with 580,000 stolen cookies logged. Symantec's own attribution doubts it was one team

One million implant check-ins, more than 15 government webmail tenants watering-holed by a single script tag, and a supplier relationship the coverage flattened into one team.

Thursday 13 August

A square fingerprint reader sensor set into the brushed dark deck of a laptop, macro close-up beside the corner of a trackpad, ringed in crimson light against near-black.

Threat Intel13 Aug 2026

Unit 42 extracted every synced passkey from a Windows machine. Ars Technica called it a nothingburger

Pass-ta-key, Silver and Golden: account takeover with no user interaction, forged biometric verification, and every synced key exported for resale. Why two outlets reached opposite conclusions from the same paper.

A sealed cream business envelope on a dark desk, lit by a crimson rim light, with the flag of North Korea hanging blurred in deep shadow behind it.

Threat Intel13 Aug 2026

The August zero-day was North Korea. The part still working is the job advert

Check Point attributes the August zero-day to Lazarus. The exploit is fixed, but the delivery chain, a recruiter approach and an SEO-ranked impersonation site, is untouched and still works.

Wednesday 12 August

A brass key inserted in a lock cylinder with the pins visible, lit by a deep crimson rim light against a near-black background.

Threat Intel12 Aug 2026

Microsoft patches 420 flaws and 3 zero-days. Not one zero-day is rated Critical

Counted from Microsoft's release document: 420 CVEs, 176 elevation of privilege, 119 in Office. Why the published totals disagree, and why severity-first triage gets this month wrong.

Page 21

Tuesday 21 July

Threat Intel21 Jul 2026

Credentials did not stop mattering. The DBIR headline was read wrong

Initial access changed. The attack path did not. Half of ransomware victims with a credential leak saw it within 95 days of the attack, a window long enough to act in, if anyone is looking.

That is every briefing in this category