The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 13 to 24 of 240 briefings

Saturday 24 October

Threat Intel24 Oct 2026

Collabora CODE CVSS 9.2 command injection added to CISA KEV

Technical autopsy of Nextcloud Collabora Online Built-in CODE Server CVE-2026-110447: CVSS 9.2 command injection in proxy.php, three-day CISA KEV remediation order, webshell deployment, and password vault scraping.

Threat Intel24 Oct 2026

Kaspersky says BlackX bootkit, similar to BlackLotus, bypassed Secure Boot on patched PCs without PCA 2011 revocation

What Kaspersky GReAT reports about BlackX, a UEFI bootkit that exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys on fully patched Windows machines, what it does not state, and which Microsoft revocation steps defenders have to run themselves.

Friday 23 October

Threat Intel23 Oct 2026

CISA adds Plex2Shell unauthenticated RCE chain to Known Exploited Vulnerabilities catalog

Technical autopsy of the Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656): loopback token theft, x264 dump-yuv carrier video writes, unsigned codec dlopen execution, and CISA KEV listing.

Threat Intel23 Oct 2026

GitLab issues emergency patches for maximum severity CVSS 10.0 integer overflow RCE

Technical breakdown of GitLab emergency release: CVSS 10.0 integer overflow CVE-2026-110264, Ruby Onigmo regex compiler heap corruption, 4,535-day exposure window, and seven-train backport matrix.

Threat Intel23 Oct 2026

Microsoft says Storm-0940 used ARTEX AI agents to try sign-ins at more than 2,250 tenants via ConnectWise

What Microsoft says Storm-0940 did with the ARTEX AI framework after the ConnectWise Cloud Backup compromise: sign-in attempts to more than 2,250 tenants, a password spray that peaked at 2,900 failures a minute, and what is not established.

Threat Intel23 Oct 2026

LiteLLM supply chain attack poisons official PyPI and Docker builds with Python startup backdoor

LiteLLM version 1.107.0 compromised on PyPI and Docker Hub via stolen GitHub CLI OAuth tokens, injecting a Python startup backdoor and credential stealer.

Threat Intel23 Oct 2026

HPE Aruba patches 72 vulnerabilities in wireless operating systems including eight CVSS 10.0 RCE flaws

HPE Aruba bulletin HPESBNW05162 patches 72 flaws across AOS-8 and AOS-10 wireless operating systems, including eight CVSS 10.0 remote code execution vulnerabilities.

Threat Intel23 Oct 2026

Threat actor k0t breaches enterprise firewalls exposing 70,000 credentials for ransomware gangs

Group-IB and NyxLab expose threat actor k0t compromising Fortinet and Palo Alto firewalls to harvest 70,000 credentials feeding Qilin and The Gentlemen ransomware.

Threat Intel23 Oct 2026

Russia-aligned UAC-0099 and Sandworm hid a backdoor's C2 in the Yggdrasil mesh before a data wipe in Ukraine, ESET reports

ESET's account of an intrusion at a Ukrainian grain logistics company: UAC-0099 initial access, a Go backdoor with its command server inside the Yggdrasil mesh, and a Sandworm wipe two months later.

Threat Intel23 Oct 2026

Microsoft 365 token spraying compromises 79 organisations across 70 days without passwords

What Huntress reported on 22 October 2026: a ten-week Microsoft 365 token-spraying campaign, at least 497 successful sign-ins at 79 organisations, rogue Entra devices, replaced MFA methods and hidden inbox rules, and what Huntress advises defenders to do.

Threat Intel23 Oct 2026

PHP advisory on CVE-2026-115560: an unlikely session upload RCE vector, with the fix due in the next regular release

What PHP's informational advisory on CVE-2026-115560 says and leaves out: the conditions it names, the one-line setting it suggests, the missing versions, severity score and release date, and what The Register, The Hacker News and Cloudflare add.

Threat Intel23 Oct 2026

Node2Shell Brotli briefing withdrawn: it duplicated another briefing and named Node.js versions that do not exist

Why this Node.js Brotli briefing was withdrawn and where the account of CVE-2026-111497 is.