The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 61 to 84 of 240 briefings

Wednesday 14 October

A dark server rack in cold blue light. A glass-fronted rack stands open on the right with plain grey servers, and one server tray is slid forward. In it sits a smaller matte black box with a hairline crack across its lid that runs out over the grey floor of the tray, with a thin cyan light along the line. The left half is empty dark blue, with the headline and a stat drawn over it: 2 OF 5.

Threat Intel14 Oct 2026

Vghost: kernel fix dated 3 August, demos 12 October, and 2 of 5 tested distributions still without a fix

What the kernel commit, the CVE record and the vendor trackers establish about Vghost, what found by AI does and does not say, how seven raters score it from 6.4 to 8.8, which of 26 releases have a fix, the UK clocks and a ranked checklist. Defender level only.

A dark equipment cabinet in cool light. A large brass screw-threaded coupling with a visible thread and a backed-off nut hangs in a dense sweep of cables in cyan, blue, white, grey, red and amber that all run into it. Blank recessed plates sit on unmarked rack units behind. The left half is empty dark blue, with the headline and a stat drawn over it: 616 days.

Threat Intel14 Oct 2026

curl's first High flaw in 1,099 days was in 13 releases; curl lists eight conditions for code execution

The arithmetic behind curl's High flaw, what its advisory states and leaves out, where libcurl hides, what the distributions had fixed on 14 October, the UK patch clocks as read, and a ranked checklist. Defender level only.

A plain black rack-mounted network appliance with two blank pill-shaped recesses on its bezel takes in a line of five blank cream envelopes on a steel roller conveyor. The envelope nearest the viewer carries one blank red wax seal. The left half is empty dark blue, with the headline and a stat drawn over it: 30 days.

Threat Intel14 Oct 2026

Cisco's second exploited email gateway flaw in 30 days: its two fixed builds were named on 14 September

What Cisco's 14 October advisory for CVE-2026-76519 states and leaves out, the two conditions and the scanner update that fixes it, the 16.0 gap, what Shadowserver's count can and cannot say, what NCSC, Cyber Essentials and the ICO say as read, and an ordered checklist. Defender level only.

A dark print shop. On the right, four taut cords hold rows of identical pale paper sheets, each printed with the same blank page layout of empty rounded bars and boxes and no writing. One sheet in the front row has been ripped away, leaving a ragged strip in two wooden pegs and a crumpled scrap on the floor. The left half is empty dark blue, with the headline and a stat drawn over it: 34 names.

Threat Intel14 Oct 2026

Microsoft's temporary order moves 34 names under five domains; its billion messages are not a victim count

What Microsoft's announcement, its sworn declarations and the court order actually count: 34 names moved, a billion messages with no stated method, 1.1 million dollars traced against tens of millions claimed, and what UK organisations should do.

A dark small-shop back room. A row of plain white and grey boxes with blank label wells sits on a shelf above a counter holding a switched-off terminal screen on a stand and a pale grey card reader, with a dark server tower at the far right. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 177 listed.

Threat Intel14 Oct 2026

Adobe's October bulletins list 177 flaws; every one rated critical sits in AEM, ColdFusion or Commerce

What Adobe's 11 bulletin pages establish and do not, why 176 is 177 entries and 175 ids, how priority 2 and 3 compare with the Cyber Essentials and NCSC clocks, the Commerce hotfix beside a no exploits line, and a ranked checklist. Defender level only.

A dark desk after hours. On the right, three tall stacks of grey bound ledgers with blank label plates stand beside a closed silver laptop, and a cream folder with one red paper clip lies on the laptop. The left is empty dark navy with the headline and stat drawn over it: seven totals for one release, one exploited CVE, 7 TOTALS.

Threat Intel14 Oct 2026

Microsoft's October Patch Tuesday has seven totals, 1,407 to 1,417, and one exploited CVE, not three zero-days

Which rule produces each outlet's total and Critical count, what zero-day did and did not mean, what Microsoft states about the exploited Windows Shell bug, why its risk cohorts omit it, and the UK clocks and an ordered checklist, and September's release set beside it.

A dark desk in cold blue light. An unmarked pale grey desktop document scanner holds a stack of blank white sheets in its input tray and feeds one blank sheet out of the front. Behind it a flat monitor shows a grid of twelve blank page thumbnails, one outlined in cyan. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 10,240.

Threat Intel14 Oct 2026

Ghostscript CVE-2026-39919: two exploits failed 10,240 times on other builds and worked on the matching one

What Wordfence's post establishes about a Ghostscript PDF flaw, where BleepingComputer's wording departs from it, what 0 of 10,240 does and does not say, which distributions have a fix, the UK patching clocks, and a ranked checklist. Defender level only.

Tuesday 13 October

A dark equipment rack holding one plain grey rack-mounted network appliance, with a row of empty network jacks and a blank rounded plate on its faceplate, black blanking panels above and below, and a pale blue network cable hanging in a coil from a hook on the rack post. The left half is empty dark blue, with the headline and a stat drawn over it: Fully patched, still exploited, 2 of 3.

Threat Intel13 Oct 2026

A fully patched Ivanti VPN gave an attacker root through a three-flaw chain; two flaws are fixed, one is not

What Ivanti, Volexity, NVD and CISA each state about the Connect Secure chain, the fixed builds and their dates, what the record does not establish, the UK clocks and duties, and an ordered checklist. Defender level only.

A dark corporate server room in cool blue light. On the right stands a tall black rack of enterprise servers whose faceplates carry blank pill-shaped recesses, with grey cables down its side. In front of it a stainless steel service cart carries a flat monitor showing an empty form made only of blank rounded fields and an empty button. The left half is dark and carries the headline, SAP's 10.0 flaw sits in a library you must upgrade yourself, and the stat 53 days.

Threat Intel13 Oct 2026

SAP's October 10.0 is a library customers must upgrade, with a fixed build dated 53 days before the advisory

What SAP's 13 October overview and GitHub advisory state about the 10.0 OAuth2 SSRF in the Cloud SDK for Python, the 22 rows counted, who acts on each Critical row, the UK clocks to 27 October and an ordered checklist. Defender level only.

A dark data-centre aisle in cool blue light. A black rack on the right is filled with network switches whose faceplates carry empty port openings and blank pill-shaped recesses, with bundles of grey and teal patch cables falling in loops. One small amber port light glows on one switch. The left half is dark and empty and carries the headline, Cisco's October bundle, 16 of 35 CVEs score 9.0 or more, and the stat 20 of 35.

Threat Intel13 Oct 2026

Cisco's October bundle: 16 of 35 CVEs score 9.0 or more, 7 in NX-OS, and 20 are umbrella IDs with no bug count

What Cisco's 14 advisories state and do not: the count by product and score, what a 'hardening release' is, five critical NX-OS flaws gated by features, fixed releases per train, the UK 14-day clock to 21 October, and an ordered checklist. Defender level only.

A dark data centre aisle. On the right, a black server rack holds four matching pale grey rack servers above a row of blank black drives, with a flat black status panel at the top, switched off and blank, and one small amber light at its corner. More racks recede into the dark. The left half is empty dark blue, with the headline and a stat drawn over it: 32 DAYS.

Threat Intel13 Oct 2026

Progress published 31 MarkLogic flaws 32 days after the fixes shipped, and the August fixes miss them

What Progress's bulletin, release notes and CVE records establish about 31 MarkLogic flaws, what they leave out, the arithmetic behind 32 days, the Cyber Essentials clock, UK guidance and an ordered checklist. Defender level only.

Monday 12 October

A dark server room corner in cool blue light. A pale grey rack-mounted backup appliance with rows of blank black drive bays and a dark blank status display stands in an open black rack beside a tall graphite tape library whose smoked window shows shelves of plain black cartridges with empty pale label windows. The left half is empty dark blue, with the headline and a stat drawn over it: 9.4.

Threat Intel12 Oct 2026

Veeam CVE-2025-64393: a Backup Viewer can run code on the backup server, in version 12 only

What Veeam's advisories establish about the Backup Viewer flaw and the Cloud Connect file read, what they leave out, the fixed build for each version line, the evidence on exploitation, what UK guidance and Cyber Essentials say, and a ranked checklist. Defender level only.

Page 7

Monday 12 October

A dark equipment room. A grey rack-mount server is pulled forward out of a black cabinet on the right, its status lights dark. A blank paper calendar page with one amber square is clipped to the cabinet rail beside it, and a blank card tag with an amber band hangs from the server handle. The left half is empty dark navy carrying the headline Struts mapper flaw: two of four lines are end of life, and the words No patch.

Threat Intel12 Oct 2026

Struts CVE-2026-104711: two of four affected lines are end of life; the remedy is a mapper change, not a patch

What Apache's bulletins, the CVE records and CISA's catalogue establish about CVE-2026-104711 and its three companions, the version-line matrix, the end-of-life dates, what they leave out, UK controls and a ranked checklist. Defender level only.

A dark help-desk desk at night. A white desk telephone with blank round keys and its handset in the cradle sits beside an open laptop whose screen shows an empty remote-session window with blank pills, and a black headset with a boom microphone lies in front. The left half is empty dark blue, with the headline and a stat drawn over it: 42 of 50 recent victims were law firms.

Threat Intel12 Oct 2026

Luna Moth leak: no new malware, a phone call and a remote tool, and Check Point treats the files as unverified

What Check Point's analysis of the Luna Moth Files establishes, what it leaves open, the arithmetic behind it, what the NCSC, Cyber Essentials v3.3 and the ICO say, and a ranked checklist for a group that steals data without encrypting it. Defender level only.

A dark server room. A tall black server rack with plain blank drive bays stands on the right beside a wall-mounted board of three rows of five empty rounded tiles joined by thin lines, like a pipeline. One tile in the middle row carries a single small lit amber lamp. The left half is empty dark blue, with the headline and a stat drawn over it: CVSS 10.0.

Threat Intel12 Oct 2026

GitLab says CVE-2026-97229 needs no account, the third regex-titled critical in 19 days

One CVSS metric separates 12 October's critical from the two regex criticals of 23 September: the attacker no longer needs an account. What GitLab states, what it leaves out, the count checked, CISA and the NVD at 14:52 BST, the UK 14 day clocks and an ordered checklist.

A dark server room. A black equipment rack holds six flat grey firewall appliances with blank label plates, and a single small cyan status light is lit on the third. Beside it a plain paper calendar page is taped to the rack, a grid of empty squares with one square outlined in cyan marker. The left half is empty dark blue, with the headline and a stat drawn over it: 149 days.

Threat Intel12 Oct 2026

Palo Alto's CVE-2026-0257 advisory was 149 days old when ReliaQuest warned ransomware groups still use it

A computed gap, 149 days, from Palo Alto's advisory to ReliaQuest's warning; the fixed versions per train; four scores for one flaw; what no source establishes; UK controls; and an ordered checklist. Defender level only.

A dark desk in low blue light with one open laptop on the right. Its screen is tiled with about three dozen small identical blank windows, each with a pale title bar and two grey bars, and the keys are blank. The left half is empty dark blue, with the headline and a stat drawn over it: 51 agent files, WordPress flaws fixed on 17 July, 32 shells.

Threat Intel12 Oct 2026

CyberXero: 51 Claude Code agent files, 32 shells in 61 seconds, and WordPress flaws fixed on 17 July

What SOCRadar's CyberXero report establishes, what it does not, the arithmetic behind 32 shells in 61 seconds and 564,073 of 628,000 records, the public fixes and CISA KEV status for the named CVEs, what the model's maker has said, UK controls, and a ranked checklist. Defender level only.

A dark designer's desk at night. A large monitor shows a half-built web page layout made only of blank rounded shapes, with a dark indigo side panel and a bright canvas. Beside it stands a small industrial warning lamp with a smoked amber dome, switched off. A white mouse and stylus lie on a grey felt mat. The left half is empty dark blue, with the headline and a stat drawn over it: 21:47 UTC.

Threat Intel12 Oct 2026

Bricksforge CVE-2026-85097: exploit attempts began on disclosure day; the changelog has no 3.1.8.10 date

What the primary records establish about CVE-2026-85097: the first attempt, a fix date nobody publishes, three flaws in five weeks on one database's dates, a spray of 56 requests from 44 addresses, UK controls and an ordered checklist. Defender level only.

Sunday 11 October

A dark room with an open paper desk diary on a walnut desk at the right of the picture. Its pages hold seven empty ruled boxes with blank pills at the top, and one amber sticky note lies in a box on the right page. The left is empty dark, with the headline and a stat drawn over it: 0 clicks.

Threat Intel11 Oct 2026

Calendar phishing arrives with zero clicks on Google Workspace's default; Sublime's 33,000% is a projection

What Google's and Microsoft's own pages say about the default, which settings stop a calendar lure and which do not, the number behind "exponential", what no source establishes, UK reach of the NCSC and Cyber Essentials, and a ranked checklist. No lure is printed.

A dusk landscape. A pale grey outdoor steel cabinet stands in the right foreground with its door swung open and a brass padlock hanging open from the hasp, an empty blank plate on the door. The base of a white wind turbine tower rises behind it and rows of solar panels recede to an amber horizon. The left half is empty dark blue, with the headline and a stat drawn over it: 93% solar.

Threat Intel11 Oct 2026

Modat counts 8,547 wind and solar systems reachable online: 93% solar, a floor, and the UK outside its scope

What Modat's pages, Reuters and others establish about 8,547 exposed wind and solar systems, the arithmetic behind the percentages, why the UK is outside the count, what the NIS Regulations and the NCSC say, and a ranked checklist. Nothing identifying a site is printed.

Saturday 10 October

A dark room with two near-identical brass nameplates side by side on a walnut desk at the right of the picture. Each has four screws and an empty recessed panel. The right plate is slightly darker and redder, with a small dimple at each end of its panel. The left is empty dark, with the headline and a stat drawn over it: 29 letters.

Threat Intel10 Oct 2026

Two characters put 20 lookalike domains past Chromium's checks: a 29-letter list and an 8,462-domain list

What the researchers' write-up and Chromium's own source establish about two characters that pass the browser's lookalike checks, what is not stated, why a list fails open for a letter or a brand it does not hold, UK controls and a ranked checklist. No lookalike domain is printed.

A dark desk at night with a black smartphone lying face up at the centre right. Its screen shows an update page made only of empty pills: one short title pill, three wide grey pills and a blank pale cyan button. Beside it stand a small closed steel padlock and, behind it, a blank white card. The left is empty dark, with the headline and a stat drawn over it: 239 days.

Threat Intel10 Oct 2026

P7 DarkSword is a kit for iOS 18.4 to 18.7, and Apple fixed all six of its flaws by 11 February 2026

What iVerify, Google, Lookout, Censys, Report URI and Apple establish about P7 DarkSword: the six flaws and their fixes, which iPhones are exposed, what is not stated, UK controls and a ranked checklist. No indicators are printed.

A dark room with a silver laptop on a walnut desk at the right of the picture. Its screen shows a download page made only of empty pills, a browser strip, and a pale cyan button above a blank command panel with an empty copy square. Beside it stands a blank white card and a blank amber sticky note lies on the desk. The left is empty dark, with the headline and a stat drawn over it: 4 stops.

Threat Intel10 Oct 2026

A Google ad showed bing.com; four stops later a fake Claude installer's copy button swapped the command

What Push Security and BleepingComputer establish about the Adception campaign: the four stops, the cloaking gates, the swapped clipboard command, what is not stated, UK controls for Macs and a ranked checklist. No attacker addresses are printed.

Friday 9 October

A dark room with a slim black monitor on a walnut desk at the right of the picture. Its screen shows one window outlined in pale cyan, made only of empty pills and blank rounded squares, with a small cyan pill at the top right. Beside it stands a compact black tower computer with a mesh front and one amber status light. The left is empty dark, with the headline and a stat drawn over it: 107 days.

Threat Intel9 Oct 2026

AnyDesk Linux: the researchers' root exploit came 107 days after a release logged only as a crash fix

What AnyDesk's changelogs, its post on X, the researchers' post, NVD, CVE.org and CISA's catalogue establish about the AnyDesk Linux flaw: dates, scope, the relay dispute, the UK timescales and a ranked checklist.

Show 12 more